🔐 RageVault

Your passwords, self-hosted and end-to-end encrypted. A password manager you fully own — CLI, a full-screen TUI, a self-hosted web UI and a browser extension. Import your whole vault from Bitwarden / 1Password / Proton Pass in one drop, then get categories & folders, user roles, a serious password generator, live 2FA codes, a WireGuard one-command setup — and only standard, auditable crypto (scrypt + AES-256-GCM).

Designed, built & maintained by SoyRage Agency · https://soyrage.es/

⚡ New here? Install in 60 seconds.

⚠️ Use a VPN. Seriously.

RageVault is self-hosted and meant to live on a private network — never exposed to the open Internet. Run the built-in setup to put it behind a WireGuard tunnel in one command:

ragevault wg          # installs & configures WireGuard, prints a client QR

It's optional — for purely local / personal use you don't need it — but if the vault is reachable from another machine, put a tunnel in front of it.

📸 A look

Terminal dashboard — a searchable folder tree with a live detail panel (no shortcuts to learn)

As you move, the right panel shows the item's URL, strength and a live breach check (Have I Been Pwned, k-anonymity) — weak or leaked passwords are flagged in red with a one-click "regenerate".

Type to search, ↑/↓ to move, Enter opens a menu of actions — reveal, copy, copy 2FA, rename, regenerate, move, delete:

Self-hosted web UI — the SoyRage cream/ink/blue line

A full-screen animated unlock, then your vault. Credential cards with the real site favicon, reveal / copy / live 2FA:

🔁 Coming from another manager? One drop and you're in.

Export → drop the file → done. RageVault auto-detects Bitwarden, 1Password, Proton Pass, LastPass and any CSV — no manual field mapping, and the file is parsed locally (nothing is uploaded):

Make it yours — themes, a guided tour & in-app settings

Pick a theme (Cream, Dark, Midnight, Forest), change your master password, and a first-run interactive tour points out every feature:

Browser extension — auto-detects your server on the network

A cinematic connect screen finds your self-hosted server, then one click copies, autofills or reads a 2FA code:

Unlock screens: TUI · web

What it is

A password manager you fully own. The vault is a small encrypted file (or, soon, a self-hosted server): a KDF salt and two AES-256-GCM ciphertexts. Without your master password there is nothing to read — not even the titles.

• End-to-end encrypted — scrypt (memory-hard KDF) derives a key that wraps a random data key; AES-256-GCM encrypts everything, authenticated.
• Blur by default — secrets show as ••••••; you explicitly reveal or copy, so nobody sees every password at a glance.
• Categories, folders, tags, favourites, password history.
• Users & roles — owner / admin / member / viewer with capability checks.
• Generator — random, passphrase, or pronounceable, with a real entropy meter.
• No exotic dependencies — the crypto is the Node standard library. Read it.

Full design, threat model and the 30+-feature roadmap: docs/ANALYSIS.md.

⬇️ Which download do I want?

RageVault ships in a few shapes — they all open the same encrypted vault, so pick one or mix them:

| You want… | Download | Who it's for | |---|---|---| | A desktop app — a window with an icon, no terminal | Windows: RageVault.Setup.<ver>.exe · macOS: RageVault-<ver>-arm64.dmg · Linux: RageVault-<ver>.AppImage | 👉 Most people. Windows installs to Start menu + system tray. | | A self-hosted server / CLI / TUI on a box you reach over VPN | ragevault-<os>-x64 (one self-contained file) — or npx ragevault if you have Node | Home-labbers. Run ragevault serve or the terminal UI. | | Autofill in your browser | ragevault-extension.zip | Anyone — it auto-detects your server and fills logins. | | Your phone | ragevault-<ver>.apk (Android) — or add the web UI to your home screen (PWA) | Android users. Enable "install unknown apps" to sideload. |

🖥️ Desktop app (Windows) — double-click and go

Prefer a real app window over the terminal? The RageVault desktop app is a normal Windows program: install it, launch it from the Start menu, and your vault opens in its own window with the RageVault icon — no console, no config. It runs the encrypted server privately in the background (loopback only) and stores your data in your user profile.

