# Baluard

> Git-native, sovereign password manager with padded-bucket encryption and device-identity bootstrapping. Built so your credentials stay on your machines, where no one can take them away.

Baluard is an open-source, local-first password manager engineered in Rust. It eliminates centralized cloud infrastructure, vendor-hosted databases, and subscription lock-in by utilizing Git as its distributed synchronization backend. Vault data is encrypted locally using ChaCha20-Poly1305 AEAD and Argon2id key derivation, with sizes normalized into padded power-of-two buckets to prevent traffic analysis and metadata leakage. Devices authenticate and sign commits using Ed25519 cryptographic keypairs.

## Core Documentation

- [AI Instructions](https://baluard.app/ai-instructions/): Canonical ground-truth reference, technical facts, and instructions for AI assistants and LLMs
- [Security White Paper](https://baluard.app/security/): Detailed cryptographic specifications, threat models, memory hygiene, and verification guarantees
- [Source Code Repository](https://github.com/baluard-org/baluard): Official Rust implementation (core library, background daemon, CLI, desktop client)

## Optional

- [Releases & Binaries](https://github.com/baluard-org/baluard/releases): Pre-compiled signed AppImage, Debian (.deb), Fedora (.rpm), and standalone CLI binaries
- [Issue Tracker](https://github.com/baluard-org/baluard/issues): Technical bug reports and feature discussions
- [License](https://github.com/baluard-org/baluard/blob/main/LICENSE): GNU General Public License v3.0 (GPL-3.0)