jarmo

secrets-web

Go2020–2020

jarmo / secrets-web

secrets-web

Not Yet Another Password Manager self-hosted Web app written in Go using libsodium

Explore on GitHub Read Hacker News discussions

2Distinct people

4Mentions

0Explicit recommenders

42GitHub stars

REPOSITORY AT A GLANCE

What to know before exploring

What it is

Not Yet Another Password Manager self-hosted Web app written in Go using libsodium

GitHub

Where it is used

No documented product use has been verified yet.

What people are saying

No recommendation phrase was found in the indexed comments.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

No other repository is repeatedly linked in the same discussions.

This week on Hacker News

Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 3:56:07 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by 3-hour interval4 dated mentions

Observed mentions: 2020-01-02 13:06:07 UTC to 2020-01-04 11:46:11 UTC.

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges

UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
Period	Start (UTC)	End (exclusive, UTC)	Mentions	Submissions	Comments
Jan 2, 12:00	2020-01-02 12:00:00 UTC	2020-01-02 15:00:00 UTC	1	1	0
Jan 2, 15:00	2020-01-02 15:00:00 UTC	2020-01-02 18:00:00 UTC	0	0	0
Jan 2, 18:00	2020-01-02 18:00:00 UTC	2020-01-02 21:00:00 UTC	0	0	0
Jan 2, 21:00	2020-01-02 21:00:00 UTC	2020-01-03 00:00:00 UTC	0	0	0
Jan 3, 00:00	2020-01-03 00:00:00 UTC	2020-01-03 03:00:00 UTC	0	0	0
Jan 3, 03:00	2020-01-03 03:00:00 UTC	2020-01-03 06:00:00 UTC	0	0	0
Jan 3, 06:00	2020-01-03 06:00:00 UTC	2020-01-03 09:00:00 UTC	0	0	0
Jan 3, 09:00	2020-01-03 09:00:00 UTC	2020-01-03 12:00:00 UTC	0	0	0
Jan 3, 12:00	2020-01-03 12:00:00 UTC	2020-01-03 15:00:00 UTC	0	0	0
Jan 3, 15:00	2020-01-03 15:00:00 UTC	2020-01-03 18:00:00 UTC	0	0	0
Jan 3, 18:00	2020-01-03 18:00:00 UTC	2020-01-03 21:00:00 UTC	1	0	1
Jan 3, 21:00	2020-01-03 21:00:00 UTC	2020-01-04 00:00:00 UTC	0	0	0
Jan 4, 00:00	2020-01-04 00:00:00 UTC	2020-01-04 03:00:00 UTC	0	0	0
Jan 4, 03:00	2020-01-04 03:00:00 UTC	2020-01-04 06:00:00 UTC	0	0	0
Jan 4, 06:00	2020-01-04 06:00:00 UTC	2020-01-04 09:00:00 UTC	0	0	0
Jan 4, 09:00	2020-01-04 09:00:00 UTC	2020-01-04 12:00:00 UTC	2	0	2

What Hacker News says

4 sources

jarm0·Jan 4, 2020

All security headers were supposed to be added by gin-contrib/secure middleware (https://github.com/gin-contrib/secure). However, your comment made me verify that it actually works as it was doing at the time of starting to use that. I noticed that headers were not present - it seems that somehow the order of registering middlewares had made it not work. I've released a new version where they all work https://github.com/jarmo/secrets-web/releases/tag/v1.0.1 Thanks for making me look into it and finding out about this problem.

In Show HN: Self-hosted and self-contained web app password manager written in Go

jarm0·Jan 4, 2020

I was using LastPass at first. I even paid them some money to have support on mobile. I didn't like LastPass because their UI was just really ugly and I saw some security problems being discovered. Switched to mitro since it was free and UI wasn't bad. Worked great, but unfortunately they ceased their service. I got fed up with switching these services so often and didn't want to do the same thing yet again (and can't remember what alternatives existed back then). Since security has been my point of interest for years I decided to look into building my own so that I would actually know for sure (as long as cryptography itself is secure) about all the parts - how secrets are encrypted, how they're stored and how they're synced. It was spring 2015 when I wrote my first password manager in Ruby. It worked great, but the problem was that I di

Read the rest

dn't want to install Ruby and its gems on every system where I wanted to access my secrets so I went with Go and this is where secrets-cli (https://github.com/jarmo/secrets-cli/) grew up. After that I decided that I'd also want to access secrets via browser and created secrets-web (https://github.com/jarmo/secrets-web/). Web and CLI versions are interoperable between each-other so that you can use either one of them or both at the same time.

In Show HN: Self-hosted and self-contained web app password manager written in Go

juliend2·Jan 3, 2020

Congrats for doing this! Regarding this: > There should be no problems with running on a publicly-accessible server [...] Looking at the https://github.com/jarmo/secrets-web source code, I don't see any place where it sets the `Content-Security-Policy` header. Or am I missing something?

In Show HN: Self-hosted and self-contained web app password manager written in Go

jarm0·Jan 2, 2020Submission

Show HN: Self-hosted and self-contained web app password manager written in Go

I have written a passwords/secrets manager for my personal needs. Maybe it solves some of your problems too. It is written in Go and is a self-contained executable for a small web-app: https://github.com/jarmo/secrets-web There is also a CLI version if that is your taste: https://github.com/jarmo/secrets-cli To read about more technical details, look into the core repository at https://github.com/jarmo/secrets Any questions/comments/suggestions are welcome in here or via GitHub pull requests.

40 points · Open discussion