IronDome 3.2.2

Local-first password vault — TUI | AES-128-CBC (Fernet) | PBKDF2-HMAC-SHA256 | OS biometric gate

Your bunkers. Your machine. Your rules.

IronDome encrypts your vault locally with AES-128-CBC (Fernet) and derives keys with PBKDF2-HMAC-SHA256 at 600,000 iterations. Full terminal UI. Unlock with Touch ID, Windows Hello, or fprintd. There is no account, no sync, and no telemetry: the package makes no network calls anywhere, verified by a test that fails the build if any module under password_manager/ so much as imports a networking library. Nothing leaves your device.

Quick Start

pip install IronDome
irondome

Two commands. Full TUI launches — splash screen, biometric auth, dashboard, vault browser, password generator.

First-time setup:

irondome-cli create bunker
irondome

Security

• AES-128-CBC encryption via Fernet
• PBKDF2-HMAC-SHA256 with 600,000 iterations (OWASP 2023)
• No network calls anywhere in the package — verified by a test that fails if any module imports socket/http/urllib/requests
• Master password never stored — only a PBKDF2 digest is written to disk, and there is no server to send it to
• Machine-scoped metadata — the stored master-user record is wrapped with a key derived from /etc/machine-id; the vault itself is protected by your master password
• Biometric gate — an OS authentication gate (PAM / Touch ID / Windows Hello) in front of the keyring-stored vault key. It is an access gate, not key material
• Two-factor mode — biometric gate + master password
• 24-character recovery code (XXXX-XXXX-XXXX-XXXX-XXXX-XXXX format)
• Adaptive lockout — progressive brute-force protection
• 30-minute sessions with auto-lock

Terminal UI

IronDome's primary interface is a full Terminal UI built with Textual:

• 12 screens — splash, login, dashboard, vault, detail, generator, save, settings, backup, status, help, confirm
• Keyboard-driven — arrows, Tab, Enter, Esc, hotkeys for every action
• Command palette — Ctrl+P fuzzy search across all commands
• Themed TUI — dark theme, dome green, amber warnings, red threats
• Security controls — masked input, alternate screen buffer, clipboard auto-clear (30s), signal handlers, mlockall swap avoidance (TUI only, best-effort)

CLI Mode

For scripts and automation:

irondome-cli create bunker       # First-time setup
irondome-cli open airspace       # Authenticate (30-min session)
bunker create                    # Quick-create password entry
bunker open                      # List all entries
bunker open github               # Search by name
bunker fortify                   # Encrypted backup
irondome-cli close airspace      # Lock everything

Cross-Platform

IronDome vs Cloud Managers

What IronDome does not do

• AES-128. Fernet splits its 32-byte key into a 16-byte AES key and a 16-byte HMAC key, so the block cipher runs with a 128-bit key, not a 256-bit one.
• The biometric check is not cryptographic. The key sits in the OS keyring under your login credentials, not under your fingerprint.
• No hardware security module. Machine scoping reads /etc/machine-id (mode 0444, world-readable). No TPM, no Secure Enclave.
• nuke cannot defeat an SSD controller. One random-overwrite pass, fsync, then unlink. On SSDs, CoW filesystems, or journaled ext4 the original blocks may survive.
• No memory zeroing of the key. It is held as an immutable Python bytes inside a Fernet object.
• No independent third-party audit. The project ships its own pytest suite, gated in CI before publish, but no external review. Treat this as beta software.

Links

• Website
• Documentation
• GitHub
• Live Demo (Colab)

License

GPL-3.0 — free to use, modify, distribute. Derivatives must remain open source.

Created by King Hippopotamus
_{No servers. No cloud. No compromise.}