Padloc is a free, open source password & secret management project written in JavaScript and released under AGPL-3.0. It has 2,922 GitHub stars, 266 forks and 105 open issues, and was last pushed 18 months ago. On this registry it ranks #5 of 7 tracked projects in Password & Secret Management, and is listed as an open source replacement for 1 paid product, with 5 head-to-head comparisons available. It gained 1 stars over the last 6 tracked days.

What is Padloc?

What it is

Padloc is an open source password and data manager for individuals and teams, distributed under the AGPL-3.0 license and written primarily in JavaScript and TypeScript. It lives in the JavaScript and TypeScript ecosystem, and the repository is organized as a monorepo split into separate packages: a core logic library, a web-based UI component library, a backend server, a Progressive Web App client, a localization package, an Electron desktop app, a Cordova project for iOS and Android, a Tauri-based cross-platform native app, and a browser extension. The project positions itself as an open alternative to 1Password, and its stated design centers on end-to-end encryption, with a dedicated security whitepaper describing the design.

The concrete problem Padloc addresses is that password and secret management is normally delivered as a paid, closed hosted service, which leaves users and teams unable to inspect the cryptography, self-host the backend, or control where their encrypted vault data lives. Padloc provides the server, the clients, and the shared core logic as separate installable packages, so an operator can run their own instance rather than depending on a vendor. Because the client is a Progressive Web App and additional native and desktop shells are provided, the same encrypted data can be reached from a browser, a desktop application, a mobile build, or a browser extension.

Key capabilities

  • End-to-end encryption for stored passwords and data, with a security whitepaper documenting the design.
  • Password generator built into the client.
  • Progressive Web App client, installable and usable from a browser.
  • Desktop application built with Electron.
  • Cross-platform native app powered by Tauri.
  • Cordova project for building iOS and Android applications.
  • Browser extension for the Padloc client.
  • Localization package providing translations and other localization-related resources.

Who uses it and how

  • Individuals who want a self-hosted password vault instead of a paid hosted subscription.
  • Teams that need shared password and secret management on infrastructure they control.
  • Self-hosters who deploy the backend server together with the web client as the minimum viable instance.
  • Developers who build and distribute their own desktop and mobile builds from the Electron, Tauri, and Cordova packages.
  • Users who want browser-extension access alongside the web and native clients.

Getting started

Clone the repository, run npm ci, then npm start, and the web client becomes available at http://localhost:8080. Development mode runs with npm run dev, starting the backend server on port 3000 and the PWA on port 8080, both configurable through the PL_TRANSPORT_HTTP_PORT and PL_PWA_PORT environment variables. A DigitalOcean deploy button is also provided.

When to use it — and when not to

Padloc is a reasonable fit when the goal is replacing a paid product such as 1Password with something that can be self-hosted and audited, and the repository provides the server and client packages needed to do so. A self-hoster must operate the backend server and the web client at minimum, and the README notes that in-depth guides for hosting a production instance and for building distributable desktop and mobile apps are still marked as coming soon. The project also carries 105 open issues, which is worth weighing before committing to it for a team deployment.

project readme (upstream, from github) — read inline

Padloc

Simple, secure password and data management for individuals and teams.

Deploy to DigitalOcean

About

This repo is split into multiple packages:

Package Name Description
@padloc/core Core Logic
@padloc/app Web-based UI components
@padloc/server The Backend Server
@padloc/pwa The Web Client, a Progressive Web App.
@padloc/locale Package containing translations and other localization-related things
@padloc/electron The Desktop App, built with Electron
@padloc/cordova Cordova project for building iOS and Android app.
@padloc/tauri Cross-platform native app, powered by Tauri
@padloc/extension Padloc browser extension

How to use

As you can see in the About section, there are lots of different components to play with! But at a minimum, in order to set up and use your own instance of Padloc you'll need to install and configure the Server and Web Client. In practice, there a few different ways to do this, but if you just want to install and test Padloc locally, doing so is really quite easy:

git clone [email protected]:padloc/padloc.git
cd padloc
npm ci
npm start

The web client is now available at http://localhost:8080!

In-depth guides on how to host your own "productive" version of Padloc and how to build and distribute your own versions of the desktop and mobile apps are coming soon!

Contributing

All kinds of contributions are welcome!

If you want to report a bug or have a feature request, please create an issue.

If you have question, feedback or would just like to chat, head over to the discussions section.

If you want to contribute to Padloc directly by implementing a new feature or fixing an existing issue, feel free to create a pull request! However if you plan to work on anything non-trivial, please do talk to us first, either by commenting on an existing issue, creating a new issue or by pinging us in the dissusions section!

To learn how to get started working on Padloc, refer to the Development section of the readme.

Security

For a security design overview, check out the security whitepaper.

Development

Setup

Setting up your dev environment for working with Padloc is as simple as:

git clone [email protected]:padloc/padloc.git
cd padloc
npm ci

This may take a minute, so maybe grab a cup of ☕️.

Dev Mode

To start "dev mode", simply run

npm run dev

from the root of the project. This will start the backend server (by default listening on port 3000), as well as the PWA (available on http://localhost:8080) by default.

The server and PWA port can be changed vie the PL_TRANSPORT_HTTP_PORT and PL_PWA_PORT environvent variables, respectively. For more configuration options, check out the Conguration section of the server and pwa.

Formatting

This project is formatted with Prettier. To re-format all files using our .prettierrc.json specification, run the following from the root of the project.

npm run format

To simply check whether everything is formatted correctly, you can use the following command:

npm run format:check

Testing

To run unit tests, use:

npm run test

Cypress end-to-end tests can be run via:

npm run test:e2e

And to start cypress tests in "dev mode":

npm run test:e2e:dev

Adding / removing dependencies

Since this is a monorepo consisting of multiple packages, adding/removing to/from a single package can be less than straightforward. The following commands are meant to make this easier.

To add a dependency to a package, run:

scope=[package_name] npm run add [dependency]

And to remove one:

scope=[package_name] npm run remove [dependency]

For example, here is how you would add typescript to the @padloc/server package:

scope=server npm run add typescript

Note: We're trying to keep the number and size of third-party dependencies to a minumum, so before you add a dependency, please think twice if it is really needed! Pull requests with unnecessary dependencies will very likely be rejected.

Updating The Version

The Padloc project consists of many different subpackages. To simplify versioning, we use a global version for all them. This means that when releasing a new version, the version of all subpackages needs to be updated, regardless of whether there have been changes in them or not. To update the global version accross the project, you can use the following command:

npm run version [semver_version]

Deployment / Publishing

Padloc has a lot of different components that all need to be built/released/published in different ways. To manage this complexitiy, we have compiled all deployment steps for all components in a single Github Workflow. To release a new version, simply:

  1. Update project version
  2. Commit and push.
  3. Run the Publish Release action.

Licensing

This software is published under the GNU Affero General Public License. If you wish to acquire a commercial license, please contact us as [email protected].

Frequently asked questions

Is Padloc free to use?

Padloc is open source under the AGPL-3.0 licence. There is no licence fee and no seat count — you can self-host it or, where the project offers one, pay a vendor for a managed version instead.

What does Padloc do?

Secure password manager with end-to-end encryption

What is Padloc written in?

Padloc is primarily written in JavaScript. Its source is publicly available at https://github.com/padloc/padloc, and it has 2,922 GitHub stars.

What is a good open source alternative to 1Password?

Padloc is one of the open source options listed as an alternative to 1Password. Compare licences, stars and activity side by side on the Padloc profile.