Skip to content
nullbrand
EN PT

Your passwords. Your machine. Nothing in between.

nullbrand keeps your vault in a single encrypted file on your computer. No account, no cloud, no server, no telemetry.

Free and MIT-licensed. Runs on Windows, macOS and Linux with Node.js 22.14 or newer.

npx nullbrand-pass
Or install it once: npm install -g nullbrand-pass Read the source on GitHub
Download for Windows macOS Linux

A vault on a server is a target.

A copy of your vault sits on a stranger’s server.

One file. On your own machine.

The copy is yours and stays only where you keep it. You own it, and you can do whatever you want with it.

Illustration: a vault file leaves a server and lands on a laptop as you scroll.

vault.json

Online password vaults get breached, and when they do, attackers get time: a stolen encrypted copy can be attacked offline, as slowly as they like. nullbrand takes the server out of the picture.

December 2022

A copy of customers’ vault backups was taken.

After an intrusion in August 2022, attackers used stolen credentials and keys to copy a backup of customer vault data from a hosted password manager’s cloud storage. Website addresses were stored unencrypted; usernames, passwords and notes were encrypted. The company warned that attackers might try to guess master passwords by brute force.

What it means Encryption helped, but the copy of the vault was no longer in its owner’s hands. It does not mean the encryption was broken.
The Hacker News: LastPass admits to severe data breach Help Net Security: LastPass says attackers got users’ info and password vault data
February 2026

Researchers tested the “zero-knowledge” promise.

Researchers at ETH Zurich and USI assumed a malicious server and found 25 attacks across three major cloud password managers, plus findings on a fourth. Several allowed passwords to be recovered. The vendors have fixed or are fixing the issues, and there is no evidence any were exploited in the wild.

What it means Trusting a server is part of the security model. It does not mean these services are unsafe today.
The Hacker News: Study uncovers 25 password recovery attacks in major cloud password managers ETH Zurich news release

Local doesn’t make a vault invincible. It removes the server, the account and the company from the list of things that can fail.

Facts from public reports, checked on 19 October 2026.

0

runtime dependencies. Node.js built-ins only; TypeScript is used to build and nothing else.

0

outbound connections once it’s running. No telemetry, no update checks.

128

MiB of memory for every password guess against a stolen vault file.

15

minutes idle before the vault locks itself, by default.

30

seconds before a copied password is wiped from the clipboard.

Three steps. No sign-up.

To start using nullbrand you run one command, choose a master password and open your browser. There is nothing to register for.

  1. 1

    Run it

    npx nullbrand-pass opens a point-and-click interface in your browser, served from 127.0.0.1. Prefer the terminal? Every action also works there.

  2. 2

    Choose a master password

    You create it the first time (at least 8 characters). After that, you just unlock.

  3. 3

    That’s it

    Your vault is one encrypted file, ~/.nullbrand/vault.json. Item names are encrypted too.

Click through the interface or type commands. Same vault, same features.

What it looks like.

This is the real interface, rebuilt with sample data. Keep scrolling.

Animated demo of the nullbrand interface: it opens full screen, then shows creating a login and generating a 64-character password.

What’s inside

nullbrand stores logins, cards, identities, SSH keys and notes in one encrypted vault, and it works from a browser interface or the command line.

Everything you store

Logins, cards, identities, SSH keys and secure notes, with folders, favorites, search and filters.

Password generator

Uniform sampling with crypto.randomInt, so there is no modulo bias.

Clipboard that cleans up

The password reaches the clipboard through stdin, never through arguments. After 30 seconds, on lock and on quit, it is cleared only if it still holds your password.

Auto-lock

Locks after 15 minutes idle by default. The key lives only in memory and is zeroed on lock.

Import and backup

Import from a .json file; the layout is detected, never guessed. Export an encrypted backup, then restore or merge it later.

Point and click, or terminal

A friendly web interface for everyday use and a full command line for the terminal crowd, both working on the same vault.

English and Portuguese

In the interface and on the command line.

What it protects against

nullbrand defends the vault against six specific threats, listed below with how each one is handled. Malware already running as your user is out of scope. This is the threat model from the README, in plain words.

Someone on your network
Listens on 127.0.0.1 only and refuses to start on any other address.
A malicious website open in your browser
Single-use access token that expires in 60 seconds, an HttpOnly, SameSite=Strict session cookie, Host and Origin checked on every request, no CORS.
Injected or third-party scripts
CSP with default-src 'none', no external resources, data always rendered with textContent.
Leaving the vault open
Auto-lock after inactivity (15 minutes by default). The key lives only in memory and is zeroed on lock.
Someone stealing the vault file
Brute force is limited by scrypt’s cost, about 128 MiB per guess.
A copied password you forgot about
After 30 seconds, on lock and on quit, the clipboard is cleared only if it still holds the password (compared by SHA-256). On Windows, Clipboard History may keep a copy; turn it off if that matters to you.

nullbrand collects nothing, so there is nothing to share. No telemetry, no analytics, no update checks.

