i didn't want my logins living on someone else's server, so i wrote my own that doesn't. the whole vault stays on your pc and makes no requests to the internet.
encrypted with your master password, then locked to the machine it's sitting on.
every big manager syncs your vault to a datacenter somewhere. one breach and it's out. skeet keeps everything local, encrypts it with a key only your master password makes, and ties the file to this specific pc, so a copy of it is useless anywhere else.
info-stealers copy your saved-password files in one pass and crack them later. i built skeet so that doesn't get them anywhere.
the vault is encrypted with AES-256-GCM (key from your master password via PBKDF2), then wrapped again in windows DPAPI. you'd have to break both to read a single login.
because of the DPAPI layer the vault won't decrypt on any other machine, even if they later crack or keylog your master password. that's the whole "steal now, crack later" plan gone.
the extension holds no passwords. they only cross the local bridge when you ask for a fill, and only while the vault's unlocked. browser-password stealers find nothing.
autofill runs on 127.0.0.1 behind a per-browser token. send that token to some server and it's useless. nothing off your machine can reach it.
your master password never leaves the pc and never hits disk. by default skeet makes no internet requests at all.
site icons are opt-in (off = fully offline). auto-lock, clipboard timeout and startup are yours to set, and you can export an encrypted backup whenever.
