PwdPal is a deterministic, client-side password manager. Instead of storing your passwords in a vault, it rederives each one on demand from three inputs you provide: a phrase you remember, a pattern you draw on a 3×3 grid, and the site's domain. The same inputs always produce the same password, so there's nothing to sync and nothing stored to breach, lose, or leak. The cryptography (PBKDF2-SHA256, 600,000 iterations) runs entirely in your browser via the Web Crypto API, and the web-app core is open source (MIT, github.com/sudorune/PwdPal) and unminified, so you can read and verify it. No accounts, no servers.
Password length is adjustable per site (12-64 characters, default 20), along with per-site toggles for uppercase, digits, and symbols — so a site that caps length or bans symbols still gets a working password.
It's a deliberately narrow tool: there's no recovery if you forget your inputs, it can't store passwords it didn't generate, and it has no breach monitoring, 2FA, or shared vaults — it pairs well alongside a traditional vault for your most sensitive logins. Free, with optional donations. Available as a web app (installable, works offline) and as a Chrome extension that recognizes the site and fills the password field in one click.
