LessPass is a stateless, open-source password manager written in TypeScript and licensed under GPL-3.0 that generates passwords from a master password instead of storing them in a synchronized vault, built for individuals and self-hosters who want the same passwords on every device without syncing an encrypted database.

What it is

LessPass is a password manager built on derivation rather than storage. Instead of maintaining an encrypted vault and replicating it between devices, LessPass computes a password from a master password plus the parameters of the site in use, so the same result appears anywhere the generator runs. The project lives in the open-source security and identity space: the repository is TypeScript, carries 6,061 stars, 365 forks, 34 open issues and a last push of 2026-09-13, and the code is published under the GNU GPLv3, with the LessPass mobile package bi-licensed under both the Mozilla Public License Version 2 and the GNU GPLv3.

The concrete problem it solves is vault synchronization. The README states the goal plainly: stop wasting time synchronizing an encrypted vault, and remember one master password to access passwords anywhere, anytime, with no sync needed. That single change removes the vault service, the sync conflict, and the question of which device holds the newest copy. LessPass also offers an optional server component for connected use over its API, and the project credits the original idea to the masterpassword app.

Key capabilities

• Stateless password generation from a master password, with no encrypted vault and no synchronization step.
• Browser extensions for Chrome and Firefox, opened with Ctrl + Shift + L, or Command + Shift + L on macOS, which copy the generated password to the clipboard.
• A command line interface installed with python3 -m pip install --user lesspass and documented through lesspass --help.
• Mobile applications published for iOS, Android and F-Droid.
• A web password generator on the project site, with the extensions recommended over it for security reasons.
• A self-hostable LessPass server exposing an API, alongside third-party API server implementations catalogued in the project wiki.
• Licensing under GPLv3 for the main project, with the mobile package under MPL-2.0 and GPLv3.

Who uses it and how

• Individuals who need credentials in a browser, on a phone and in a terminal, and want one master password to cover all three.
• Self-hosters running their own LessPass server for connected use, now the required path for anyone outside the original user base.
• Existing users of the hosted LessPass service, which stays open to them while new registrations are closed.
• Terminal-oriented users who generate passwords through the CLI rather than a graphical client.
• Deployments using DigitalOcean App Platform, which the project currently relies on for automatic server deployment.

Getting started

Install the CLI with python3 -m pip install --user lesspass, or take a client instead: the Chrome or Firefox extension, the iOS, Android or F-Droid application, or the generator at https://www.lesspass.com. Connected use requires self-hosting a LessPass server, since the hosted server is closed to new registrations.

How it compares

The README names the masterpassword app as the original idea behind the project, so LessPass sits in that derivation-based lineage rather than in the vault-synchronization family of password managers. Where similar tools keep a stored, encrypted database, LessPass keeps nothing to sync. The project also points to third-party API server implementations in its wiki as alternatives to its own server, while warning that their support for the latest API is not guaranteed.

When to use it — and when not to

Anyone choosing LessPass for connected use must operate a LessPass server themselves, and the promised DigitalOcean self-hosting guide remains an open todo item, so deployment currently rests on automatic App Platform deployment and existing documentation. The hosted service is closed to new registrations, and the project cautions that third-party server implementations may not fully support the latest API, which makes the server path the weakest link. A website translation task is also still open, so non-English coverage on the site should not be assumed.

python3 -m pip install --user lesspass
lesspass --help