APM is a fast, zero-knowledge CLI password manager written in Go and Rust. It stores **25+ structured secret types** in a single encrypted vault — from passwords and TOTP codes to SSH keys, medical records, photos, and binary files. Two binaries ship from this repo: `pm` for personal use and `pm-team` for shared organizational vaults.

---

Why APM?

• Fast & easy to learn — no memorizing commands or flags. APM prompts you for whatever it needs. CLI flags are also available for power users who want maximum speed.
• Zero-knowledge — your master password is never stored. Three separate 32-byte keys are derived using Argon2id. No one but you can decrypt your vault.
• Dual encryption — choose AES-256-GCM or XChaCha20-Poly1305. Double-layer integrity via HMAC-SHA256 on top of AEAD authentication.
• Portable — one vault file, one binary. Take your vault anywhere.
• Optional cloud — sync to Google Drive, GitHub, or Dropbox. Fully opt-in; no account required to use APM.
• AI-ready — native MCP server with scoped tokens so Claude, Cursor, or any MCP-compatible agent can access your vault safely.
• Team-ready — full RBAC, departments, approval workflows, and shared vaults in pm-team.

---

Quick Start

go build -o pm .
pm setup       # initialize vault and choose security profile
pm unlock      # start a session
pm add         # add a secret (interactive)
pm get github  # fuzzy search and retrieve
pm lock        # end session

Team edition:

cd team
go build -o pm-team .

---

Secret Types

APM supports 25 structured secret types with validated fields and type-specific display logic:

#	Type	#	Type
1	Password	14	Docker Registry
2	TOTP	15	CI/CD Secret
3	Government ID	16	Secure Note
4	Medical Record	17	Recovery Codes
5	Travel Info	18	Certificate
6	Contact	19	Banking
7	Wi-Fi	20	Document
8	API Key	21	Software License
9	Token	22	Legal Contract
10	SSH Key	23	Photo
11	SSH Config	24	Audio
12	Cloud Credentials	25	Video
13	Kubernetes

---

Features

Security

• Zero-knowledge Argon2id key derivation — master password never stored
• Dual AEAD ciphers: AES-256-GCM and XChaCha20-Poly1305
• HMAC-SHA256 double-layer integrity check
• Four tunable security profiles: standard, hardened, paranoid, legacy
• Watchtower (pm watchtower): a 0–100 security score with weak, reused, old, breached (opt-in, k-anonymous) and exposed passwords, expiring items, missing two-factor and passkeys, risky keys and setup checks, plus per-item trust scores and an activity review
• Wrong passwords add a growing wait (never a permanent lock), shared by the CLI, app and extension
• Tamper-evident audit log stored outside the vault

Vault

• Single encrypted vault file — portable across any device
• Spaces for logical compartmentation (like folders)
• Fuzzy search with interactive browser and keyboard navigation
• Metadata inspector: creation date, last access, access count, trust score

TOTP

• Live countdown timers in an interactive list
• Persistent custom ordering
• Direct copy: pm totp github
• Autofill daemon integration for auto-injecting 2FA codes

Cloud Sync

• Google Drive (OAuth2 PKCE), GitHub (PAT), Dropbox (OAuth2 PKCE)
• End-to-end encrypted — providers never see plaintext
• .apmignore to filter entries per provider
• Conflict resolution: overwrite, keep local, or cancel
• Background auto-sync

Sessions

• Explicit unlock/lock with configurable expiry and inactivity timeout
• Delegated ephemeral sessions for automation and AI-agent access

MCP Server

• Native Model Context Protocol server
• Scoped permission tokens: read, secrets, write, admin
• Write ops wait for your approval in the desktop app; assistants cannot approve their own changes
• Works with Claude Desktop, Cursor, Windsurf, and any MCP client

Recovery

Factor	Command
Email OTP	pm auth email
Recovery Key	pm auth recover
Quorum Shares (Shamir)	pm auth quorum-setup
WebAuthn Passkey	pm auth passkey register
One-time Recovery Codes	pm auth codes generate

Import / Export

Format	Import	Export
JSON	pm import json	pm export json
CSV	pm import csv	pm export csv
TXT	pm import txt	pm export txt

Policy Engine

name: corporate-standard
password_policy:
  min_length: 14
  require_uppercase: true
  require_numbers: true
  require_symbols: true
rotation_policy:
  rotate_every_days: 90
  notify_before_days: 14

pm policy load ./policies/

Team Edition (pm-team)

• RBAC with multiple roles
• Departments with isolated encryption domains
• Approval workflows for sensitive entries
• Shared vaults for multi-user credential sharing

---

Browser extension

The APM browser extension fills logins, offers one-time codes on the sites they belong to, saves new logins, and creates and uses passkeys. It never sees your master password or a passkey's private key. It talks to a small bridge that APM serves on your own machine at 127.0.0.1:41417 (set APM_BRIDGE_PORT to use another port).

Three ways to reach the vault

• With the desktop app: the bridge runs while the app is open. Pairing requests and browser unlocks show up in the app.
• With the CLI only, linked (recommended): run pm extension link once. It registers pm as a native messaging host with each Chromium browser (Chrome, Edge, Brave, Arc, Vivaldi, Chromium), and from then on the browser starts pm on its own whenever the app is closed.
• With the CLI only, from a terminal: run pm extension serve and leave it open. It serves the same API the desktop app serves, and shows each unlock, lock and pairing request as it happens.

pm extension link               # once per computer; confirm the code the extension shows
pm extension serve              # unlocks with your CLI session, or asks for the master password
pm extension serve --locked     # starts locked; unlock from the extension
pm extension serve --idle 5m    # locks after 5 minutes without browser activity (default 15m, 0 turns it off)

pm extension serve prints a line when the vault is unlocked or locked. Press Ctrl+C to stop it; the vault key is dropped from memory. If the port is taken, it exits and tells you the APM app may already be serving the extension.

Pairing a browser

1. In the extension, choose Connect. The extension shows a 6 character code, for example K7M-2QX.
2. Check that APM shows the same code: the desktop app opens a dialog, and pm extension link or pm extension serve asks in the terminal, for example Connect Chrome on macOS? Code K7M-2QX [y/N].
3. Approve it. The extension receives its token and is paired.