Aegis Vault

Aegis Vault is a local-first password manager and 2FA authenticator for Chrome and Chromium-based browsers. PASSWORD MANAGEMENT • Store website logins, usernames, passwords, secure notes, and payment cards. • Suggest the account matching the username displayed on the login page. • Autofill credentials only after a user action and exact website-origin validation. • Offer to save new logins and recently changed passwords. • Generate strong passwords with configurable length and character groups. 2FA OTP AND QR SCANNING • Generate RFC 6238 TOTP authentication codes with a live countdown. • Add OTP accounts using Base32 secrets or otpauth:// URIs. • Import QR-code images or select a QR region directly from the current page. • Search, reorder, and quickly copy OTP codes. ON-DEVICE ENCRYPTION • Vault data is encrypted with AES-256-GCM before being stored or synchronized. • Encryption keys are derived from the master password using PBKDF2-SHA-256 with 600,000 iterations. • The master password is not uploaded to Firebase and cannot be recovered by the extension developer. • Unencrypted vault contents are available only while the vault is unlocked. LOCAL-FIRST STORAGE AND OPTIONAL SYNC • Changes are encrypted and saved on the device first. • Optional synchronization uses Firebase Authentication and Cloud Firestore. • Firestore receives encrypted vault data and synchronization metadata. • Chunked snapshots, concurrency preconditions, and pending mutation handling help protect changes made across devices. BACKUP, IMPORT, AND SECURITY REVIEW • Create and restore encrypted Aegis Vault backups. • Import and export login data in CSV format. • Import and export OTP accounts. • Detect weak and reused passwords. • Restore recently deleted items from Trash. PRIVACY • No advertising or sale of personal data. • No automatic form submission. • No browsing-history profiling. • Imported and exported files are processed only after an explicit user action. LANGUAGES • Full English and Vietnamese interface support. Aegis Vault has not undergone an independent security audit. Keep an encrypted backup of important data.