Lives in the system tray, shows native notifications for updates, and first run walks you through a “create your vault” screen + a guided tour. macOS (.dmg, Apple Silicon) and Linux (.AppImage) builds are on the latest release too (unsigned — right-click → Open on macOS).

⚡ Or the CLI / server — one self-contained file, no Node, no npm

The command-line + self-hosted-server build is one file per device (Windows, macOS, Linux). Ideal for a home-lab box you reach over your VPN, or the terminal/TUI.

⬇️ Download for your device

…or see all files & the changelog on the latest release. macOS/Linux: chmod +x <file> && ./<file>.

🟢 Or one command (auto-downloads + adds to PATH)

irm https://raw.githubusercontent.com/soyrageagency/ragevault/main/scripts/install.ps1 | iex

curl -fsSL https://raw.githubusercontent.com/soyrageagency/ragevault/main/scripts/install.sh | sh

🟣 Or, if you already have Node

npx ragevault            # run it once, no install
npm i -g ragevault       # or install the command globally

🔵 Or download the binary by hand

Grab the file for your device from the latest release, make it runnable, and go:

| Device | File | Run it | |---|---|---| | Windows 64-bit | ragevault-windows-x64.exe | double-click, or .\ragevault-windows-x64.exe | | macOS (Apple Silicon) | ragevault-macos-arm64 | chmod +x ragevault-macos-arm64 && ./ragevault-macos-arm64 | | macOS (Intel) | ragevault-macos-x64 | chmod +x … && ./ragevault-macos-x64 | | Linux 64-bit | ragevault-linux-x64 | chmod +x ragevault-linux-x64 && ./ragevault-linux-x64 |

Re-run the installer any time to update — and RageVault tells you in-app when a new version ships.

🚀 First run — a guided 3-step wizard

Just type ragevault (or the binary name). It walks you through everything — no config files, ever:

1)  ragevault init      →  names your vault, asks you to set a master password
                           (twice), and creates the encrypted file. That's it.

2)  ragevault add       →  a friendly prompt: title, username, URL — then offers
                           to *generate* a strong password for you. Repeat freely.

3)  ragevault tui       →  the full-screen dashboard. Arrow keys to move, r to
                           reveal, c to copy, t for a 2FA code, l to lock, q to quit.

Prefer a browser? ragevault serve opens the web UI at http://127.0.0.1:8722, and the browser extension autofills logins. Want it reachable from your phone/laptop safely? ragevault wg sets up WireGuard and prints a QR to scan — optional, and skippable for personal use.

Your vault lives at ~/.ragevault/vault.ragevault (override with RAGEVAULT_HOME), written owner-readable only. Back it up any time with ragevault backup.

📱 On your phone (Android & iOS) — install the app

RageVault's web UI is an installable app (PWA) — no store, no APK sideloading:

1. On the machine that holds your vault, run ragevault serve (ideally behind your VPN — ragevault wg).
2. On your phone's browser, open the server's address (e.g. http://10.72.0.1:8722 over WireGuard).
3. Chrome/Android: menu → "Install app" / "Add to Home screen". Safari/iOS: Share → "Add to Home Screen".

It launches full-screen like a native app, with the RageVault icon. Your data stays on your server.

Prefer a real .apk? Download ragevault-<ver>.apk from the latest release (built on CI) and sideload it — enable "Install unknown apps" for your browser/files app. It's a thin, secure shell that opens your self-hosted vault. Source + signed-build steps: mobile/ and docs/ANDROID.md.

🔁 Switch in seconds — import from anywhere

Leaving another manager shouldn't be a chore. RageVault reads the export files the big managers already give you and detects the format for you — no column-mapping, no cleanup.

| Coming from | Export you give RageVault | |---|---| | 🟦 Bitwarden | Tools → Export vault → .json | | ⬛ 1Password | export a vault as .csv | | 🟪 Proton Pass | Settings → Export → .json | | 🟥 LastPass | Advanced → Export → .csv | | ⬜ Anything else | any .csv with url/username/password columns |

In the web UI: unlock → ↓ Import → drop the file. On the CLI:

ragevault import bitwarden-export.json     # auto-detects Bitwarden/1Password/Proton/LastPass/CSV

Everything is parsed on your machine — the file never leaves it.

