Your passwords.
Only yours.
Faithful Ferret is a planned self-hosted password manager that is designed so it can’t read your vault. It is encrypted and decrypted only on your own devices; your server stores ciphertext. It will fill in logins, keep your passkeys and one-time codes, and work in your browser, on iOS and on Android.
Design approved. Nothing to install yet, and please don’t store real passwords in it.
-
example.orgLogin · generated password Saved
-
example.netPasskey · synced to your devices Ready
-
example.ioOne-time code · refreshes every 30 s 482 913
-
example.comLogin · password changed on the site Save update?
Why Ferret
A password manager you host yourself, and don’t have to trust.
There are good self-hosted password managers already. Ferret is for people who want one that is lighter, fits the rest of the Hedgerow family, and gets the everyday details right.
-
Autofill that notices
Reliable detection of new and changed passwords, so a password you just created or changed on a site isn’t left behind. It will be tested against a matrix of real sites before release.
-
Unlock the way you want
Biometric unlock and an optional local PIN, in the browser extension on Windows and macOS as well as on your phone. Ferret will never see or store your biometrics.
-
Small to run
One container with SQLite and a Rust core, like the other Hedgerow apps, and a browser extension that stays light on memory. The resource budgets are measured, not promised.
Planned for 1.0
What Ferret will do.
Everything on this list is a requirement for the first stable release. Nothing here exists yet, and 1.0 doesn’t ship until all of it works.
-
Generate, save and fill
A password generator, saving logins, autofill that only fills the site a login belongs to, and detection of new and changed passwords.
-
Passkeys, as a full provider
Create and store passkeys, sign in to websites with them, and sync them between your devices. Not just a place to keep passkey data.
-
One-time codes
TOTP codes for your other accounts, stored encrypted in the vault next to the login they belong to.
-
A full web vault
Unlock, browse and edit your vault in the browser. Decryption happens in your browser; your server only ever sees ciphertext.
-
Sync that never loses edits
Changes sync between your devices. If two devices edit the same entry, you get an explicit conflict to resolve, never a silent overwrite.
-
Bring your logins along
Import from AliasVault and from Bitwarden or Vaultwarden, and export an encrypted copy whenever you like.
Later, after 1.0: secure notes and payment cards as their own types, files and attachments, an SSH agent, Wi-Fi and custom item types, sharing, and e-mail aliases as an optional add-on. The core never depends on e-mail.
Security approach
Security comes first, and we’ll say where it ends.
For a password manager, security is the product. These are the rules the design follows, and the limits we plan to document plainly.
-
Zero-knowledge
Your vault is encrypted and decrypted only on your devices. The server, its admin panel and its API store ciphertext and can’t read your passwords.
-
Master password, plus a secret key
Your master password unlocks the vault on a new device. An optional secret key adds protection if someone ever gets a copy of the server’s database.
-
Recovery you control
A recovery key and an encrypted export that you keep. There is no admin recovery of vaults: nobody, including whoever runs your server, can open it for you.
-
Published first
A threat model and the cryptographic design are written and published before the implementation starts.
-
Established cryptography only
Well-known algorithms and reviewed libraries. No home-made cryptography.
-
Reviewed and tested
An internal review and testing programme, with test vectors and fuzzing for the cryptographic core.
No external audit is funded Ferret is a small open source project. It has no independent security audit and none is planned yet. The design and code are public so that anyone can review them.
The web vault trusts the server that serves it A web page is delivered by your server each time, so a compromised server could serve a tampered one. This limit will be documented, and admins will be able to switch the web vault off and use the extension and apps only.
Platforms
Where you’ll use it.
All of these are planned for 1.0. Which browser and system combinations support each unlock method and passkey feature will be confirmed with prototypes before the design is locked.
-
Web vault
A full vault in modern browsers: unlock, view, edit, generate and manage recovery.
-
Browser extension
Firefox and Chromium browsers (Chrome, Edge, Brave) on Windows and macOS. Autofill, passkeys, and biometric or PIN unlock.
-
iOS
An app with system AutoFill and passkey support, unlocked with Face ID or Touch ID.
-
Android
An app with autofill, passkeys and biometric unlock. It comes as an APK from the GitHub releases with updates inside the app, not through Google Play.
Server: one container with SQLite, like the other Hedgerow apps, for Docker and Unraid (planned).
Status
Where it stands.
Ferret is in the design phase. The phases below are the order the work happens in, not cuts in scope, and there are no dates: each step is done when it works. Version 1.0 will not be released until every planned feature and security check is in place.
-
Done
Design approved
What Ferret is for, what 1.0 includes, the security goals and how recovery works.
-
Next
Throwaway prototypes
Quick experiments, thrown away afterwards, that answer the risky questions first: biometric unlock from a browser extension, acting as a passkey provider, key derivation speed on every platform, and the sync protocol.
-
Then
Security design
The published threat model, cryptographic design and sync protocol, reviewed before any production code is written.
-
Then
Server and cryptographic core
The server (accounts, devices, an encrypted item store with revisions and conflicts, backups) and a shared Rust core for all clients, with test vectors and fuzzing.
-
Then
Web vault
Unlocking, editing, the generator, one-time codes, conflict handling, the recovery key, encrypted export and import.
-
Then
Browser extension, iOS and Android
Autofill and detection of new and changed passwords, passkeys, biometric and PIN unlock, on every planned platform.
-
Then
Hardening and 1.0
The internal security programme, measured performance, upgrade and migration tests and documentation. 1.0 is released only when all of it is green.
Questions.
-
When can I use it?
Not yet. The design is approved and nothing is usable. Please don’t store real passwords in it when early builds appear. There is no release date. Watch or star the repository to hear about progress.
-
Is it open source?
Yes, under the GNU AGPL-3.0-only, including the apps and the browser extension.
A contributor licence agreement will be required for code contributions. Contributions aren’t open yet.
-
Can the server read my passwords?
That is the design goal: no. The vault is encrypted and decrypted only on your devices, and the server stores ciphertext. “Zero-knowledge” is a goal that has to be shown by the published design, tests and review, not just a label. The security section lists the known limits.
-
What if I forget my master password?
You use your recovery key, or restore from the encrypted export you saved. Ferret will check during setup that you have kept them. There is no admin recovery: if you lose the master password, the recovery key and every export, the vault can’t be opened by anyone.
-
Will it be audited?
No external audit is funded. Instead: a published threat model and cryptographic design, established cryptography only, and an internal review and testing programme. Everything is open for others to read and check.
-
Why isn’t the Android app on Google Play?
The Android app will be an APK from the GitHub releases, which can update itself from inside the app. It avoids app-store terms, which don’t fit well with an AGPL-licensed project.
-
Will I be able to import my existing vault?
Yes. Import from AliasVault and from Bitwarden or Vaultwarden is planned for 1.0, including one-time codes and passkeys where the export format contains them. Ferret will warn you when an export file holds secrets in plain text.