A password manager on your own NAS, no cloud

Want a password manager that doesn't depend on someone else's cloud? With Obskura your password database lives on your NAS, arrives there already encrypted and updates on all your computers within seconds.

Why keep your passwords on your own NAS

Online services are convenient, but your data sits on their servers and you need an account (often a paid one). Obskura has no servers of its own: it opens and saves the database directly on your NAS, with no sync software in between.

Everything is encrypted on your computer before it leaves, with AES-256 and a key derived from your password with Argon2id. The NAS only ever receives an unreadable file: anyone who gets into the NAS, administrators included, sees nothing.

What you need

• a NAS or server with SFTP (recommended), WebDAV, SMB or FTPS: Synology, QNAP, TrueNAS, Nextcloud or any Linux server;
• a NAS user with access to a folder, for example /passwords;
• Obskura, free for Windows, macOS and Linux.

On Synology, SFTP is enabled in Control Panel → File Services → FTP → SFTP; on other NAS models it is usually among the network or SSH services.

Connect the NAS

1. In Obskura open Settings → Server connections and press New connection.
2. Choose SFTP and enter the NAS address, user and password (the port only if it isn't the standard one).
3. Press Test connection: on the first connection Obskura shows the fingerprint of the NAS key, just like ssh. Accept it and press Save.

The NAS password goes into the system keychain, never into a text file.

Create the database on the NAS

1. Press New database and choose On a server… instead of "On this computer".
2. Pick the connection and the folder, and give the database a name.
3. Set a master password (a long passphrase is ideal) and, if you like, a key file. Press Create.

From now on every change is saved straight to the NAS, already encrypted.

Use it from several computers at once

On your other computers install Obskura, create the same connection and open the database with From server…. Once you enter the Obskura access key (Settings → Obskura access key) the app finds key files, backups and each device's paths by itself.

Obskura checks the file on the server every 5 seconds. When another computer saves, the changes are merged entry by entry and a notification shows what changed. If two people edit the same entry the most recent change wins, and the other one stays in the entry's history.

A backup that doesn't depend on the NAS

From the database's ⋯ menu choose Automatic backup…: on every change Obskura copies the database to a second destination, such as an external drive, keeping as many dated copies as you want. The copies stay encrypted.

Tips

• Prefer SFTP or FTPS: with plain FTP the NAS credentials travel unencrypted.
• To use the NAS away from home, don't expose SFTP to the Internet: connect through the NAS's VPN or a private network such as Tailscale or WireGuard.
• Keep the key file away from the NAS, for example on a USB stick, and keep a spare copy.

All guides