Out of scope: malware already running as your user.

Read the security policy

Two honest ways to do this

Neither is right. They fail in different places.

Two honest ways to do this A local file (nullbrand) A hosted service
Where the vault lives A local file (nullbrand) A file on your computer A hosted service A provider’s servers
Account A local file (nullbrand) None A hosted service Required
Sync across devices A local file (nullbrand) Not built in. You move backups yourself. A hosted service Built in
If you forget the master password A local file (nullbrand) Yours to keep, like a crypto wallet. Lose the password and no one can open it. A hosted service Often has recovery options
What can be breached A local file (nullbrand) Your computer A hosted service Your computer and the provider
Updates A local file (nullbrand) You choose when A hosted service Automatic
Cost A local file (nullbrand) Free A hosted service Often a free tier with limits and a paid plan

No brand to buy into.

The name says it. There’s no account to sign in to and no logo to rent. nullbrand is MIT-licensed code in a repository. The interface is plain HTML, CSS and TypeScript: clone it, restyle it, translate it, run it. Adding a language takes one JSON file.

If you publish your own version, give it your own name. See the trademark policy.

Clone the repository Add a language

Built for people who keep their own keys.

nullbrand puts you in charge of the vault, which also means the spare copies are yours to keep.

Node.js 22.14 or newer

That’s the only requirement.

Back up your vault

Export an encrypted backup and keep it somewhere you trust.

Pick a master password you’ll remember

Nobody can reset it for you, so the responsibility is yours, as with a crypto wallet.

Where the project stands

nullbrand is a new project (version 0.1.1) and has not had an independent security audit. It is provided as is. The desktop app is out, but no installer is code-signed yet, so Windows or macOS may warn you before opening a downloaded file. Check the SHA-256 shown next to each download before you open it.

Questions, answered briefly

These are the questions people ask most about how nullbrand works, what it does not do and who is responsible for what.

Is it really offline?

Once it’s running, nullbrand makes no outbound network connections. It has no telemetry and no update checks, and it listens only on 127.0.0.1. The first npx nullbrand-pass downloads the package from npm, so that step needs a connection. After that, it doesn’t. You can verify all of this in the source.

What does “zero dependencies” mean?

No runtime dependencies: it uses Node.js built-in modules only. TypeScript is a development dependency used to compile the code.

Has it been audited?

No. It has not had an independent security audit. It’s a new open-source project (version 0.1.1) provided as is. The code is public, the tests run in CI on Linux, macOS and Windows, and vulnerability reports are welcome. Keep encrypted backups.

What if I forget my master password?

The vault can’t be opened. There is no recovery, by design: the responsibility is yours, as with a crypto wallet. Nobody holds a spare key.

How do I back it up?

Open Import and backup in the interface and export an encrypted backup with a few clicks. Prefer the terminal? npx nullbrand-pass export backup.json does the same, and npx nullbrand-pass import backup backup.json restores or merges it later. Keep the backup somewhere you trust.

Can I import from another password manager?

Yes, from a .json file. The layout is detected from its structure; unsupported files are refused, never guessed. An encrypted export from another app has to be exported again, unencrypted.

Does it sync, autofill in browsers or have a mobile app?

Not built in today. It is a vault file, a command line and a local web interface.

Where is my data?

In ~/.nullbrand/vault.json. On Windows that is C:\Users\[username]\.nullbrand\vault.json. Change it with --vault <path> or the NULLBRAND_HOME variable.

Is it free?

Yes. It’s free and MIT-licensed. You can also clone it, customize it and own your own version, using nullbrand as the base. If you publish it, give it your own name.

Which languages does it speak?

English and Portuguese, in the interface and on the command line.

Are the downloads signed?

No. Nothing nullbrand ships is code-signed today, so Windows SmartScreen or macOS Gatekeeper may warn you before opening a download. Compare its SHA-256 with the one listed next to the download, or run it from source with npx nullbrand-pass.

Report it, suggest it, ask it.

Found a vulnerability or a bug, have an idea for a feature, or just want to say something? Pick a reason and write your message.

Subject

Your message is saved on our server and e-mailed to us. We only use it to answer you.

Run it. Read it. Make it yours.

npx nullbrand-pass
Download for Windows macOS Linux
View on GitHub Read the docs