Sesame

What Sesame handles, and what it does not.

The desktop application is the only Sesame product that handles vault contents. The website and API publish product information and release metadata.

On this page Product boundary Local vault Website and API Open source Current limitations

The vault stays with the desktop app.

Vault creation, unlocking, encryption, import, TOTP generation, password checks, backups, restore, export, and deletion run locally. Opening a local vault does not depend on a Sesame account or service.

Data kept on your device

Vault content is encrypted and authenticated with XChaCha20-Poly1305. Argon2id derives the wrapping key from your master password, from a separately generated recovery kit, and, if you enable it, from a PIN combined with a random value stored under Windows DPAPI. Each of these unlock methods wraps the same vault key independently, so the vault file itself holds only ciphertext, never a password or a recovery kit. Windows Hello, when you turn it on, adds a further wrap: the vault key is sealed to a device key held in the Windows Passport key store, which releases it only after a fresh Hello gesture. Sesame sees that gesture succeed or fail and never receives biometric data.

  • Vault contents, encrypted vault files, and document attachments
  • Master passwords, derived keys, and recovery material
  • Imported password-manager and browser exports, in 15 supported formats
  • TOTP seeds, backup codes, and recovery notes

Data handled by the website and API

The service publishes product information and release metadata. It also holds a separate website account: an email address, a password hash, and a revocable session. It has no vault endpoint and will not accept vault fields, imports, or vault credentials.

A future Sync service may retain encrypted opaque records and limited routing metadata. It is not enabled in this beta. The browser extension is built and packaged for Chrome and Edge but is not published in either store, and it needs the signed native host that ships with a desktop installer. Filling a form requires a user action in the extension and an approval from the unlocked desktop app; the extension stores no credential and never submits the page.

You do not have to take our word for this

Every claim on this page describes code you can read. Sesame is published under the GNU Affero General Public License v3.0 or later: the Windows app and the Rust vault core, the vault-blind API, the account and administration portals, this website, and the browser extension. The encryption and key handling described above live in the vault core, so the design and the shipped behaviour can be compared rather than trusted.

The browser extension's store archives are reproducible. The same commit and Node version produce the same SHA-256 digests, and those digests are published beside the packages, so an upload can be checked against the source it claims to come from.

The AGPL also binds a hosted deployment: anyone who runs a modified Sesame service has to offer its corresponding source. The Sesame name and artwork are handled separately by the trademark policy, which is what stops a modified build from presenting itself as official.

Current limitations

Sesame has not completed an independent security review. Website accounts are for invited beta access and release management; they do not store vault data. Public artifacts, automatic updates, the browser helper, and Sync remain unavailable.