Skip to content

Case study

LostPass — Local-First Password Manager + Licensing

A desktop vault on Electron with encrypted local SQLite (AES‑256‑GCM) and PIN/WebAuthn, plus a licensing server for subscriptions via Monobank, email key delivery, and deep-link activation.

Web
Integrations
Security
Open live site
LostPass — Local-First Password Manager + Licensing cover

Overview

Project overview

LostPass is a local-first password manager: the encrypted vault lives only on the user’s device. The server exists strictly for the commercial flow — purchase/renewal, license issuance and verification, email delivery, and one-tap activation inside the app via deep-link.

ROLE

Full Stack Engineer

FOCUS

  • Local-first architecture (offline by default)
  • Encrypted vault + PIN auth
  • Anti-bruteforce + optional biometrics
  • Commerce-only backend (payments + licenses)
  • Deep-link activation flow

Story

Problem → Solution → Outcome

PROBLEM

We needed to ship a trust-first password manager without cloud sync: a secure local vault, strong access control, and a commercial flow (trial, checkout, license delivery) that feels seamless.

SOLUTION

Built the desktop app with an encrypted SQLite vault (AES‑GCM) and PIN/WebAuthn access, then implemented a licensing server that sells subscriptions via Monobank, sends keys by email, and supports one-time, token-based activation through deep-link.

OUTCOME

A privacy-first product with a complete monetization loop — while keeping the vault strictly local and the server limited to licensing only.

Highlights

What we built

Key systems shipped end-to-end — designed for reliability, conversion, and scale.

Encrypted local vault

Passwords never go to the server — everything stays inside a local SQLite database on the user’s device.

  • Vault stored in user profile (app.getPath('userData')/data).
  • Each record encrypted with AES‑256‑GCM (IV + tag + ciphertext).
  • Offline-first: works without the network (except licensing).

Access control that holds up

PIN-derived encryption keys (scrypt) plus optional platform biometrics via WebAuthn.

  • PIN is never stored (only scrypt hash + salts/params in auth.json).
  • Anti-bruteforce throttling with state protected via safeStorage.
  • WebAuthn validation: signature checks, rpIdHash and signCount handling.

Commerce-only licensing server

SSR product site + licensing backend: checkout, renewals, key issuance, and email delivery — without ever seeing the vault data.

  • Monobank Merchant checkout with webhook processing and status polling fallback.
  • Token-based key reveal on success page (server stores only hash).
  • One-time activation via deep-link with appToken TTL.

Challenges

Technical challenges

The hard parts — and the solutions that made the system stable.

Results

Impact

Measured outcomes and operational wins.

  • Local-first by design: the server never receives passwords or vault data — only licenses.

  • End-to-end monetization: trial → checkout → email key delivery → in-app activation/renewal.

  • Secure activation: one-time tokens with TTL and deep-link redemption.

  • Multi-language SSR site with SEO basics (canonical/hreflang, OG/Twitter, sitemap).

Stack

Tech stack used

Tools and patterns used on this build.

Desktop app

  • Electron
  • React
  • TypeScript
  • TailwindCSS
  • sql.js (SQLite/WASM)

Security

  • AES‑256‑GCM
  • scrypt (PIN → key derivation)
  • safeStorage
  • WebAuthn (platform authenticator)

Web + licensing server

  • Node.js
  • Express
  • EJS (SSR)
  • i18n (ru/en/uk)
  • SEO (hreflang, JSON‑LD, sitemap)

Payments + delivery

  • Monobank Merchant
  • Webhook + polling fallback
  • Nodemailer (SMTP)
  • Deep-link lostpass://activate

Storage (no DB)

  • licenses.json + invoices.json
  • Atomic writes (tmp + rename)
  • Serialized updates queue

Metrics

Impact metrics

Trial

30days

Platforms

2Windows + Linux

Auth modes

2PIN + WebAuthn

Locales

3languages

Next

Next case study

Keep browsing the system.

Sadova Photographer — Next.js Marketing Platform

A commercial portfolio site built for lead generation: fast galleries, service landing pages, locations map, gift certificates, SEO structure, GA4 consent-mode analytics, and automated deploy.

Next case