Passky-Server

Rabbit-CompanyEUPL-1.2活跃维护

Passky 密码管理器的服务端,用 TypeScript 实现,负责账号密码的存储与同步,适合想自建密码库、不依赖第三方云服务的人。

Server for Passky (password manager)

v9.0.0发布于 2026-10-21 09:43 UTC242star30fork同步于 2026-11-10 18:04 UTC

怎么上手

由 README 提炼,执行前请确认
bun install
bun run dev
硬件要求按 README 说明

README 未说明硬件要求,仅说明运行在 Bun 上,未提及 GPU 或显存。

下载:源码 zip·GitHub Releases(安装包)本站不镜像安装包

项目说明

由 README 自动翻译提炼

Passky 密码管理器的自托管服务端,用零信任加密保存你的密码库

Passky 密码管理器的服务端,用 TypeScript 实现,负责账号密码的存储与同步,适合想自建密码库、不依赖第三方云服务的人。

核心能力

  • 用 XChaCha20 加密敏感数据后存到服务端
  • 用 Argon2id 哈希主密码,抵御暴力破解
  • 基于零信任架构,服务端不接触明文
  • 数据可存 SQLite、MySQL、MariaDB 或 PostgreSQL
  • 提供 Docker 与 Umbrel 一键安装方式

容易踩的坑

需要先安装 Bun 运行时,不是 Node.js 环境;开发模式从 .env 读取配置,需自行准备该文件;测试始终使用内存 SQLite,不会加载 .env,别拿测试结果验证真实配置。

内容由模型根据 README 生成,可能不完整或不准确,以官方文档为准。看原文 README

最近发版

5 个版本v9.0.0
  1. v9.0.0最新正式版2026-10-21 · 2026-10-21 09:43 UTC

    Passky Server 9.0.0

    Passky Server has been rewritten in TypeScript and now runs on Bun. The API is unchanged, so existing Passky clients keep working without an update.

    Upgrading

    Back up your database first, then run the usual commands:

    docker compose pull
    docker compose down
    docker compose up -d
    

    Your existing .env and docker-compose.yml keep working. If your compose file still mounts the database at /var/www/html/databases, Passky finds it there and keeps using it.

    All users will need to sign in again once after the upgrade.

    Read the upgrade guide before upgrading. To stay on the PHP version for now, use the image rabbitcompany/passky-server:8.1.8.

    Highlights

    • One lightweight Bun process replaces Nginx, PHP-FPM, cron, and the bundled Redis.
    • PostgreSQL is now supported alongside SQLite, MySQL, and MariaDB.
    • Account passwords are now hashed with Argon2id. Existing bcrypt hashes are upgraded automatically at each user's next sign-in.
    • The administrator interface has been redesigned. It adds searchable, paginated accounts and licenses, a registration report, and health checks.

    New features

    • DATABASE_URL setting for SQLite, MySQL, MariaDB, and PostgreSQL connections.
    • BurrowGate support. Set BURROWGATE_ORIGIN_SECRET to accept only requests signed by BurrowGate.
    • Optionally show Passky usernames in BurrowGate's traffic log with BURROWGATE_REPORT_USERNAMES. Only usernames verified by a password, token, or administrator session are reported.
    • TRUSTED_PROXIES setting that controls which reverse proxies may report a client's IP address.
    • Redis is optional. Use REDIS_URL, or the existing REDIS_* settings, to keep sign-ins across restarts.
    • OpenMetrics endpoint at /metrics, with optional bearer token protection.
    • Optional log export to Grafana Loki.
    • Health endpoint at /health, used by the Docker health check.
    • Adjustable Argon2id cost with ARGON2_MEMORY_COST and ARGON2_TIME_COST. Accounts are rehashed with new values at their next sign-in.
    • MYSQL_CACHE_MODE caches user and password counts, which reduces load on databases billed by rows read.

    Security

    • Deleting an account now signs it out on every device.
    • The password is checked before two-factor authentication, so the API no longer reveals whether an account uses 2FA.
    • YubiKey codes are validated more strictly, and the response from the validation server is fully verified.
    • Administrator sign-in is limited to five attempts per IP address every fifteen minutes.
    • Administrator actions require a CSRF token, and session cookies are HttpOnly, SameSite=Strict, and Secure over HTTPS.
    • A license key can no longer be redeemed twice by simultaneous requests.
    • Password edits and deletions are checked against the owner directly in the database.
    • Forwarded client IP headers are only accepted from trusted proxies.
    • Request sizes are limited, and metrics cannot be inflated by random URLs.

    Behavior changes

    • getReport is disabled by default and returns error 32. Set REPORTS_ENABLED=true to make it public again. Administrators always see the report in the administrator interface.
    • getStats is disabled by default and returns error 33. Set STATS_ENABLED=true to make it public again. Administrators always see CPU, memory, and disk usage in the administrator interface.
    • A wrong password returns error 2, even when two-factor authentication is enabled.
    • getInfo now reports hashingAlgorithm and hashingMemoryCost. hashingCost now holds the Argon2id time cost.
    • Daily maintenance runs inside the server. The /cron.php endpoint has been removed and external cron jobs are no longer needed.
    • REDIS_LOCAL_HOST, REDIS_LOCAL_PORT, and REDIS_LOCAL_PASSWORD are no longer used.

