🔐 GePass

Welcome back

Enter your credentials to access your vault.

User ID Master Password

Two-Factor Authentication

Open Google Authenticator and enter the 6-digit code for GePass.

Tap the code in Google Authenticator to copy it, then paste it below.

Authenticator Code

Account Recovery

We will send a recovery code to your registered email address.

Recovery code

Create your vault

Choose a unique User ID and a strong master password. These cannot be recovered if lost.

User ID Master Password

Confirm Password

Recovery email

Used to receive a one-time code if you lose access to Google Authenticator.

Set up Authenticator

Scan the QR code with Google Authenticator (or tap the link on mobile), then enter the code to confirm.

Open in Google Authenticator

Or enter the key manually:

Enter the 6-digit code to confirm setup

🔐 GePass

🔍

🔍

GePass 1.0.0

AES-256-GCM · PBKDF2-SHA256 · TOTP (RFC 6238)

🔐

Open in Google Authenticator

Or enter the key manually:

📝

16

🔐

Privacy & Security Notice

How GePass handles your data

🔒 Your data security

All passwords are encrypted with AES-256-GCM directly in your browser before being transmitted or stored on the server.
Your master password never leaves your device — it is used only to derive the encryption key locally via PBKDF2-SHA256.
The server stores only encrypted data. Nobody — not even the server administrator — can read your passwords without your master password.
Two-factor authentication (TOTP) via Google Authenticator adds a second layer of protection: even if your master password is stolen, the vault cannot be opened without the time-based code.
Each session auto-locks after 15 minutes of inactivity.

⚠️ Risks to be aware of

Forgotten master password: if you forget your master password, your data is permanently unrecoverable — there is no backdoor.
Weak master password: a short or simple master password makes the encrypted vault file more vulnerable to offline brute-force attacks if it is ever obtained by an attacker.
Compromised device: malware or keyloggers on your device could capture the master password as you type it.
No automatic backup: if the vault files are deleted from the server, data is permanently lost. Keep regular server backups.
Recovery email: the recovery email address is stored inside the encrypted vault. Without a recovery email, losing access to Google Authenticator means permanent loss of access to the vault.

GePass is a self-hosted tool. Responsibility for securing the server and vault files rests with whoever operates the server infrastructure.