Sesame launches a Windows password vault with sync still off

Why it matters

Sesame is testing a cautious release order for security software: ship an inspectable local vault first, keep hosted sync disabled, and tell users that independent review is still pending. Its prospects depend on whether that restraint can earn trust before established rivals' broader platform support pulls users away.

Sesame Password Manager has opened a public beta for a free, open-source password vault that stores passwords, two-factor authentication codes and recovery information on the user's computer. The distributed beta targets 64-bit Windows, while the project documentation also includes Linux build support. Registration is open, and a website account is optional, according to the current product page.

A public submission was posted by d0mkaaa, but it does not provide a full name, founder title or legal entity. The project's privacy policy is public, but the available materials do not establish the operator's full identity, headquarters, country of incorporation, team size, funding round, investors or prior companies. Its funding status is undisclosed.

Sesame Password Manager is the usesesame.app product, distinct from Sesame, the personal-agent and intelligent-eyewear company. The two products have no apparent connection.

The application stays local

Sesame's desktop app is presented as a local-first vault. The product's data map says the vault file, master password or unlock secret, and imported password-manager exports remain on the user's device.

A website account covers signed downloads, licences and connected-device management, according to Sesame. The product page says the account never holds a vault, and the desktop application can operate without the project's published Go server. The account registration and download pages are public.

Migration is the first product problem

Sesame is designed for people whose credentials already sit in another password manager, browser or authenticator. The product page lists imports from 15 formats, including Bitwarden, 1Password and major browsers, with a review step before changes are saved.

The interface groups usernames, passwords, websites, TOTP codes, backup codes, recovery details, notes and document attachments under the relevant login. Sesame also lists password checks, backup and restoration, export tools, Windows Hello and PIN unlock among the beta features.

That design consolidates material frequently divided among a password manager, authenticator, downloaded backup-code file and miscellaneous notes. It also concentrates highly sensitive records in one vault, raising the cost of flaws in key handling, backups or application code. Sesame's answer is to keep the shipping vault local, publish the implementation and warn beta users to retain another copy of irreplaceable data.

The beta carries an explicit warning

The public beta notice tells users to keep a separate backup of anything they cannot afford to lose until the independent review is complete. That warning makes the current build better suited to testing and evaluation than serving as the sole copy of critical credentials.

The release page lists Sesame 0.1.1 as the current Windows build, released August 16, 2026. Its release notes include Linux build support, while the project documentation specifies 64-bit Windows 10 or later. Sync is built but not yet shipped, and the independent security review remains pending.

The release documentation also says installers carry published SHA-256 hashes, Tauri updater signatures and Sigstore evidence. The beta installers lack Authenticode signing, so Windows may display an unknown-publisher warning.

Sesame reported 147 commits across its repositories during the 30 days ending August 22, 2026. Its breakdown attributes 78 commits to the Rust-based desktop repository, 34 to the Go server, 11 to the separately published website code, and 24 to the TypeScript browser extension. All four repositories are licensed under AGPL-3.0-or-later. Sesame has disclosed no user, customer, revenue or growth figures, leaving code activity as the only public measure of traction.

The browser extension remains gated

The browser extension is packaged for Chrome, Edge and Firefox, according to the product page. It has not been submitted to those browsers' stores, and Sesame classifies it as built but not yet shipped. Users of the public beta therefore do not yet have a generally distributed browser-filling component.

Hosted Sync is also unavailable. Those omissions narrow the current distributed beta's use case to people working primarily from a 64-bit Windows computer, though developers can build the project for Linux. Anyone who routinely moves between a PC and another device would still need another product or a separate workflow.

Established rivals already cover more devices

Sesame enters a category with mature open-source and local-storage options. KeePassXC is an established password manager, while Bitwarden publishes client and server software as open source. PearPass, introduced in December 2025, also presents itself as a fully local, open-source password manager and includes peer-to-peer synchronization.

Sesame's narrower proposition is a Windows-first distributed vault whose public build excludes hosted sync, with Linux build support available in the repository. The unavailable browser extension and hosted sync leave the beta well short of the platform coverage many users already expect.

Published source code gives engineers a way to inspect Sesame's design and build the application themselves. It does not substitute for the independent review the project says is still pending. Until that work is complete, Sesame's strongest evidence is its local data model, public repositories and unusually direct beta warning.