Built like it matters.
A password manager earns trust with engineering, not adjectives. Here is how Tymbor is put together, and how it was tested.
976automated tests, all passing
1,502written test cases, every one settled
26k+lines of C#, plus 7k+ of tests
4ways in, one shared core
One core, four ways in.
Everything that touches your secrets lives in one small, well-tested library. The apps, the extension and autofill are thin layers on top of it.
Windows app.NET 10 and MAUI. A roomy two-pane desktop layout.
Android app.NET 10 and MAUI, with an Android autofill service built in.
Browser extensionManifest V3 and plain JavaScript, in a closed shadow DOM.
Browser connectorA small native program the extension talks to, on your PC only.
↓
Tymbor.CoreOne shared library: cryptography, the vault, sync, import, backup and licensing. No platform code in it, so it is tested on Windows and Linux in CI.
↓
Encrypted vault on your deviceEvery item sealed before it is written to disk.
Your own cloud, optionalOnly the encrypted vault ever leaves the device.
How a secret is protected.
- Argon2id on the main keyA deliberately slow, memory-hard function turns the main key into a key-encrypting key. Guessing at scale is expensive.
- A random vault keyThe key that seals your data is random, not derived from your main key, so changing the main key re-wraps one key instead of re-encrypting everything.
- AES‑256-GCM everywhereAuthenticated encryption with a fresh nonce for every write. Tampering is detected, and a wrong main key fails the same check.
- A key per item, derived with HKDFEach item gets its own key. An item can be given an extra key of its own on top.
- A recovery sheet, not a back doorA question only you can answer plus a code unlock a separate copy of the vault key. Nothing is held by anyone else.
- Signed licence codesFree-for-life codes are Ed25519 signatures checked offline on the device. No server is involved.
Helpful in the page, blind to the web.
- No network between browser and vaultThe extension talks to a local connector over the browser's own native messaging channel. The vault never passes through a web page.
- The extension has one fixed identityThe connector answers only that identity, so another extension cannot ask it for anything.
- The page cannot read itTymbor's button and menu live in a closed shadow DOM, so the web page cannot look inside them or restyle them, and saving only reacts to real clicks and key presses from the person.
- Exact site, no guessingA login is offered only on the exact site it was saved for. No subdomain tricks, no look-alike matching.
How it was tested.
- 976 automated testsCover the cryptography, the vault, sync, import, attachments, backup and licensing. They run on every push, on Windows and on Linux.
- 1,502 written test casesWritten before they were run, across the lock screen, passwords, notes, settings, sync, the browser extension, backup and transfer. Each is either scripted or settled with a reason.
- The real apps, driven by robotsWindows is driven through its accessibility interface and Android through adb and uiautomator on an emulator, so the tests click what a person clicks.
- Accessibility, checkedEvery control on every screen was swept for a name a screen reader can read, plus keyboard, hover and window-size checks.
- Attack casesA dedicated area tries to break the app: tampered files, hostile pages, look-alike sites and bad input.
The toolbox.
C# .NET 10 MAUI Windows UI Automation Android autofill framework AES-GCM Argon2id HKDF Ed25519 Manifest V3 JavaScript GitHub Actions Inno Setup PowerShell ffmpegWhat is next
More to come.
Tymbor is in beta and still growing. An independent security review is part of what comes next. Until then, the tests above show it behaves as designed, and the design is laid out on this page.