PWDnow

Paid LinuxSelf-hostedWeb

What PWDnow is

PWDnow is a free, open-source password manager for Linux, self-hosted deployments, and a web interface. It uses a zero-knowledge, local-first design: a Rust daemon performs cryptographic operations and stores credentials in an SQLCipher-encrypted database, while the web interface forwards encrypted requests without holding key material. Cloud synchronization is off by default, and the software can run offline on one machine or behind Nginx with TLS for LAN or self-hosted access. Vault entries support folders, passwords, TOTP secrets, notes, and custom fields. PWDnow scores password strength, detects reused or common passwords, and checks breaches against a local Have I Been Pwned corpus filter without a network lookup for each password. Authentication includes passkeys, WebAuthn, FIDO2 keys, platform authenticators, TOTP, HOTP, and configurable per-account MFA. It also offers duress and travel modes, failed-unlock backoff, and delayed emergency access.

Who it suits

PWDnow suits Linux users, self-hosting operators, and people who want local-first password storage. It also fits users needing passkeys, hardware-key authentication, offline operation, or detailed credential checks.

What it does well

Local SQLCipher-encrypted vault storage
Passkeys, WebAuthn, and FIDO2 support
Offline operation with no cloud sync by default
Local breach checks without per-password network lookups
Imports Bitwarden, 1Password, and NordPass exports

What to know first

No macOS or Windows build
Building from source requires several development dependencies
No product price or subscription plan is stated

Verdict

PWDnow combines local vault control with broad authentication options and password checks. Its Linux-only availability and source-build requirements matter when choosing it.

Facts from PWDnow's own pages

Authentication: It supports WebAuthn and FIDO2 hardware keys and platform authenticators, TOTP and HOTP, passkeys, and configurable per-account MFA enforcement. · github.com, 12 Oct 2026
Breach checks: PWDnow checks passwords against a local Have I Been Pwned corpus filter, without a network lookup for each password. · github.com, 12 Oct 2026
Credential storage: Credentials can include passwords, TOTP secrets, notes, and custom fields, organized in folders. · github.com, 12 Oct 2026
Credential tools: Credentials can be organized into folders and include passwords, TOTP secrets, notes, and custom fields; the app also scores password strength and detects reuse and common passwords. · github.com, 12 Oct 2026
Cryptography: The project describes hybrid X25519 and ML-KEM key encapsulation enabled by default, ML-DSA signatures, Argon2id key derivation, and AES-256-GCM and XChaCha20-Poly1305 encryption. · github.com, 12 Oct 2026
Data protection: The project says vault data is stored in an SQLCipher-encrypted database and that master and derived keys remain in the daemon rather than the browser layer. · github.com, 12 Oct 2026
Deployment: PWDnow can run offline on one machine or be deployed behind Nginx with TLS for LAN or self-hosted server access. · github.com, 12 Oct 2026
Imports and exports: PWDnow imports Bitwarden, 1Password, and NordPass exports, and supports JSON, CSV, KeePass-compatible XML, and its encrypted .p2w export format. · github.com, 12 Oct 2026
Install requirements: Building from source requires Node.js 24 or newer, Rust 1.94 or newer, protoc, and development headers for libsodium, SQLCipher, and libfido2. · github.com, 12 Oct 2026
License and pricing: The repository identifies the project as MIT-licensed and does not state a product price or subscription plan. · github.com, 12 Oct 2026
Local-first design: The project says cryptographic operations run in a Rust daemon on the machine where the vault lives, while the web interface forwards encrypted requests and does not hold key material. · github.com, 12 Oct 2026
Offline use: It can run offline on one machine, with no cloud sync by default and no telemetry. · github.com, 12 Oct 2026
Optional strict mode: An optional CNSA 2.0 strict mode restricts the daemon to the algorithms listed in the README for that mode. · github.com, 12 Oct 2026
Passkey support: Yes · github.com, 16 Sept 2026
Password checks: It scores password strength, detects reuse and common passwords, and checks breaches against a local Have I Been Pwned corpus filter without a per-lookup network call. · github.com, 12 Oct 2026
Passwordless account login: Yes · github.com, 16 Sept 2026
Product: PWDnow is a zero-knowledge, local-first password manager. · github.com, 12 Oct 2026
Purpose: PWDnow is a zero-knowledge, local-first password manager whose Rust daemon handles cryptography while the web interface exchanges encrypted data with it. · github.com, 12 Oct 2026
Security modes: Features include duress mode, travel mode, lockout backoff after failed unlock attempts, and time-delayed emergency access for a trusted contact. · github.com, 12 Oct 2026
Security reporting: The project asks vulnerability reporters to use GitHub private vulnerability reporting or contact the maintainers directly instead of opening a public issue. · github.com, 12 Oct 2026
Security reports: The project asks users to report vulnerabilities through GitHub's private vulnerability reporting or directly to maintainers, rather than through a public issue. · github.com, 12 Oct 2026
Supported platforms: Linux,web interface,self-hosted · github.com, 16 Sept 2026
Supported systems: The project says it is developed and tested primarily on Ubuntu 26.04 LTS, and its installer also supports Debian-derived and Fedora or RHEL-family distributions; it has no macOS or Windows build. · github.com, 12 Oct 2026
Vault storage: The vault daemon stores credentials in an encrypted SQLCipher database, and the project says there is no cloud sync by default. · github.com, 12 Oct 2026

Where PWDnow stands on Freedom251

Password Managers#98 of 104