About OpenSesame

OpenSesame is a local-first, end-to-end-encrypted vault. A master password derives the key that opens the vault, and that key stays on the device. The project also provides an auth broker for static websites and scoped, time-boxed grants for agents.

Who it is for

People who want a password manager they can host themselves; developers who need a static site to authenticate without receiving a password; and teams that want agents to use narrow credentials with an audit trail.

How it works

Vault items are encrypted in the browser. The public Pages build is a static PWA. It has no server-side vault key, no hosted credential store, and no password recovery. Access to a resource is granted through the vault's share ledger, not by copying a secret into a website.

Project

The source code, security policy, and documentation are public in the OpenSesame repository.