mirror of
https://github.com/Nexoniarz/NexoPass.git
synced 2026-11-03 04:24:28 +00:00
987cea431f
The PC app (Compose Multiplatform) uses the nexopass script's files, so the window and the terminal share accounts, site lists and the app password. Clipboard copies carry KDE's password hint. GitHub Actions builds the APK, .deb, .rpm, .msi and a portable Windows zip, and checks that passwords still match the script. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
82 lines
3.4 KiB
Markdown
82 lines
3.4 KiB
Markdown
<p align="center"><img src="desktop/icons/nexopass.png" width="96" alt=""></p>
|
|
|
|
# NexoPass
|
|
|
|
Passwords derived from a master, nothing stored in plain text. For Android, Linux and Windows, and as the `nexopass` command on NixOS.
|
|
|
|
*Made by **Nexoniarz***
|
|
|
|
## How it works
|
|
|
|
Every password is computed, never saved:
|
|
|
|
```
|
|
password = Argon2id(master, site + version + type + login)
|
|
```
|
|
|
|
The same master gives the same password on every device. What NexoPass does store is the site list of each account (which sites, their current version, an archive of old versions), encrypted with a key derived from that account's master.
|
|
|
|
- **Accounts.** Several accounts, each with its own master and site list. Switch in one click.
|
|
- **App unlock.** A password or PIN (on the phone also a pattern and fingerprint/face) unlocks every account; a master is only typed to create or recover an account. Too many wrong tries remove it, and you recover with the master.
|
|
- **Data breach?** Rotate the site to a new version; the old one goes to the archive.
|
|
- **Passwords** of 5-15 words or 12-64 characters, chosen per site.
|
|
- **Typos** like "discrod" get a "did you mean discord?".
|
|
- **Export/import** with encrypted OpenPGP files, the same format everywhere, to move a site list between phone and PC.
|
|
- Clipboard cleared after a while (and hidden from KDE's clipboard history), auto-lock, screenshots blocked on the phone, no internet access at all.
|
|
|
|
## Download
|
|
|
|
Grab the files from [Releases](../../releases):
|
|
|
|
| | File |
|
|
|---|---|
|
|
| Android 8.0+ | `NexoPass-<version>-android.apk` |
|
|
| Windows | `NexoPass-<version>.msi` (installer) or `...-windows-portable.zip` |
|
|
| Debian/Ubuntu | `nexopass-gui_<version>_amd64.deb` |
|
|
| Fedora/openSUSE | `nexopass-gui-<version>.x86_64.rpm` |
|
|
| NixOS | see [nexoniarz-config-nixos](https://github.com/Nexoniarz/nexoniarz-config-nixos) |
|
|
|
|
The PC versions bring their own Java runtime: nothing else to install.
|
|
|
|
## The PC app and the `nexopass` command
|
|
|
|
On Linux the window and the command use the same files, so accounts, site lists and the app password are shared:
|
|
|
|
```
|
|
~/.local/share/nexopass/accounts/<name>/vault.gpg site list
|
|
~/.local/share/nexopass/keyring.gpg + keyring.meta app password
|
|
~/.config/nexopass/config settings
|
|
```
|
|
|
|
On Windows the same layout lives in `%APPDATA%\NexoPass`.
|
|
|
|
## Project layout
|
|
|
|
```
|
|
shared/ code both apps compile
|
|
src/.../core/ passwords, vault, export (no UI)
|
|
src/.../app/ app state and the platform interface
|
|
src/.../ui/ Compose UI: every screen
|
|
resources/ word list, license
|
|
android/ Android app: Keystore unlock, biometrics, file pickers
|
|
desktop/ Linux/Windows app (Compose Multiplatform): script-compatible storage
|
|
```
|
|
|
|
## Build
|
|
|
|
```
|
|
./gradlew :android:assembleRelease # APK
|
|
./gradlew :desktop:run # run the PC app
|
|
./gradlew :desktop:packageDeb # or packageRpm, packageMsi (on Windows)
|
|
./gradlew :desktop:test # passwords must match the script
|
|
```
|
|
|
|
GitHub Actions builds everything on each push; a `v*` tag publishes a release.
|
|
|
|
## Compatibility
|
|
|
|
`shared/src/.../core/Core.kt` must stay byte-for-byte compatible with the script: same Argon2id parameters, salts, word list (EFF Large Wordlist, checked by SHA-256), site-name rules and password layout. `CompatibilityTest` holds values produced by the script; changing any of them changes every password.
|
|
|
|
## License
|
|
|
|
Apache License 2.0, see [LICENSE](LICENSE) and [NOTICE](NOTICE).
|