需要先安装 Bun 运行时,不是 Node.js 环境;开发模式从 .env 读取配置,需自行准备该文件;测试始终使用内存 SQLite,不会加载 .env,别拿测试结果验证真实配置。
Passky-Server
Rabbit-CompanyEUPL-1.2活跃维护Passky 密码管理器的服务端,用 TypeScript 实现,负责账号密码的存储与同步,适合想自建密码库、不依赖第三方云服务的人。
Server for Passky (password manager)
bun install
bun run devREADME 未说明硬件要求,仅说明运行在 Bun 上,未提及 GPU 或显存。
Passky 密码管理器的自托管服务端,用零信任加密保存你的密码库
Passky 密码管理器的服务端,用 TypeScript 实现,负责账号密码的存储与同步,适合想自建密码库、不依赖第三方云服务的人。
核心能力
- 用 XChaCha20 加密敏感数据后存到服务端
- 用 Argon2id 哈希主密码,抵御暴力破解
- 基于零信任架构,服务端不接触明文
- 数据可存 SQLite、MySQL、MariaDB 或 PostgreSQL
- 提供 Docker 与 Umbrel 一键安装方式
容易踩的坑
- v9.0.0最新正式版2026-10-21 · 2026-10-21 09:43 UTC
Passky Server 9.0.0
Passky Server has been rewritten in TypeScript and now runs on Bun. The API is unchanged, so existing Passky clients keep working without an update.
Upgrading
Back up your database first, then run the usual commands:
docker compose pull docker compose down docker compose up -dYour existing
.envanddocker-compose.ymlkeep working. If your compose file still mounts the database at/var/www/html/databases, Passky finds it there and keeps using it.All users will need to sign in again once after the upgrade.
Read the upgrade guide before upgrading. To stay on the PHP version for now, use the image
rabbitcompany/passky-server:8.1.8.Highlights
- One lightweight Bun process replaces Nginx, PHP-FPM, cron, and the bundled Redis.
- PostgreSQL is now supported alongside SQLite, MySQL, and MariaDB.
- Account passwords are now hashed with Argon2id. Existing bcrypt hashes are upgraded automatically at each user's next sign-in.
- The administrator interface has been redesigned. It adds searchable, paginated accounts and licenses, a registration report, and health checks.
New features
DATABASE_URLsetting for SQLite, MySQL, MariaDB, and PostgreSQL connections.- BurrowGate support. Set
BURROWGATE_ORIGIN_SECRETto accept only requests signed by BurrowGate. - Optionally show Passky usernames in BurrowGate's traffic log with
BURROWGATE_REPORT_USERNAMES. Only usernames verified by a password, token, or administrator session are reported. TRUSTED_PROXIESsetting that controls which reverse proxies may report a client's IP address.- Redis is optional. Use
REDIS_URL, or the existingREDIS_*settings, to keep sign-ins across restarts. - OpenMetrics endpoint at
/metrics, with optional bearer token protection. - Optional log export to Grafana Loki.
- Health endpoint at
/health, used by the Docker health check. - Adjustable Argon2id cost with
ARGON2_MEMORY_COSTandARGON2_TIME_COST. Accounts are rehashed with new values at their next sign-in. MYSQL_CACHE_MODEcaches user and password counts, which reduces load on databases billed by rows read.
Security
- Deleting an account now signs it out on every device.
- The password is checked before two-factor authentication, so the API no longer reveals whether an account uses 2FA.
- YubiKey codes are validated more strictly, and the response from the validation server is fully verified.
- Administrator sign-in is limited to five attempts per IP address every fifteen minutes.
- Administrator actions require a CSRF token, and session cookies are
HttpOnly,SameSite=Strict, andSecureover HTTPS. - A license key can no longer be redeemed twice by simultaneous requests.
- Password edits and deletions are checked against the owner directly in the database.
- Forwarded client IP headers are only accepted from trusted proxies.
- Request sizes are limited, and metrics cannot be inflated by random URLs.
Behavior changes
getReportis disabled by default and returns error32. SetREPORTS_ENABLED=trueto make it public again. Administrators always see the report in the administrator interface.getStatsis disabled by default and returns error33. SetSTATS_ENABLED=trueto make it public again. Administrators always see CPU, memory, and disk usage in the administrator interface.- A wrong password returns error
2, even when two-factor authentication is enabled. getInfonow reportshashingAlgorithmandhashingMemoryCost.hashingCostnow holds the Argon2id time cost.- Daily maintenance runs inside the server. The
/cron.phpendpoint has been removed and external cron jobs are no longer needed. REDIS_LOCAL_HOST,REDIS_LOCAL_PORT, andREDIS_LOCAL_PASSWORDare no longer used.
