nexoniarz/NexoPass
Watch
1
0
Fork
You've already forked NexoPass
 0
mirror of https://github.com/Nexoniarz/NexoPass.git synced 2026-11-03 04:24:28 +00:00
Code Issues Projects Releases Packages Wiki Activity

NexoPass 1.3.0: Linux and Windows app, project split into shared/android/desktop

Browse source 
The PC app (Compose Multiplatform) uses the nexopass script's files, so the
window and the terminal share accounts, site lists and the app password.
Clipboard copies carry KDE's password hint. GitHub Actions builds the APK,
.deb, .rpm, .msi and a portable Windows zip, and checks that passwords
still match the script.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Nexoniarz 2026-10-08 14:59:04 +02:00
commit 987cea431f
42 changed files with 1475 additions and 557 deletions
Download patch file Download diff file Expand all files Collapse all files

61
README.md
View file

@ -1,6 +1,8 @@
<p align="center"><img src="desktop/icons/nexopass.png" width="96" alt=""></p>
# NexoPass
Passwords derived from a master, nothing stored in plain text. Android app, compatible with the `nexopass` script for NixOS.
Passwords derived from a master, nothing stored in plain text. For Android, Linux and Windows, and as the `nexopass` command on NixOS.
*Made by **Nexoniarz***
@ -12,29 +14,68 @@ Every password is computed, never saved:
password = Argon2id(master, site + version + type + login)
```
The same master gives the same password on the phone and on the PC. What the app does store is the site list of each account (which sites, their current version, an archive of old versions), encrypted with AES-256-GCM under a key derived from that account's master.
The same master gives the same password on every device. What NexoPass does store is the site list of each account (which sites, their current version, an archive of old versions), encrypted with a key derived from that account's master.
- **Accounts.** Several accounts, each with its own master and site list. Switch between them in one tap.
- **App unlock.** A PIN, password or pattern (required), plus fingerprint/face if you want. It unlocks every account; the master is only typed to create or recover an account. The unlock data is encrypted twice, once with the Android Keystore (hardware), and too many wrong tries remove it.
- **Accounts.** Several accounts, each with its own master and site list. Switch in one click.
- **App unlock.** A password or PIN (on the phone also a pattern and fingerprint/face) unlocks every account; a master is only typed to create or recover an account. Too many wrong tries remove it, and you recover with the master.
- **Data breach?** Rotate the site to a new version; the old one goes to the archive.
- **Passwords** of 5-15 words or 12-64 characters, chosen per site.
- **Typos** like "discrod" get a "did you mean discord?".
- **Export/import**: OpenPGP files, the same format as the script, so the site list moves between phone and PC.
- No internet permission, screenshots blocked, clipboard cleared after a while, auto-lock, no cloud backup.
- **Export/import** with encrypted OpenPGP files, the same format everywhere, to move a site list between phone and PC.
- Clipboard cleared after a while (and hidden from KDE's clipboard history), auto-lock, screenshots blocked on the phone, no internet access at all.
Android 8.0 or newer. Material 3, light and dark theme, animated background.
## Download
Grab the files from [Releases](../../releases):
| | File |
|---|---|
| Android 8.0+ | `NexoPass-<version>-android.apk` |
| Windows | `NexoPass-<version>.msi` (installer) or `...-windows-portable.zip` |
| Debian/Ubuntu | `nexopass-gui_<version>_amd64.deb` |
| Fedora/openSUSE | `nexopass-gui-<version>.x86_64.rpm` |
| NixOS | see [nexoniarz-config-nixos](https://github.com/Nexoniarz/nexoniarz-config-nixos) |
The PC versions bring their own Java runtime: nothing else to install.
## The PC app and the `nexopass` command
On Linux the window and the command use the same files, so accounts, site lists and the app password are shared:
```
~/.local/share/nexopass/accounts/<name>/vault.gpg site list
~/.local/share/nexopass/keyring.gpg + keyring.meta app password
~/.config/nexopass/config settings
```
On Windows the same layout lives in `%APPDATA%\NexoPass`.
## Project layout
```
shared/ code both apps compile
src/.../core/ passwords, vault, export (no UI)
src/.../app/ app state and the platform interface
src/.../ui/ Compose UI: every screen
resources/ word list, license
android/ Android app: Keystore unlock, biometrics, file pickers
desktop/ Linux/Windows app (Compose Multiplatform): script-compatible storage
```
## Build
```
./gradlew assembleRelease
./gradlew :android:assembleRelease # APK
./gradlew :desktop:run # run the PC app
./gradlew :desktop:packageDeb # or packageRpm, packageMsi (on Windows)
./gradlew :desktop:test # passwords must match the script
```
The APK lands in `app/build/outputs/apk/release/`. Release builds are signed with the debug key so they install right away; use your own key if you publish the app.
GitHub Actions builds everything on each push; a `v*` tag publishes a release.
## Compatibility
`Core.kt` must stay byte-for-byte compatible with the script: same Argon2id parameters, salts, word list (EFF Large Wordlist, checked by SHA-256), site-name rules and password layout. Changing any of them changes every password.
`shared/src/.../core/Core.kt` must stay byte-for-byte compatible with the script: same Argon2id parameters, salts, word list (EFF Large Wordlist, checked by SHA-256), site-name rules and password layout. `CompatibilityTest` holds values produced by the script; changing any of them changes every password.
## License