Passwords you don't need to store.
Local deterministic password generation for your browser.

SpectralPass helps you create strong, repeatable passwords without building a password vault. It runs locally in your Chromium browser, recreates results from your own inputs, and stores only the metadata needed to fill the form again.

SpectralPass is not a password manager. It does not store your master secret, generated passwords, security answers, or cryptographic keys.

Use it when you want a fast, private workflow without a cloud account or synced password vault: open the side panel, choose a site, and recreate the value only when you need it.

Language: English | Polski

Table of Contents

• Why SpectralPass?
• Product Preview
• Features
• Browser Compatibility
• Installation
• Using SpectralPass
• Saved Sites, Import, and Export
• Password Variants
• How It Works
• How Inputs Affect the Result
• Security Model
• Known Limitations
• Stored Data
• Permissions
• Domain Mismatch Protection
• Protocol
• License

Why SpectralPass?

SpectralPass is for users who want fewer stored secrets, less account syncing, and more control over how their passwords are created.

• Local by design: generation happens in the extension, without remote APIs or telemetry.
• No vault of generated passwords: saved sites restore the form, not the secrets themselves.
• Recreate on demand: the same inputs recreate the same result whenever you need it.
• Built for daily use: saved sites, search, import, export, and language selection are available in the side panel.
• Made for the side panel: keep the generator next to the page you are using instead of switching between tabs or popups.
• Transparent by design: the V1 protocol is documented for review, reproducibility, and full clarity about how results are created.

Product Preview

SpectralPass lives in the Chromium side panel, so your generator stays beside the page you are using instead of hiding in a small popup.

Locked and unlocked panel views:

Features

Daily Workflow

• Side-panel interface for Brave, Chrome, and other Chromium-based browsers.
• Live deterministic generation while you edit the form.
• One-click fill from the active tab domain.
• Search across saved sites.
• Polish and English interface with a language selector.

Privacy and Safety

• Generated results are hidden by default and can be revealed with the eye button.
• Copying works without revealing the result on screen.
• Results expire after 30 seconds and cannot be copied after expiry.
• One-minute idle session lock.
• Domain mismatch confirmation before copying to reduce accidental use on the wrong site.

Portability

• Local saved-site list with labels, counters, variants, and small site icons.
• Import and export of saved-site metadata.
• Independent SpectralPass V1 protocol.

Browser Compatibility

SpectralPass is built for Chromium-based browsers.

Tested with:

• Google Chrome
• Brave
• Microsoft Edge

It should also work in other modern Chromium-based browsers that support Manifest V3 and the Chromium side panel API, but they are not part of the currently verified test set.

Installation

Local installation from this repository:

1. Open brave://extensions or chrome://extensions.
2. Enable Developer mode.
3. Select Load unpacked.
4. Choose the extension directory.
5. Click the SpectralPass toolbar icon to open the side panel.

Using SpectralPass

The daily workflow is intentionally short: unlock once, choose the site, copy the result, and let the panel clear it automatically.

1. Open the SpectralPass side panel.
2. Enter your username and master secret.
3. Unlock the session.
4. Choose the current domain, a saved site, or a manual alias.
5. Select the purpose, password variant, and counter.
6. Copy the generated result before the 30-second window expires.

The result is generated automatically. There is no separate generate button.

When the result expires, the field is cleared and copying is blocked. If the session is still unlocked, select Show password for 30 seconds to display the result again and enable copying for a new 30-second window.

Saved Sites, Import, and Export

Saved sites are convenience shortcuts, not stored passwords. They make it easier to restore the form later, but they never contain generated values. Saved sites store the selected identifier, label, icon, password variant, and counter values for password and security-answer purposes.

Export files contain:

• username,
• saved site identifiers,
• labels,
• icons,
• variants,
• counters,
• settings required to restore the saved-site list.

Import behavior:

• Importing when no local metadata exists creates the local metadata record.
• Importing the same data again makes no changes.
• Importing data for the same username merges saved sites.
• A conflict appears only when the same saved-site record has different data.
• Importing data for a different username requires replacing the local metadata record.

Imported JSON is validated before it is saved. Files with oversized content, unsupported schema, invalid counters, unsafe icons, or secret-like fields are rejected.

Password Variants

Variant	Use case
Strong	20 characters, best for new accounts.
Compatible	16 characters, useful for older password forms.
6-digit PIN	Numeric PIN when a service requires six digits.
4-digit PIN	Numeric PIN for services that force a short PIN.
Phrase	Several easier-to-type pseudoword segments.

Security-answer generation uses a phrase-style result.

How It Works

SpectralPass recreates the same value from the same set of inputs:

• username,
• master secret,
• site or alias,
• purpose,
• password variant,
• counter.