Removed
- T
- v8.1.82024-11-05 · 2024-11-05 18:46 UTC
查看更新说明
Improved:
- Email validation
Updated:
- TailwindCSS
- v8.1.72024-06-03 · 2024-06-03 20:21 UTC
查看更新说明
Fixed:
- Rare issue that could prevent users from storing their passwords
Updated:
- Docker Image
- TailwindCSS
- v8.1.62024-01-28 · 2024-01-28 11:12 UTC
查看更新说明
Updated:
- Docker Image
- TailwindCSS
- PHPMailer
- v8.1.52023-08-20 · 2023-08-20 07:46 UTC
查看更新说明
Fixed:
- Forgot Username feature
Updated:
- Docker Image
- TailwindCSS
- dotenv
用户点评
登录用户的真实使用记录,可按版本和硬件筛选还没有人点评。第一个说出真实体验的人最有价值。
Download from Official Website
Passky Clients
What is Passky?
Passky is a simple, modern, lightweight, open source and secure password manager.
How Much Does it Cost?
Passky is a free, open-source password manager that simplifies your digital life. Both the free and premium plans include advanced security features such as two-factor authentication to ensure the safety and security of your sensitive data.
While the free plan allows you to store up to 100 passwords, the premium plan offers additional benefits such as the ability to store an unlimited number of passwords. Upgrade to the premium plan to gain access to all of Passky's features and take your password security to the next level.
At Passky, we take your security seriously, and we don't compromise on safety when it comes to password management. Sign up now and experience the peace of mind that comes with using Passky.
How it Works?
Passky uses a combination of advanced encryption methods to ensure the security of your data.
Passky is based on a zero trust architecture and uses advanced encryption methods such as XChaCha20 and Argon2id to ensure the security of your sensitive data.
For sensitive data encryption, Passky uses XChaCha20, a state-of-the-art encryption algorithm that provides a high level of security and performance. This encryption method is designed to be resistant to known-plaintext attacks and other forms of cryptanalysis.
For master password hashing, Passky uses Argon2id, a password-hashing algorithm that has been recognized as the winner of multiple password-hashing competitions, such as the Password Hashing Competition (PHC) held by the community. It is designed to be resistant to brute-force attacks. This algorithm uses a combination of memory-hard and data-dependent techniques to make it difficult for attackers to guess your master password.
When you save your account information to Passky, all sensitive data is fully encrypted using XChaCha20. The encrypted data is then stored on Passky's servers.
When you try to access your account, Passky will prompt you to input your master password. The master password is then hashed using Argon2id algorithm to ensure its security. The hashed master password is then used to decrypt the sensitive data, allowing you to access your account.
In summary, Passky uses advanced encryption methods such as XChaCha20 and Argon2id to ensure the security of your sensitive data and master password, making it difficult for anyone to access your information without your permission.
How Does Passky Compare to the Competition?
| Feature | Passky | Bitwarden | NordPass | Dashlane | 1Password | LastPass |
|---|---|---|---|---|---|---|
| Premium price | $2.00/mo | $1.65/mo | $1.99/mo | $4.99/mo | $3.99/mo | $3.00/mo |
| Free plan | 100 passwords | Unlimited | 1 active device | None | None | 1 device type |
| Premium passwords | Unlimited | Unlimited | Unlimited | Unlimited | Unlimited | Unlimited |
| Two-factor authentication | Yes | Yes | Yes | Yes | Yes | Yes |
| Zero-knowledge encryption | Yes | Yes | Yes | Yes | Yes | Yes |
| Encryption | XChaCha20 | AES-256 | XChaCha20 | AES-256 | AES-256 | AES-256 |
| Key derivation | Argon2id | PBKDF2 or Argon2id | Argon2 | Argon2d | PBKDF2 | PBKDF2 |
| Open source | Yes | Yes | No | Partial | No | No |
| Self-hosting | Yes | Yes | No | No | No | No |
Personal plans in USD, price per month with yearly billing, without first-year discounts. Checked October 2026.
Installation
Passky Server runs on Bun and stores data in SQLite, MySQL, MariaDB, or PostgreSQL. It can be installed in multiple ways.
All settings are described in the configuration reference.
Upgrade
To upgrade your Passky Server, please select the installation method that you previously used to set up your server. This will ensure a seamless upgrade process and minimal disruption to your current Passky Server configuration. If you have any issues or concerns during the upgrade process, please do not hesitate to reach out to our support team for assistance.
Development
bun install
bun run test
bun run typecheck
bun run dev
bun run dev starts the server with file watching. Settings are read from .env. The tests never load it and always run against an in-memory SQLite database.
Pull requests to main run the type check and test suite. Pushes to main publish rabbitcompany/passky-server:latest, and GitHub releases publish the versioned image tags.
License
Passky Server is licensed under the European Union Public Licence v. 1.2 (EUPL-1.2). Releases up to and including 8.1.8 were published under the GNU General Public License v3.0 and remain available under those terms.
