NullPass

Local password manager. Everything stays on your machine — no accounts, no sync, no telemetry.

---

Requirements

python 3.9+
pip install cryptography argon2-cffi Pillow

tkinter ships with Python. On Linux it's sometimes separate:

# Arch
sudo pacman -S tk

# Ubuntu / Debian
sudo apt install python3-tk

# Fedora
sudo dnf install python3-tkinter

Running

python nullpass.py

First launch asks for a language (English / Русский), then lets you set a master password and create the vault.

Installing

Linux

chmod +x install.sh && ./install.sh

Installs to ~/.local/share/NullPass, creates a launcher at ~/.local/bin/nullpass and a .desktop entry.

Windows

install.bat

Icon

The bundled icon is generated by make_icon.py. Run it once to produce icon.png and icon.ico:

python make_icon.py

Features

• AES-256-GCM encryption, Argon2id key derivation
• Password generator — random, passphrase, PIN, memorable
• TOTP / 2FA codes with live countdown
• Password strength meter with entropy and crack-time estimate
• Have I Been Pwned check (k-anonymity, first 5 chars of SHA1 only)
• Security audit — weak, reused, outdated passwords, score gauge
• Password history per entry (last 20), one-click restore
• Custom fields with optional masking
• Soft delete with trash and restore
• Multi-select with bulk delete and category move
• CSV import/export (compatible with Bitwarden, 1Password, Chrome)
• Encrypted .npx export/import (AES-256-GCM, separate password)
• Timestamped backups
• Dark and light theme
• English and Russian interface
• Auto-lock, clipboard auto-clear

Shortcuts

Ctrl+N	New entry
Ctrl+F	Search
Ctrl+G	Toggle generator panel
Ctrl+L	Lock
Ctrl+D	Duplicate entry
Ctrl+E	Edit entry
Ctrl+Return	Save dialog
Esc	Close dialog / clear search

Data

Platform	Location
Linux / macOS	~/.local/share/NullPass/
Windows	%LOCALAPPDATA%\NullPass\

Files: vault.np (vault), config.json (settings), vault_backup_*.np (backups).

Security notes

• Master password is never stored — only used to derive the encryption key via Argon2id
• Key is stored as a bytearray and zeroed via ctypes.memset on lock
• Vault writes are atomic: written to a .tmp file, then renamed
• AES-GCM authentication tag detects any tampering on next unlock
• HIBP: only the first 5 hex characters of the SHA1 hash are sent to the API

License

MIT