APM

A better local password manager for everyone.

APM is a fast, zero-knowledge CLI password manager written in Go and Rust. It stores **25+ structured secret types** in a single encrypted vault — from passwords and TOTP codes to SSH keys, medical records, photos, and binary files. Two binaries ship from this repo: `pm` for personal use and `pm-team` for shared organizational vaults.

Why APM?

Fast & easy to learn — no memorizing commands or flags. APM prompts you for whatever it needs. CLI flags are also available for power users who want maximum speed.
Zero-knowledge — your master password is never stored. Three separate 32-byte keys are derived using Argon2id. No one but you can decrypt your vault.
Dual encryption — choose AES-256-GCM or XChaCha20-Poly1305. Double-layer integrity via HMAC-SHA256 on top of AEAD authentication.
Portable — one vault file, one binary. Take your vault anywhere.
Optional cloud — sync to Google Drive, GitHub, or Dropbox. Fully opt-in; no account required to use APM.
AI-ready — native MCP server with scoped tokens so Claude, Cursor, or any MCP-compatible agent can access your vault safely.
Team-ready — full RBAC, departments, approval workflows, and shared vaults in pm-team.

Quick Start

go build -o pm .
pm setup       # initialize vault and choose security profile
pm unlock      # start a session
pm add         # add a secret (interactive)
pm get github  # fuzzy search and retrieve
pm lock        # end session

Team edition:

cd team
go build -o pm-team .

Secret Types

APM supports 25 structured secret types with validated fields and type-specific display logic:

#	Type	#	Type
1	Password	14	Docker Registry
2	TOTP	15	CI/CD Secret
3	Government ID	16	Secure Note
4	Medical Record	17	Recovery Codes
5	Travel Info	18	Certificate
6	Contact	19	Banking
7	Wi-Fi	20	Document
8	API Key	21	Software License
9	Token	22	Legal Contract
10	SSH Key	23	Photo
11	SSH Config	24	Audio
12	Cloud Credentials	25	Video
13	Kubernetes

Features

Security

Zero-knowledge Argon2id key derivation — master password never stored
Dual AEAD ciphers: AES-256-GCM and XChaCha20-Poly1305
HMAC-SHA256 double-layer integrity check
Four tunable security profiles: standard, hardened, paranoid, legacy
Watchtower (pm watchtower): a 0–100 security score with weak, reused, old, breached (opt-in, k-anonymous) and exposed passwords, expiring items, missing two-factor and passkeys, risky keys and setup checks, plus per-item trust scores and an activity review
Wrong passwords add a growing wait (never a permanent lock), shared by the CLI, app and extension
Tamper-evident audit log stored outside the vault

Vault

Single encrypted vault file — portable across any device
Spaces for logical compartmentation (like folders)
Fuzzy search with interactive browser and keyboard navigation
Metadata inspector: creation date, last access, access count, trust score

TOTP

Live countdown timers in an interactive list
Persistent custom ordering
Direct copy: pm totp github
Autofill daemon integration for auto-injecting 2FA codes

Cloud Sync

Google Drive (OAuth2 PKCE), GitHub (PAT), Dropbox (OAuth2 PKCE)
End-to-end encrypted — providers never see plaintext
.apmignore to filter entries per provider
Conflict resolution: overwrite, keep local, or cancel
Background auto-sync

Sessions

Explicit unlock/lock with configurable expiry and inactivity timeout
Delegated ephemeral sessions for automation and AI-agent access

MCP Server

Native Model Context Protocol server
Scoped permission tokens: read, secrets, write, admin
Write ops wait for your approval in the desktop app; assistants cannot approve their own changes
Works with Claude Desktop, Cursor, Windsurf, and any MCP client

Recovery

Factor	Command
Email OTP	`pm auth email`
Recovery Key	`pm auth recover`
Quorum Shares (Shamir)	`pm auth quorum-setup`
WebAuthn Passkey	`pm auth passkey register`
One-time Recovery Codes	`pm auth codes generate`

Import / Export

Format	Import	Export
JSON	`pm import json`	`pm export json`
CSV	`pm import csv`	`pm export csv`
TXT	`pm import txt`	`pm export txt`

Policy Engine

name: corporate-standard
password_policy:
  min_length: 14
  require_uppercase: true
  require_numbers: true
  require_symbols: true
rotation_policy:
  rotate_every_days: 90
  notify_before_days: 14

pm policy load ./policies/

Team Edition (pm-team)

RBAC with multiple roles
Departments with isolated encryption domains
Approval workflows for sensitive entries
Shared vaults for multi-user credential sharing

Browser extension

The APM browser extension fills logins, offers one-time codes on the sites they belong to, saves new logins, and creates and uses passkeys. It never sees your master password or a passkey's private key. It talks to a small bridge that APM serves on your own machine at 127.0.0.1:41417 (set APM_BRIDGE_PORT to use another port).

Three ways to reach the vault

With the desktop app: the bridge runs while the app is open. Pairing requests and browser unlocks show up in the app.
With the CLI only, linked (recommended): run pm extension link once. It registers pm as a native messaging host with each Chromium browser (Chrome, Edge, Brave, Arc, Vivaldi, Chromium), and from then on the browser starts pm on its own whenever the app is closed.
With the CLI only, from a terminal: run pm extension serve and leave it open. It serves the same API the desktop app serves, and shows each unlock, lock and pairing request as it happens.

pm extension link               # once per computer; confirm the code the extension shows
pm extension serve              # unlocks with your CLI session, or asks for the master password
pm extension serve --locked     # starts locked; unlock from the extension
pm extension serve --idle 5m    # locks after 5 minutes without browser activity (default 15m, 0 turns it off)

pm extension serve prints a line when the vault is unlocked or locked. Press Ctrl+C to stop it; the vault key is dropped from memory. If the port is taken, it exits and tells you the APM app may already be serving the extension.

Pairing a browser

In the extension, choose Connect. The extension shows a 6 character code, for example K7M-2QX.
Check that APM shows the same code: the desktop app opens a dialog, and pm extension link or pm extension serve asks in the terminal, for example Connect Chrome on macOS? Code K7M-2QX [y/N].
Approve it. The extension receives its token and is paired.

apm v11.1.0

APM