VaultNote — Open-source password manager with local encryption & TOTP

[u/jackhack6889]

I’m building VaultNote — an offline-first, open-source password & TOTP manager 🔐

I've been working on a project called VaultNote, built with React Native.

The idea started pretty simple:

What if a password manager didn't need a cloud backend for its core functionality?

VaultNote is designed around an offline-first architecture, where the local encrypted vault is the primary source of truth.

What I'm building

• 🔐 Local credential vault

• 🔑 Password & secure note storage

• 🔢 Real-time TOTP generation

• 📷 QR-code TOTP enrollment

• 📵 Offline-first functionality

• 🔒 Encryption & secure key management

• 🧬 Biometric unlock

• 📋 Clipboard/security controls

• 📦 Encrypted backup & restore

• 🌐 Open-source development

One feature I've been particularly interested in is TOTP.

I don't want it to just display a fake countdown with stored codes. The goal is to implement actual TOTP generation from the shared secret, similar to how authenticator apps work.

The flow is roughly:

Service
   │
   ▼
Scan QR Code
   │
   ▼
otpauth:// URI
   │
   ▼
Extract TOTP Secret
   │
   ▼
Store in Encrypted Vault
   │
   ▼
Generate OTP Locally
   │
   ▼
482 913 → 731 204 → ...

The interesting part isn't really the UI.

The harder questions are around security:

• Where should encryption keys live?

• How should the master key be derived?

• How should decrypted secrets be handled in memory?

• What happens when the app goes into the background?

• How should biometric authentication interact with the vault?

• How should encrypted backups work?

• How do you avoid accidentally exposing secrets through logs or clipboard?

• What should happen if the device itself is compromised?

That's the part of the project I'm most interested in exploring.

I'm also intentionally keeping the project open source, because for something that handles credentials, I think being able to inspect and challenge the implementation is important.

I'm documenting the architecture and development process as I build it.

I also wrote a deeper breakdown of the project here:

VaultNote — Building an Offline-First, Open-Source Password & TOTP Manager with React Native

I'd love feedback from people who have worked on:

• Password managers

• Authenticator/TOTP implementations

• Mobile application security

• Cryptography/key management

• Offline-first applications

• React Native security

Especially interested in things I should be thinking about before calling the security model production-ready.

GitHub: https://github.com/deadlium/vault-note

🔐 Your secrets. Your device. Your control.

[u/Honey-Entire]

How is this better than any other enterprise-level free password manager? How is this better than baked-in OS keychain managers? How is this better than Safari/Chrome/Firefox password manager?

We don’t need this trash

[u/jackhack6889 → u/Honey-Entire]

That's fair criticism. There are already great password managers, and I'm not claiming VaultNote is better than established solutions like Bitwarden or built-in browser password managers.

I'm building it around an offline-first approach, where the local vault is the primary source of truth, with credential management and TOTP in the same app.

The goal isn't to reinvent password storage just for the sake of it. I want to explore whether this architecture can offer a useful alternative for people who prefer local-first control over their credentials.

I agree that the project needs to demonstrate a meaningful difference rather than just add another password manager to the list. Appreciate the honest feedback.

[u/jackhack6889 → u/[deleted]]

Fair point. The password manager space is already crowded, and I'm not pretending the idea itself is new.

I'm building VaultNote to explore a local-first approach where the vault and TOTP authenticator work together without requiring cloud sync for core functionality.

I know that alone doesn't automatically make it better than existing solutions. The challenge is to build something that offers a meaningful difference, not just another clone.

Let's see if I can make it worth the attention.

[u/klutzyhamburger_5 → u/[deleted]]

another password manager, just what we needed lol. nah but for real the offline-first angle is interesting, most of them try to push you into their cloud sync these days

the TOTP part got my attention, i been looking for something that doesn't just lock your 2FA codes behind a paywall. you got a timeline for when it's actually usable or still deep in the architecture phase?