Sesame open-sources a local-first password manager that keeps 2FA and recovery off its servers

A new password manager called Sesame reached the front page of Hacker News this week, pitching a local-first, fully open-source alternative that keeps passwords, two-factor authentication codes and account recovery details together in one vault — without that vault ever reaching the company's servers.

What ships in the beta

According to the project's website, Sesame is currently a free public beta for Windows. Each entry combines a username, password, 2FA code, website and optional recovery details, so users can copy credentials, read a 2FA code and check recovery information from a single view. The app imports vaults from 15 other password-manager formats and, unusually, presents every change for review before it is saved.

The beta also includes a security checkup that links each result back to the affected login, unlock via Windows Hello or a PIN, document attachments, backups and export.

A server that never sees the vault

Sesame's architecture splits the sensitive work from the networked parts. Encryption, security checks, 2FA generation and backups all run inside the desktop app, and the site states plainly that the vault never reaches Sesame's servers. The server component — a Go API the project describes as vault-blind, plus an account portal and admin interface running on PostgreSQL — handles only things like account registration and connected-device management. The desktop app works without any of it, and the project publishes instructions for hosting the server yourself.

A website account is optional and covers beta access, signed downloads, licences and device management. It never stores a vault.

The site adds that there is nothing to opt out of: no analytics, no ads and no third-party scripts, with the content security policy published in the source.

Everything under AGPL

The project's answer to the trust problem a password manager inevitably raises is to publish all of its code under AGPL-3.0-or-later. Four repositories make up the product: sesame-desktop, the Windows app and its Rust vault core; sesame-server, the Go API and portals; sesame-browser-extension, written in TypeScript; and the static website. The repositories showed 147 commits in the 30 days to 22 August 2026, with the desktop app the most active at 78.

Users can build the desktop app themselves from Node, Rust and the Windows WebView2 runtime, and the site notes that a vault created in a self-built copy opens like any other.

What is still missing

Several pieces are further behind. The browser extension for Chrome, Edge and Firefox is packaged but has not been submitted to the browser stores. In-app updates and Sesame Sync are described as built but not yet shipped, while mobile apps, passkeys, sharing and emergency access remain on the planned list.

The project is also candid that an independent security review is still pending, and it advises beta users to keep a separate backup of anything they cannot afford to lose.

Why it matters

Password managers ask for an unusual degree of trust, and most mainstream options resolve that with closed source and reputation. Sesame's bet is that verifiability can substitute: local-first storage, a server that is structurally unable to hold vaults, permissive self-hosting and AGPL licensing together let technically minded users check the claims rather than take them on faith. Pairing 2FA codes with passwords in one place is convenient, but it also concentrates sensitive material on a single device — which makes the still-pending independent review the main thing to watch before treating Sesame as a primary manager rather than an interesting experiment.