Password Savers CLI

A simple encrypted password manager CLI built with Node.js.

This project creates a local password vault protected by one master password. Service metadata stays readable for quick listing, while the actual passwords are encrypted before they are written to disk.

Features

• Create a vault with a strong master password
• Save or update passwords for services like GitHub, Gmail, or Netlify
• Copy passwords to the clipboard by default instead of printing them
• Print a password only when explicitly requested with --show
• List saved entries without decrypting and exposing every password
• Delete saved entries with confirmation
• Generate strong random passwords
• Limit repeated unlock attempts in a single CLI session
• Store vault data in the user's home directory by default

Security

This CLI uses:

• crypto.scrypt() with a stronger work factor to derive an encryption key
• aes-256-gcm to encrypt and authenticate saved secrets
• a random salt and IV for each vault state
• in-session retry limits when the master password is wrong

The master password is not stored directly in the vault file.

Installation

Install globally to use it as a command:

npm install -g password-savers-cli
password-savers help

Commands

Initialize the vault

password-savers init

Creates a new encrypted vault and asks the user to set a strong master password.

Re-initialize the vault

password-savers reinit

Prompts for confirmation, then replaces the existing vault with a new empty vault and a new master password.

Add or update a password

password-savers add github

Prompts for:

• service name
• username or email
• password

If the service already exists, the entry is updated.

Get a saved password

password-savers get github

By default, the password is copied to the clipboard and not printed to the terminal.

If you explicitly want it printed:

password-savers get github --show

List saved entries

password-savers list

Shows saved services and usernames without printing passwords.

Delete a saved entry

password-savers delete github

Prompts for confirmation before deleting the entry.

Generate a password

password-savers generate 24

Generates a random password. If no length is provided, the default length is 20.

Vault Location

By default, the vault is stored here:

~/.password-savers-cli/vault.json

You can override the location with an environment variable:

PASSWORD_SAVERS_DIR=/tmp/password-savers-test password-savers list

Notes

• Keep your master password safe. If you forget it, the encrypted vault cannot be recovered.
• reinit is destructive and removes all existing saved passwords after confirmation.
• Clipboard support depends on platform tools such as pbcopy, wl-copy, xclip, xsel, clip, or powershell.