    Removed

    • T
  2. v8.1.82024-11-05 · 2024-11-05 18:46 UTC
    查看更新说明

    Improved:

    • Email validation

    Updated:

    • TailwindCSS
  3. v8.1.72024-06-03 · 2024-06-03 20:21 UTC
    查看更新说明

    Fixed:

    • Rare issue that could prevent users from storing their passwords

    Updated:

    • Docker Image
    • TailwindCSS
  4. v8.1.62024-01-28 · 2024-01-28 11:12 UTC
    查看更新说明

    Updated:

    • Docker Image
    • TailwindCSS
    • PHPMailer
  5. v8.1.52023-08-20 · 2023-08-20 07:46 UTC
    查看更新说明

    Fixed:

    • Forgot Username feature

    Updated:

    • Docker Image
    • TailwindCSS
    • dotenv

用户点评

登录用户的真实使用记录,可按版本和硬件筛选
共 0 条

    还没有人点评。第一个说出真实体验的人最有价值。

    README 原文

    未翻译

    GitHub issues GitHub stars GitHub forks GitHub license

    Download from Official Website

    Passky Clients

    What is Passky?

    Passky is a simple, modern, lightweight, open source and secure password manager.

    Passky - Password manager

    How Much Does it Cost?

    Passky is a free, open-source password manager that simplifies your digital life. Both the free and premium plans include advanced security features such as two-factor authentication to ensure the safety and security of your sensitive data.

    While the free plan allows you to store up to 100 passwords, the premium plan offers additional benefits such as the ability to store an unlimited number of passwords. Upgrade to the premium plan to gain access to all of Passky's features and take your password security to the next level.

    At Passky, we take your security seriously, and we don't compromise on safety when it comes to password management. Sign up now and experience the peace of mind that comes with using Passky.

    How it Works?

    Passky uses a combination of advanced encryption methods to ensure the security of your data.

    Passky is based on a zero trust architecture and uses advanced encryption methods such as XChaCha20 and Argon2id to ensure the security of your sensitive data.

    For sensitive data encryption, Passky uses XChaCha20, a state-of-the-art encryption algorithm that provides a high level of security and performance. This encryption method is designed to be resistant to known-plaintext attacks and other forms of cryptanalysis.

    For master password hashing, Passky uses Argon2id, a password-hashing algorithm that has been recognized as the winner of multiple password-hashing competitions, such as the Password Hashing Competition (PHC) held by the community. It is designed to be resistant to brute-force attacks. This algorithm uses a combination of memory-hard and data-dependent techniques to make it difficult for attackers to guess your master password.

    When you save your account information to Passky, all sensitive data is fully encrypted using XChaCha20. The encrypted data is then stored on Passky's servers.

    When you try to access your account, Passky will prompt you to input your master password. The master password is then hashed using Argon2id algorithm to ensure its security. The hashed master password is then used to decrypt the sensitive data, allowing you to access your account.

    In summary, Passky uses advanced encryption methods such as XChaCha20 and Argon2id to ensure the security of your sensitive data and master password, making it difficult for anyone to access your information without your permission.

    How Does Passky Compare to the Competition?

    FeaturePasskyBitwardenNordPassDashlane1PasswordLastPass
    Premium price$2.00/mo$1.65/mo$1.99/mo$4.99/mo$3.99/mo$3.00/mo
    Free plan100 passwordsUnlimited1 active deviceNoneNone1 device type
    Premium passwordsUnlimitedUnlimitedUnlimitedUnlimitedUnlimitedUnlimited
    Two-factor authenticationYesYesYesYesYesYes
    Zero-knowledge encryptionYesYesYesYesYesYes
    EncryptionXChaCha20AES-256XChaCha20AES-256AES-256AES-256
    Key derivationArgon2idPBKDF2 or Argon2idArgon2Argon2dPBKDF2PBKDF2
    Open sourceYesYesNoPartialNoNo
    Self-hostingYesYesNoNoNoNo

    Personal plans in USD, price per month with yearly billing, without first-year discounts. Checked October 2026.

    Installation

    Passky Server runs on Bun and stores data in SQLite, MySQL, MariaDB, or PostgreSQL. It can be installed in multiple ways.

    All settings are described in the configuration reference.

    Upgrade

    To upgrade your Passky Server, please select the installation method that you previously used to set up your server. This will ensure a seamless upgrade process and minimal disruption to your current Passky Server configuration. If you have any issues or concerns during the upgrade process, please do not hesitate to reach out to our support team for assistance.

    Development

    bun install
    bun run test
    bun run typecheck
    bun run dev
    

    bun run dev starts the server with file watching. Settings are read from .env. The tests never load it and always run against an in-memory SQLite database.

    Pull requests to main run the type check and test suite. Pushes to main publish rabbitcompany/passky-server:latest, and GitHub releases publish the versioned image tags.

    License

    Passky Server is licensed under the European Union Public Licence v. 1.2 (EUPL-1.2). Releases up to and including 8.1.8 were published under the GNU General Public License v3.0 and remain available under those terms.