Share Everything
Securely

Silo is a local-first password manager you run yourself. Your vault is an encrypted file on your machine—there is no account, no cloud sync, and no remote copy of your master password.

Developers and security-curious users who want to understand every boundary in a password manager. Silo is an open educational project: useful day to day, but not yet audited for critical production credentials.

Login entries with usernames, passwords, URLs, and optional TOTP secrets. You manage them through the CLI, the interactive terminal shell, or—when the local broker is running—approved autofill via the browser extension.

Yes. The CLI, core crypto, local broker, native host, and browser extension live in the public Silo repository so you can read, build, and audit the code yourself.

Only on your machine, in an encrypted vault file. Silo never uploads entries. Exports are deliberate plaintext JSON—treat those files carefully and delete them when you are done.

Keys are derived with Argon2id and vault writes are atomic, keeping a previous .bak copy. Unlock happens locally for a command or a shell/broker session—then the vault locks again when you quit or time out.

No. The extension talks to a local broker that already holds an unlocked session. It only receives login or TOTP values you explicitly approve—never the master password.

Clone the Silo repository, then run cargo run -p silo -- init to create a vault. Add logins with silo add, browse them in silo shell, and use silo broker when you want browser autofill.

Each CLI command unlocks, does one job, and exits. The shell unlocks once and keeps an interactive workspace open—search, inspect, copy passwords or TOTP codes, then quit to lock.

TOTP secrets are stored in the vault and codes are generated locally with silo otp or the o key in the shell. Copied secrets clear from the clipboard after about 20 seconds if nothing else has replaced them.