LocalPass

Project-aware credential vault and autofill for local development.

Working on several apps at once means logging into localhost:3000, localhost:5173, 127.0.0.1:8080 and app.hiveit.local dozens of times a day, each with its own admin, developer and customer test accounts. Ordinary password managers file all of that under "localhost", so every project's accounts pile into one confusing bucket. LocalPass files credentials under projects instead. A project owns one or more site patterns (localhost:3000, *.hiveit.local, https://app.local/admin), and when you land on a login page LocalPass resolves which project you are in and offers only that project's accounts. Autofill that stays out of your way • An inline picker appears when you focus a login field; one click fills username and password. • Detects plain forms, single-page apps, forms inserted late, and username-first flows. • Optional auto-fill per project with a designated default account. • Fills only what you click, only into visible fields, and never submits the form for you. Save as you go • Submit a login and LocalPass offers to save it to the right project, or to update a changed password. • "Never for this site" is one click away. A real vault • Master password, plus passkeys (Windows Hello, Touch ID, security keys) and a one-time recovery code as extra unlock methods. • AES-256-GCM encryption of every record, PBKDF2 key derivation, auto-lock, locked after every browser restart by default. • Encrypted export and import for backups and moving between machines. • Password generator wherever you type a password. • The toolbar icon shows how many saved accounts match the current site; while locked it shows a lock instead, because even that count is vault data. Private by construction • No account, no sync, no telemetry — LocalPass has no network access at all, enforced by its content security policy. • Works on localhost, 127.0.0.1 and [::1] out of the box; asks for permission per host when you add any other site, and gives it back when you remove the site. • Threat model, cryptography design and the security review are published with the source. Built for developers and QA engineers who run many web apps on one Chrome profile. Not a general-purpose password manager and not a team-sharing tool.