Password Manager — User Guide | YoBench

What the Password Manager module does

An encrypted vault for logins, passwords, TOTP secrets and notes inside YoBench. Access requires the master password — it's used to derive the encryption key that protects every stored secret. Without it the database can't be opened.

What you get:

• Groups with hierarchy, colors and icons.
• Entries — title, username, URL, password, notes, TOTP secret, custom fields, tags.
• Password generator based on CSPRNG — character sets (upper / lower / digits / symbols), ambiguous-character exclusion, default length 20.
• TOTP / 2FA per RFC 6238 — parses otpauth:// URIs and renders the code with a countdown.
• Strength meter — a component next to the password field.
• Entry history — up to 10 snapshots per entry.
• Recycle bin — soft-delete with auto-purge after pwRecycleBinPurgeDays days.
• Import/export — KeePass XML (with XXE protection) and CSV with field mapping.

Entry parameters

• Title, Username, URL, Password (encrypted), Notes (encrypted).
• TOTP secret (encrypted).
• Group, icon, color.
• Expiry date (expiry_date) — for staleness reminders.
• Favorite, tags.
• Custom fields — field_name, field_value with an is_protected flag (when on, the value is encrypted and hidden behind a mask).

Security

• Field-level encryption — every sensitive value (password, TOTP secret, notes, attachments) is encrypted before it's written to disk. The encryption key is derived from your master password.
• Database file — encrypted at rest, so even if the file is copied off your machine it's unreadable without the master password.
• Master-password cache — kept in the OS keychain so you don't re-enter it on every action. Cleared on idle auto-lock and at OS screen-lock.
• Unlock rate limiting — exponential backoff after failed attempts.
• Reveal rate limiting — pwRevealRateLimit reveals per minute, brute-force defense.
• Clipboard auto-clear — pwClipboardClearSeconds after copying a password.

Global settings

Under Settings → Security:

• Clipboard clear (pwClipboardClearSeconds) — default 15 seconds.
• Idle auto-lock (pwAutoLockMinutes) — 15 minutes.
• Lock on screen lock (pwAutoLockOnScreenLock) — true.
• Recycle-bin TTL (pwRecycleBinPurgeDays) — 30 days.
• Default password length (pwDefaultPasswordLength) — 20.
• Character set (pwDefaultPasswordChars) — upper,lower,digits,symbols.
• Hide passwords by default (pwShowPasswordsByDefault) — false.
• History per entry (pwHistoryMaxPerEntry) — 10.
• Reveal rate limit (pwRevealRateLimit) — 30 per minute.

Workflow

1. Set the master password

You did this on the first YoBench launch (see Getting Started). The same password protects the manager.

2. Create groups

In the Groups sidebar build a structure (e.g. "Work", "Personal", "Services").

3. Add entries

Click New entry: title, username, URL, a generated password (or your own). Attach to a group.

4. Enable TOTP

If the service supports 2FA — paste an otpauth:// URI or a code. The module renders TOTP codes.

5. Use it

• Copy password — the entry clears the clipboard after 15 seconds.
• Open URL — opens in the system browser with a fill hint.
• Reveal — show the password (rate-limited).
• History — browse previous versions of the entry.

6. Import/export

In the module menu — Import KeePass XML or Import CSV with column mapping. Export does the reverse.

Next steps

• Configure all security parameters in Settings.

Help and feedback

Want browser autofill, cross-device sync, or WebAuthn / hardware keys? Contact us via the feedback form.