Spassword
Spassword is a zero-knowledge Chrome password manager available at spassword.net. All encryption and decryption happen on the user's device. The Cloudflare backend only stores ciphertext, so the company cannot access user passwords. The extension includes a web vault, autofill, password generator, multi-device sync, offline support, TOTP-based 2FA codes, and passkey creation/use. The homepage states that all core features are live and in daily use. Security architecture is built around a master password that never leaves the device. Argon2id derives a master key in memory, HKDF splits it into an encryption key and an auth key, and the auth key produces a one-way verifier sent for login. The server only sees ciphertext and the verifier, never the plaintext password, master key, or encryption key. Login, registration, and account-lookup endpoints are rate-limited to block brute-force attempts and account enumeration. Spassword is distributed as a downloadable ZIP for Chrome and Edge (Manifest V3) and must be loaded in developer mode. The extension is described as free and provides a changelog and blog. It is available in English and Chinese.
- Category
- Password Managers
- Pricing
- Unknown
Problem solved
Spassword solves the problem of trusting a password manager with plaintext credentials by providing a zero-knowledge architecture where the service provider never sees master passwords or decrypted vault entries, while still offering autofill, sync, 2FA, and passkey support.
Use cases
- Saving and autofilling website login credentials
- Managing 2FA/TOTP codes alongside passwords
- Synchronizing a password vault across multiple devices
- Generating strong, random passwords
- Storing credentials for offline use
- Using passkeys on supporting websites
Audience
- Business Users
- Hobbyists
- Developers
Pros
- Zero-knowledge architecture: server never sees plaintext passwords
- Free with built-in 2FA (TOTP)
- Supports passkeys
- Multi-device sync via Cloudflare Durable Objects
- Works offline
Cons
- Requires manual developer-mode loading; not an official one-click store install
- Only supports Chromium-based browsers (Chrome and Edge)
- No mobile or desktop app mentioned
- Open-source status and third-party audit not documented
- Pricing model is unclear beyond being described as free
Official website: https://spassword.net/
Canonical LambdaBase page: https://www.lambdabase.com/tools/spassword