The master secret unlocks the local session and derives a non-extractable session key inside a dedicated crypto worker. Site values are derived on demand. When the session locks or the panel closes, the worker is terminated and the result is cleared.

If you forget your master secret, SpectralPass cannot recover it.

How Inputs Affect the Result

Every generation input is part of the deterministic result:

Input	Effect
Username	Separates generated values for one user name from another.
Master secret	The main private secret used to derive the session key.
Site or alias	Separates values between websites or manual aliases.
Purpose	Separates password generation from security-answer generation.
Password variant	Selects the output format, such as strong, compatible, PIN, or phrase.
Counter	Counter changes the generated value without changing your master secret.

Keep the counter at 1 for the first password or answer. Increase it to 2, 3, and so on when a service requires a new value for the same site. This lets you rotate a password or security answer while keeping the same username, master secret, site, purpose, and variant.

Security Model

SpectralPass is designed around local-only generation and minimal persistence.

It protects against common accidental exposure paths:

• Generated results are hidden by default.
• Results disappear after 30 seconds.
• Copying is disabled after expiry.
• The side-panel session locks after one minute of inactivity.
• Closing the panel immediately locks the session.
• Copying a result for a different active domain requires confirmation.
• Import validates schema, size, counters, icons, and secret-like fields.
• The extension does not inject scripts into web pages.
• The extension does not request host permissions.
• The extension does not call remote APIs or telemetry services.

Known limitations are listed below. They are part of the current security model, not hidden guarantees.

Use a long, unique master secret used only with SpectralPass. If you forget it, SpectralPass cannot recover it.

Known Limitations

Saved Site Metadata Visibility

Saved site metadata is local metadata, not an encrypted vault. SpectralPass does not store generated values, but saved site names, identifiers, labels, icons, variants, and counters are stored locally so the form can be restored.

This means saved site metadata may be visible locally even when a different master secret or username is entered. Different credentials generate different results, but they do not currently hide the saved-site list.

Protect access to your device, browser profile, and extension storage accordingly.

Master Secret Strength

SpectralPass is deterministic. Someone who knows enough generation inputs can try to guess a weak master secret offline and compare generated results. A long, unique master secret is therefore required in practice, not just recommended.

Browser and Device Compromise

SpectralPass reduces accidental exposure inside the extension UI, but it cannot protect generated values from a compromised browser, operating system, debugger, screen recorder, clipboard monitor, or more privileged malicious extension.

Clipboard Control

SpectralPass blocks copying after a result expires, but copied content is outside SpectralPass control once it reaches the system clipboard. Other software with clipboard access may still read it.

JavaScript Memory Limits

SpectralPass clears result state, terminates the crypto worker on lock, and clears transferred input buffers where JavaScript allows it. JavaScript cannot guarantee physical memory zeroization, so this should be treated as exposure reduction rather than a hardware-level erasure guarantee.

Stored Data

SpectralPass stores only local metadata in chrome.storage.local.

Stored:

• last username,
• saved sites and aliases,
• display labels,
• validated PNG/WebP site icons,
• password variants,
• counters,
• language preference.

Not stored:

• master secret,
• generated passwords,
• generated security answers,
• root key,
• site keys,
• result history,
• page contents.

Permissions

SpectralPass uses a small Manifest V3 permission set:

Permission	Why it is needed
sidePanel	Opens SpectralPass as a browser side panel.
storage	Saves local metadata for saved sites and preferences.
tabs	Reads the active tab URL to suggest the current domain.
favicon	Reads the active tab favicon through Chromium's internal favicon endpoint.

SpectralPass does not use content scripts, page injection, host permissions, remote code, or external service calls.

Domain Mismatch Protection

SpectralPass compares the selected site with the active browser tab before copying.

• Exact domain matches are allowed.
• Subdomains are allowed.
• Different domains require explicit confirmation.
• Manual aliases do not need to match the active tab.

This helps prevent copying a value generated for one site while another site is open, which is especially useful when checking suspicious login pages.

Protocol

SpectralPass V1 is an independent protocol. It is not compatible with other deterministic password generators unless they explicitly implement the same protocol.

Most users do not need this section to use the extension. It is included for full transparency, so the deterministic behavior can be reviewed and reproduced.

The protocol uses:

• scrypt for root key derivation,
• HKDF/HMAC-SHA-256 for site-key separation,
• canonical length-delimited field encoding,
• unbiased sampling for generated characters,
• fixed password variant rules.

See docs/protocol/spectralpass-v1.md for the technical specification.

License

SpectralPass is licensed under the Apache License 2.0.

See NOTICE for the project copyright notice. The SpectralPass name, logo, and visual identity are project branding. The Apache License 2.0 applies to the software and documentation in this repository, but it does not grant trademark or branding rights.

The vendored @noble/hashes files keep their own license terms. See docs/provenance/third-party-notices.md for third-party notices in this repository.