NexGate
Self-hosted password & MFA vault
The vault that never learns your secrets.
One passphrase — set once, stored nowhere — encrypts every password and MFA seed before they reach your database. Live one-time codes, browser autofill, and a team console, on a server you run.
No trackers on this site. No third parties in the product. The demo card is a real
RFC 6238 code, computed in your browser.
How it works
Three steps between you and never retyping a password.
Deploy and sign in
Run NexGate on your own server — one Python service, one Postgres database. The first visit creates your administrator account; teammates get accounts from the console.
Set your vault passphrase
Chosen once, at your account level. It derives your encryption key and is then
forgotten — never stored, never sent to anyone, never recoverable by
an administrator. That's the point.
Save, fill, and get codes
Store each app's password and MFA seed. NexGate generates the live one-time codes, fills sign-in forms in your browser, and offers to save new logins as you go.
What you get
A password manager that works where you sign in.
Zero-knowledge vault
Your passphrase derives the key; the database holds only ciphertext. A stolen database — or a curious admin — reads nothing.
Live one-time codes
Store a TOTP seed once — scan-free, from an otpauth link or base32 secret — and read the current code with its countdown, anywhere.
Autofill where you sign in
The Chrome extension recognizes login forms and fills the right account for the site you're on — one click, correct host, no lookalikes.
Save without retyping
Sign in to a new app and NexGate offers to save it; change a password and it offers to update. Identical entries stay quiet.
Strong passwords on tap
Generate 20-character random passwords in the console, the popup, or directly inside a signup form's password field.
Built for teams
Roles, per-account lockout, rate limiting, and a security audit log. Admins manage access — and still can't read anyone's vault.
Security model
Ciphertext is all the database ever sees.
NexGate assumes the worst — a leaked backup, a compromised host — and is built so that even then, your credentials stay unreadable.
- Derivation PBKDF2-HMAC-SHA256, 600,000 iterations with a per-user random salt, turns your passphrase into the vault key.
- At rest Fernet — AES-CBC with HMAC-SHA256 authentication — seals every password and MFA seed individually.
- In memory The passphrase lives in your session's memory and nowhere else. Lock the vault — or close the browser — and it's gone.
- In transit TLS end to end, strict Content-Security-Policy (script-src 'self'), every asset self-hosted. No CDN can be poisoned into your session.
- At the door Account lockout after repeated failures, per-IP rate limits on every auth surface, and a fail2ban-ready audit log.
SELECT name, password_encrypted
FROM app_entries;
GitHub │ gAAAAABoX3enTSipythzvEzu5rq0…
Google │ gAAAAABoLW6L6FE-U1auqvhWg_kd…
# without your passphrase, that's the whole story.
Chrome extension
Your vault, on the page you're signing in to.
- Knows where you are. The popup keys off the current tab's hostname and shows the matching account — or a one-click add form.
- Fills forms in place. A small icon in the login field lists your accounts for that site; picking one fills both fields and copies the one-time code.
- Copy-only by default. Passwords are never displayed in the popup — copied, used, forgotten.
- Talks to one server: yours. No telemetry, no third-party calls — see the privacy policy.
Sign in to GitHub
NexGate — github.com
Get started
Your passwords. Your server. Your keys.
Open the console to create your vault, then add the extension to bring it into the browser.