Disclosure: this article contains affiliate links. If you buy through them we may earn a commission at no additional cost to you. Our recommendations are based on the evidence recorded alongside this article, and prices were verified on the date shown.

What changed and why it matters

On Hacker News's Show HN board, a developer introduced Sesame, described as an open-source password manager built to keep your vault local by default rather than routing it through a company's servers (Sesame's Show HN post at usesesame.app). For a category where centralized vaults are the norm, that's the specific claim worth checking before you read further: local-first storage, stated by the project's own site, not verified by an outside audit.

The timing matters because the developer is explicit about where the project stands. This isn't a finished product with a security stamp of approval — it's early software, and the developer says so directly, asking the community for testing and code review rather than pitching it as ready for your real passwords (the developer describes Sesame as early software).

The detail

"Local-first" is doing specific work in Sesame's pitch, so it's worth unpacking for anyone meeting the term for the first time. In a typical cloud password manager, your encrypted vault lives on a company's servers and syncs down to your devices. Sesame flips that: the vault stays on your device by default, and the project states that its hosted service never receives the vault itself (Sesame's hosted service never receives the vault itself).

That design choice also removes a step most password managers require. You don't need to create an account to set up or use a Sesame vault (no account is required to create or use a Sesame vault) — no signup form, no email verification, no company database holding your identity next to your vault's metadata.

Here's what that leaves confirmed and unconfirmed, based on what the developer has published so far:

That last row is the one to sit with. An open-source license and local storage reduce two specific risks — a vendor breach exposing vaults en masse, and a vendor shutting down and taking your data access with it. Neither claim, on its own, substitutes for an independent security review, which by the developer's own account hasn't happened yet.

What it means for you

If you're the kind of reader who follows Show HN threads about local-first security tools, you're probably also the kind of developer who ships your own side projects, internal tools, or companion sites — and those need somewhere to live. Before you wire up hosting for a password vault UI, a docs site, or any other project in this space, it helps to know what a deployment platform actually costs at your expected scale. You can [check current Vercel pricing and plans](See current pricing at the merchant) to see what a free tier covers and where paid limits start, before you commit a stack to it.

Skip Sesame for now if you need a password manager today for accounts that matter — banking, primary email, anything with financial exposure. The developer's own description places it before the independent review stage, and "early-stage, seeking testing" is a request for contributors, not an endorsement for daily use. Sesame is worth watching, and worth reading the source of if you can, but the decision in front of most readers right now isn't which vault to trust — it's whether to wait for the review before switching anything over.