swifty (now fwdai/rowel) is a free, open-source, offline-first password and secrets manager that keeps encrypted vaults entirely on your own devices with optional bring-your-own-cloud sync.
| Tool | swiftyapp/swifty (relaunching as fwdai/rowel) — free offline-first password manager built on Tauri 2 with a Rust crypto core |
| Category | Personal secrets management / credential storage (GPL-3.0, TypeScript + Rust) |
| Primary Use | Storing logins, passkeys, cards, SSH keys, API keys and .env files in an encrypted local vault for professionals and personal use |
| Safe Use | Entirely defensive: managing your own credentials on your own devices during authorized work, labs and everyday security hygiene |
| Telemetry Note | No backend exists to log anything; sync writes only ciphertext to the user's own Google Drive, Dropbox or iCloud, and the optional breach check never transmits the password itself |
swifty, which the README shows is relaunching under the new name Rowel at fwdai/rowel, is a free and open-source password manager built around one uncompromising architectural decision: there is no account and no server. Every password, passkey, credit card, identity document, SSH key and .env file lives in an encrypted vault on your own disk, and the application works fully offline. That design removes the entire class of vendor-breach incidents that have repeatedly damaged commercial password-manager providers, because there is simply nothing on the operator's side to breach. For security professionals who spend their days telling clients to stop trusting third-party vaults with their secrets, this is a tool that practices what the industry preaches.
The metadata tells part of the story: 944 stars, GPL-3.0 licensing, a TypeScript frontend, and topics spanning tauri, tauri2, cryptography, password-manager and privacy-tools. The architecture splits cleanly along those lines. The UI is a React + TypeScript layer rendered by Tauri 2, while all cryptography lives in a Rust core — a sensible separation, because the JavaScript side of a desktop app is the most exposed attack surface, and here it never sees the master key at all. That single claim in the README is the one most worth verifying when you audit the code yourself, and it is the difference between a password manager and a password manager-shaped liability.
Storage is layered rather than monolithic. The README describes each "lockbox" — a subdivision of the vault such as Personal, Work or Clients — as an encrypted SQLite database using SQLCipher, with each individual item sealed a second time in an application-level AEAD layer. This double-envelope construction has a concrete usability payoff: the item list and search operate without unsealing anything, and the interface only decrypts a secret at the moment you open that specific item. In other words, the database being unlocked does not mean every credential inside it is sitting in plaintext memory. Each lockbox is its own file and can sync to a different cloud account, which is a genuinely useful boundary for consultants who need to keep client credentials in a separate trust domain from personal ones.
Sync is the part of most local-first tools that quietly ruins the security model, and Rowel handles it with an explicit bring-your-own-cloud philosophy. Each lockbox uploads to Google Drive, Dropbox or iCloud as a single encrypted file, and the app is restricted to its own app-scoped storage on those services — it cannot rummage through the rest of your drive. The cloud only ever stores ciphertext. Conflicts from multiple devices are resolved item by item with a newer-edit-wins rule and no conflict dialogs, which trades manual merge control for predictability. For a single operator or a family, that is a reasonable trade; for adversarial multi-writer scenarios you should read the project's published docs/threat-model.md, which the README links directly.
Developer ergonomics are a differentiator here. SSH keys are a first-class item type, complete with fingerprint randomart and in-app Ed25519 key generation — not a note field with a pasted blob. API keys carry environment and scope metadata, and entire .env files are handled as their own item type. For anyone who has watched a teammate commit a raw .env to a repository, that feature alone justifies a look. Importers cover 1Password, LastPass, Bitwarden, KeePass (CSV export), Enpass, Chrome, Safari and any FIDO CXF export, with a report flagging anything that failed to migrate. Export goes back out to CSV, FIDO CXF or Bitwarden-compatible JSON, plus encrypted backups to .rowel files — no lock-in, which matters when you are evaluating a young project.
The essentials list is thorough: passkeys and TOTP codes, a password and passphrase generator, browser autofill and passkey support in Chrome, Edge, Brave, Vivaldi and Firefox (plus Safari on macOS), iOS AutoFill unlocked with Face ID, and biometric unlock via Touch ID or Windows Hello on desktop. Operational hygiene details are present too: the app locks on inactivity, clears copied secrets from the clipboard, and — notably — makes master-password changes crash-safe with rollback on interruption. A half-written master-password rotation is the kind of corruption that destroys vaults, so treating it as a transaction is a mark of careful engineering. A "Vault Health" feature adds strength scoring and reused-password checks, and the breach check is described as private, never sending the password itself.
Private sharing is handled through expiring encrypted links: one item, a 24-hour expiry, revocation, and the key embedded in the link itself so the storage backend never gains access. It works from a lockbox synced to Google Drive and requires the recipient to open the link in Rowel. This is a pragmatic design for the common "send me the staging credentials" workflow, though the key-in-URL construction means the link is the secret — the usual discipline about which channel you send it through still applies entirely.
Supply-chain posture is unusually strong for a project this size, and the README dedicates a full section to it. Every release is built in GitHub Actions and carries SLSA build provenance attested with actions/attest-build-provenance using keyless OIDC signing; verification is a single command, gh attestation verify ./Rowel_amd64.AppImage --repo fwdai/rowel. CycloneDX SBOMs ship with each release (rowel-rust.cdx.json and rowel-js.cdx.json) and can be fed straight into grype sbom:./rowel-rust.cdx.json to audit exact dependencies. The auto-updater refuses anything not signed with the project's minisign key, whose private half is not in the repository, and the Rust toolchain and bun version are both pinned. One caveat the README states honestly: releases up to and including v1.0.0-alpha.6 predate the swiftyapp/swifty to fwdai/rowel migration and must be verified against the old repo name, and Windows/Linux installers are not code-signed yet.
Getting started is straightforward. Downloads are available for macOS (universal .dmg), Windows (x64 setup .exe), Linux (.deb, .rpm, .AppImage) and an iOS TestFlight beta, or via gh release download --repo fwdai/rowel --pattern 'Rowel_universal.dmg'. Building from source is equally simple for anyone who wants to inspect rather than trust: git clone https://github.com/fwdai/rowel.git, then bun install && bun run tauri:dev. The README points to docs/development.md for prerequisites, tests, the iOS AutoFill build and update-signing setup.
From a defensive standpoint, this is a tool worth recommending and worth studying. The architecture — zero-knowledge local vaults, SQLCipher plus per-item AEAD, a Rust crypto core walled off from the UI, ciphertext-only sync, attested reproducible builds — reads like a checklist of password-manager best practices, and the GPL-3.0 license means none of those claims have to be taken on faith. The project is pre-1.0 by its own versioning, so treat it as promising rather than battle-hardened, keep your encrypted backups current, and read docs/threat-model.md before making it the sole home for your credentials. For authorized professionals who want their secrets under their own keys on their own machines, Rowel earns a close look.
swiftyapp/swifty.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.