adrianbrisca/password-manager repository overview

Poți copia direct descrierea de mai jos în Docker Hub:

# Password Manager

A self-hosted password manager built with Node.js, React, PostgreSQL, and Docker.

Password Manager provides personal and team vaults, encrypted credential storage, MFA, emergency access, password-health monitoring, import/export tools, and administrative controls through a responsive web interface.

## Features

- Personal password, card, and secure-note storage
- Folders, nested folders, and categories
- Shared team vaults with role-based permissions
- TOTP multi-factor authentication
- Password generator and password-health reports
- Password history and deleted-item recovery
- Emergency-access workflow
- User and team administration
- JSON import and export
- Legacy Password Manager export compatibility
- Bitwarden-compatible import
- Multiple interface themes
- Login rate limiting and account lockout
- Argon2id password hashing
- AES-256-GCM encrypted vault data
- PostgreSQL persistence

## Docker images

Backend:

```text
adrianbrisca/password-manager

Frontend:

adrianbrisca/password-manager-frontend

Available tags:

• latest — latest stable release
• 2.6.3 — pinned release version
• Commit SHA tags — immutable build references

For production deployments, pinning a specific release such as 2.6.2 is recommended instead of relying on latest.

⁠Quick start

Download the Docker Compose configuration:

curl -O https://raw.githubusercontent.com/Liionboy/password-manager/master/docker-compose.hub.yml
curl -O https://raw.githubusercontent.com/Liionboy/password-manager/master/.env.example
cp .env.example .env

Generate secure secrets:

openssl rand -hex 32
openssl rand -hex 32
openssl rand -base64 24
openssl rand -base64 24

Edit .env and configure at least:

JWT_SECRET=your-s…cret
REFRESH_SECRET=your-s…cret
ENCRYPTION_KEY=exactl…ters
PM_DB_PASSWORD=your-s…word

DB_HOST=postgres
DB_USER=postgres
DB_NAME=passwordmanager

NODE_ENV=production
PORT=5000
BASE_URL=http://localhost:1532

ALLOW_FIRST_ADMIN=true

Start the application:

docker compose -f docker-compose.hub.yml up -d

Open:

http://localhost:1532

⁠Creating the first administrator

On a new installation with an empty database, temporarily set:

ALLOW_FIRST_ADMIN=true

Register the first account through the web interface. That account becomes the application administrator.

Immediately change the setting back to:

ALLOW_FIRST_ADMIN=false

Then restart the backend:

docker compose -f docker-compose.hub.yml up -d --force-recreate backend

There is no default admin/admin account.

⁠Updating

Back up the PostgreSQL database before every production update.

To update images using the same tag:

docker compose -f docker-compose.hub.yml pull
docker compose -f docker-compose.hub.yml up -d

For predictable deployments, edit the Compose file and pin both application images to the same release:

image: adrianbrisca/password-manager:2.6.2

image: adrianbrisca/password-manager-frontend:2.6.2

⁠Security

The containers use several runtime-hardening measures:

• Unprivileged runtime users
• Read-only root filesystems
• All Linux capabilities dropped
• no-new-privileges
• Internal-only backend networking
• Minimal multi-stage backend runtime without npm
• Reproducible production dependency installation
• Automated npm audit, CodeQL, Semgrep, and secret scanning
• Automated Trivy scanning for backend and frontend images
• Docker Hub publication blocked when High or Critical vulnerabilities are detected

The v2.6.3 backend and frontend images were released with zero vulnerabilities detected by Trivy.

This application performs server-side encryption and is not a zero-knowledge password manager. Protect the server, PostgreSQL database, environment file, encryption key, backups, and reverse proxy as sensitive infrastructure.

For internet-facing deployments, use HTTPS through a trusted reverse proxy and do not expose the backend port directly.

⁠Backup

The PostgreSQL volume contains the persistent application data. Back it up regularly and test restoration procedures.

Keep backups encrypted and store copies separately from the application server. The encryption key from .env is required to decrypt stored vault data.

⁠Source code and releases

GitHub:

https://github.com/Liionboy/password-manager⁠

Releases:

https://github.com/Liionboy/password-manager/releases⁠

⁠License

See the GitHub repository for licensing information, source code, documentation, and release notes.