MARUCIE/authbox

---
The password manager that works even if we disappear. 24 words = all your passwords. No email, no account, no server dependency.
Why Auth Box
Every password manager asks you to trust them. Auth Box asks you to trust **math**.
- **No Email Required** -- Create a vault in 45 seconds. Just a seed phrase and a master password.
- **Survive Without Us** -- Your vault is encrypted with keys derived from your seed phrase. Even if Auth Box ceases to exist, your passwords remain yours.
- **Passwords Without Storage** -- Derive passwords deterministically from your seed + site name. Your vault can literally be empty.
- **AI Agent Gateway** -- Give AI assistants controlled access to credentials via MCP protocol, with policy-gated, auditable delegation.
- **Import Everything** -- Migrate from 13 sources: Apple, Google, Chrome, Edge, Firefox, 1Password, Bitwarden, LastPass, Dashlane, KeePass, Samsung Pass, NordPass, Enpass.
- **AI Infrastructure Hub** -- Manage API keys for 70+ providers (OpenAI, Anthropic, AWS, Stripe...). Drag-drop .env files to auto-import. One-click health checks verify keys are valid.
- **Arweave Permanent Storage** -- Archive your encrypted vault to Arweave for permanent, decentralized backup. Recovery works even without Auth Box servers.
The Unstoppable Promise
Auth Box uses the same proven model as Bitcoin wallets:
If you have your seed phrase, you have everything. No server. No company. No dependency.
Screenshots
Quick Start
- Web app: http://localhost:3010
- API: http://localhost:4010
Architecture
**Zero-knowledge**: The server stores only encrypted blobs. It cannot decrypt anything.
**Unstoppable Mode**: The server is optional. Your vault works offline with keys derived from your seed phrase.
Monorepo Structure
Encryption
| Layer | Primitive | Purpose |
|-------|-----------|---------|
| Seed | BIP-39 (24 words) | Sole recovery mechanism |
| Master Key | PBKDF2-HMAC-SHA512 | Key derivation from seed |
| Sub-keys | HD derivation (BIP-32 style) | vault / sync / agent / auth / derive |
| Vault | AES-256-GCM | Encrypt all vault items |
| Auth | SRP-6a | Mutual authentication (optional server) |
| Passwords | Deterministic derivation | seed + site = password (no storage) |
Comparison
| Feature | 1Password | Bitwarden | LessPass | Apple Keychain | **Auth Box** |
|---------|-----------|-----------|----------|----------------|-------------|
| Self-sovereign (seed phrase) | No | No | No | No | **Yes** |
| Works without server | No | Self-host only | Yes | Apple only | **Yes** |
| Deterministic passwords | No | No | Yes | No | **Yes** |
| Full vault + deterministic hybrid | No | No | No | No | **Yes** |
| AI Agent gateway (MCP) | No | No | No | No | **Yes** |
| Open source client | No | Yes | Yes | No | **Yes (MIT)** |
| Import sources | Few | 8 | 0 | Apple only | **13 + .env auto-import** |