🧩 Browser extension — install in 3 steps

Detect the current site, copy or autofill credentials, grab a 2FA code, and generate passwords — right from the toolbar.

1. Download ragevault-extension.zip (button above) and unzip it.
2. Chrome / Edge / Brave: open chrome://extensions, turn on Developer mode, click Load unpacked, pick the unzipped folder. (Firefox: about:debugging → Load Temporary Add-on → pick manifest.json.)
3. Click the RageVault icon, enter your server address + master password — done.

Extensions can only be truly one-click from the Chrome Web Store / Firefox AMO (store publishing is on the roadmap). Until then, the unpacked install above takes about 20 seconds.

npm install && npm run build
node dist/ragevault.js init        # or: npm run dev
npm test                           # 14 crypto/vault/TOTP tests
npm run build:release              # cross-build binaries for all 4 devices → build/release/

Security at a glance

| Property | How | |---|---| | Key derivation | scrypt, N=2¹⁶, per-vault random salt (params stored & upgradable) | | Encryption | AES-256-GCM, random 96-bit IV per record, AAD-bound | | Key hierarchy | master → KEK → wraps a random DEK (password change ≠ re-encrypt everything) | | Integrity | GCM auth tag — wrong password / tampering fails loudly | | At rest | only salt + ciphertext on disk; no plaintext leak (tested) | | Verified | npm test — 14 crypto / vault / TOTP tests (round-trip, wrong-pw, tamper, re-wrap, RFC 6238 vectors) |

RageVault is young (v0.2). The cryptographic core is standard and tested, but please review the code and threat model before trusting it with production secrets — and keep it behind that VPN.

What's inside (already shipped)

End-to-end encrypted vault · categories · nested folders · tags & favourites · password history · users & roles (owner/admin/member/viewer) · blur → reveal → copy everywhere · random / passphrase / pronounceable generator with an entropy meter · live TOTP 2FA codes (RFC 6238) · weak/reused/old health audit + opt-in HIBP breach check · one-drop import (auto-detects Bitwarden/1Password/Proton Pass/LastPass/CSV)

• JSON/CSV export · encrypted backups (backup/restore) · atomic crash-safe writes · auto-lock + clipboard auto-clear · privacy-preserving site favicons (server-fetched & cached) · custom emoji icons · 4 themes (Cream/Dark/Midnight/Forest) · change master password in-app · interactive first-run tour · Windows desktop app (Electron) with system tray + native update / broadcast notifications · CLI · TUI · web UI · browser extension (auto-detects your server) · WireGuard bootstrap · one-file standalone install + in-app update & global-announcement channel.

Roadmap: per-user cryptographic sharing (X25519) · multi-device sync · expiring share links · custom item types & attachments · Android client · audit log. Full threat model, crypto design and the 35-item feature map: docs/ANALYSIS.md.

🤝 Free & open source

RageVault is 100% free and MIT licensed — no paywall, no "pro" tier, no telemetry. Read every line, self‑host it forever, and contributions are very welcome: open an issue, suggest a feature, or send a pull request.

Want to contribute?

git clone https://github.com/soyrageagency/ragevault && cd ragevault
npm install && npm run build && npm test     # 14 tests should pass
npm run dev                                   # hack away

💙 Support the project

RageVault is free and MIT licensed. If it protects your logins, you can support development on PayPal — a ⭐ on the repo helps just as much.

🖋️ Credits & License

Designed, built and maintained by SoyRage Agency — https://soyrage.es/

Released under the MIT License — use it, modify it, self-host it, ship it commercially.

If you build something on top of it, a link back to soyrage.es is appreciated but never required.

🛠️ Maintainer? See docs/MAINTAINERS.md for how to broadcast announcements and ship updates through updates.json.

⚠️ RageVault is a password manager and still young (v0.2). The cryptographic core is standard and tested, but review the code and the threat model before trusting it with production secrets — and keep it behind your VPN.

© 2026 SoyRage Agency — https://soyrage.es/

Made with ❤ in Valencia, Spain.