Engineering Blog
Product thinking and engineering deep-dives from Account Password Helper: local-first security, MV3 performance in practice, and Web Crypto internals.
Why I Built a Local-First Password Manager
A local-first, open-source Chrome password manager for developers juggling dev, test, staging and prod accounts. No account, no sync server, no cloud trust.
Sub-Second Chrome Side Panel on MV3
MV3 service workers die without warning, so the side panel cold-starts white. Dual-layer keep-alive, four-tier pre-warming and three-way data racing fix that.
Web Crypto for a Real Password Manager
No crypto library, just the browser-native Web Crypto API — PBKDF2 at 600,000 iterations, per-field AES-256-GCM, session lifecycle and atomic re-keying.
Four Features, Four Implementation Notes
Right-click fill, inline panel positioning, site-wide side panel search and the read-only entry drawer — the trade-offs and security boundaries behind each.
Three Tiers of Cross-Subdomain Matching
Exact-host matching isolates environments, but real logins span a subdomain family. Three tiers, one root-domain rule, and a %2A bug only a real browser caught.
Chrome Password Manager: Which One to Use?
Built-in Chrome, cloud managers and local-first tools fit different users. Compare environment isolation, encryption, migration and offline use before choosing.
Managing Dev, Test and Prod Accounts Safely
Four accounts for one system — how do you stop a test credential from landing in production? A practical guide to host matching, naming, dedupe and team handoff.
TOTP 2FA: How It Works and Where to Store It
What TOTP is, why codes change every 30 seconds, and what to check before moving secrets from a phone authenticator into a browser extension.