Everything OBANO can do. Six core security systems, one unified vault. Each feature was designed for operators who refuse to compromise on privacy or control.
All account information, usernames, and passwords are encrypted with AES-256-GCM using Web Crypto API primitives, directly on your local device. No plaintext ever touches a cloud server. Even with physical access to the vault file, an attacker only finds ciphertext.
| Algorithm | AES-256-GCM (Web Crypto) |
| Key Derivation | PBKDF2-SHA256, 310,000 iterations |
| Salt | 128-bit master salt + unique 96-bit IV per record |
| Cloud Exposure | Zero |
The strike counter persists across restarts. Incorrect master passwords raise a dynamic threat counter — at 3 strikes the interface shifts to red threat state, at 5 the circuit breaker engages: hard lockout, input disabled for 60 seconds, red pulsing shell. Unlock requires the correct master verification credential.
| Threshold | 5 consecutive failures |
| Lockout | 60s hard lock, input disabled |
| Persist | Strikes + lockout survive restart |
The search engine indexes both the platform name (TikTok, Google, GitHub...) and the username simultaneously. Every keystroke streams matching records instantly with zero latency.
MULTI-PARAMETER INDEXCopied credentials are automatically purged from the system clipboard after 30 seconds. A background watchdog timer mitigates memory-sniffing and clipboard-leeching attacks.
30s AUTO-WIPEThe local audit scanner analyzes every record for vulnerabilities: passwords shorter than 12 characters, and passwords reused across multiple accounts. Findings are reported with severity and a live red warning state.
WEAK + DUPLICATE DETECTIONCSPRNG-backed token generator (crypto.getRandomValues). Length 8–64 characters, togglable A-Z / a-z / 0-9 / symbols, guaranteed at least one character of every selected set, and insertable directly into the entry form.
CRYPTO-SECURE RNGRegister with an email and your vault follows you on every machine. Only ciphertext ever leaves the device — the sync relay stores AES-256-GCM blobs, PBKDF2-derived auth verifiers, and 30-day session tokens. Conflicts resolve last-write-wins, and deletes propagate as tombstones.
| Transport | HTTPS / Cloudflare Worker + D1 |
| Server sees | Email, timestamps, ciphertext only |
| Offline mode | Vault fully usable, syncs on reconnect |
One-click encrypted backup file (ciphertext only). Forgot your master password? A 16-word recovery phrase + your backup file resets it on any machine — without ever sending the password anywhere. Change-master-password re-encrypts every record locally and rotates the account credential server-side.
16-WORD RECOVERY SEALStore your base32 2FA secrets with each entry. OBANO generates live 6-digit RFC 6238 codes (HMAC-SHA1, 30s period) with a countdown bar, auto-refreshing every second — one less app to carry.
RFC 6238Press Ctrl+Alt+O anywhere and a floating overlay appears over any app: type to search, Enter or click — OBANO fills the login and password fields for you. No master password needed: unlock the autofill with your own 6-digit PIN. Shift+click still copies the password (wipes in 30s). The session key never leaves the main window.
GLOBAL HOTKEY 6-DIGIT PIN FIELD FILLINGThe vertical system sidebar keeps every critical OBANO function one keystroke away (Ctrl+1 through Ctrl+4). Designed after professional IDE sidebars — fast, minimal, and always visible. A live status LED reflects system integrity in real time: blue breathing when secure, red pulsing under threat.
| Command | Category | Args | Description | Output |
|---|---|---|---|---|
| help | SYSTEM | — | Display all available system commands and their usage syntax. | Lists all directives with arguments |
| scan | VAULT | — | Run a vulnerability check on all local vault records. | Weakness count + reused passwords |
| search | VAULT | <query> | Instantly query the vault database by platform name or username. | Matching records: platform + username |
| generate | GENERATOR | [length] | Create a secure cryptographic token (8–64 chars) using a CSPRNG. | Token string, auto-copied (30s wipe) |
| status | SYSTEM | — | Check AES-256-GCM status, IndexedDB storage size, and strike counter. | Full system status report |
| clear | SYSTEM | — | Purge the terminal buffer. | Buffer cleared |
| lock | SYSTEM | — | Immediately seal the vault. Wipes in-memory keys and clipboard. | VAULT LOCKED — session cleared |
OBANO