lockbox
An offline-first password manager for your terminal
A minimal, secure, cross-platform CLI password manager written in Go. Fully offline — your vault is one encrypted file on your machine, with no cloud, no network, and no telemetry.
$ lockbox unlock
master password: ********
✓ unlocked · auto-locks in 15m
$ lockbox get github -p | pbcopy
✓ copied to clipboard
$ lockbox totp github
481 920
$
// what you get
One encrypted file
Your whole vault is a single AES-256-GCM blob at ~/.lockbox/store.vault, mode 0600. No database, no sync server.
Argon2id key derivation
Your master password is stretched with Argon2id (64 MiB, 3 passes, 4 lanes) before it ever touches the vault.
In-memory sessions
A small agent holds the key in memory and auto-locks after 15 minutes idle. Type your master password once.
Built-in 2FA
Store TOTP seeds in the same vault. lockbox prints RFC 6238 codes when you need them — no second app.
Multiple vaults
Keep work and personal credentials in separate files, each with its own master password and session.
Fully offline
No cloud, no network, no telemetry. Your secrets never leave the machine they were created on.
// offline by design
lockbox keeps your credentials in one encrypted file on your own machine. No browser extension, no service to trust, nothing syncing in the background.
There is no password recovery. Forget your master password and the vault is gone — that is the security guarantee, not a missing feature.
// install
# Homebrew (macOS)
brew install triforge0/tap/lockbox
# or build from source
git clone https://github.com/triforge0/lockbox
cd lockbox && go install ./cmd/lockbox
Current Focus
We are actively building and improving Sloop, and exploring new pilot projects.