LibrePass
A self-hosted password manager built as a complete product study spanning a native Android app, a Spring Boot backend, encrypted synchronization and an early web client.
Project overview
LibrePass was a self-directed open-source project covering a native Android application, a backend API, encrypted data storage, synchronization, documentation and containerized deployment.
The central architectural decision was to separate client and server responsibilities. Sensitive vault operations were designed to happen on the client. The backend handled authentication, API communication, synchronization and storage of encrypted payloads.
Main areas of the project
- Native Android client written in Kotlin and Jetpack Compose.
- Biometric access and automatic vault locking.
- Local persistence with offline operation.
- Synchronization between the local vault and backend.
- Spring Boot API with validation and request limiting.
- PostgreSQL and MySQL persistence.
- Docker-based deployment.
- Early Svelte web client.
- Technical and deployment documentation.
What it taught me
The most important lessons from LibrePass
LibrePass required me to consider user experience, encryption, synchronization, backend boundaries, deployment and project scope as parts of one system.
Security is a process
Password manager security depends on encryption, password hashing, token handling, validation, automatic vault locking and clearly defined trust boundaries working together.
Synchronization is product work
Offline operation and multi-device synchronization must remain predictable when connectivity disappears, local changes accumulate or devices modify the same data.
Mobile applications need architecture
The Android client helped me separate the Compose interface, local state, biometric access, persistence and synchronization instead of coupling them directly to the UI.
Backend services need clear boundaries
The server handled authentication, APIs, request limits and encrypted payload storage, while sensitive vault operations remained a client responsibility.
Documentation supports long-term development
Setup guides and architecture notes made it possible to reconstruct technical decisions after individual parts of the project stopped being actively developed.
Project scope must eventually close
The unfinished web client showed me when a useful project should become a documented reference instead of continuing to grow without a realistic completion plan.
Android application
Native mobile password manager
The Android application was the main and most complete LibrePass client. It combined Kotlin, Jetpack Compose, Material 3, biometric access, local persistence and offline synchronization.
Web application
Browser client prototype
The Svelte client explored how LibrePass could support vault management on larger screens. It remained an unfinished prototype and was not released as a production-ready application.
