⚡ About pwdflash

In a modern digital world dominated by automated password managers, our natural human memory for critical numbers and credentials often degrades. pwdflash was created as a dedicated memory training utility designed to help users memorize and practice active recall for:

• 🔑 Master Passwords & Passphrases
• 🔢 4-digit & 6-digit Credit Card PINs
• 📞 Phone Numbers & Emergency Contacts
• 🚗 Vehicle License Plates
• 🏠 Addresses & Security Codes
• 🧠 General Daily Memory Training

pwdflash divides flashcards into two distinct types:

• Regular Flashcards: Answer values are stored and verified client-side for rapid, instant feedback.
• Secret Flashcards: Values are salted with a 256-bit salt and hashed server-side using Argon2id with 64 MiB memory cost. The cleartext value is never stored or logged, and Argon2 hashes are never exposed to the client.

Rate Limiting Protection: To prevent online brute-force guessing attacks, the server actively rate limits secret card checks:

A common question is why secret values are not hashed client-side before being sent over the wire.

"The opinion of the author of this app is that hashing values client-side before sending them to the server brings little to no security benefit. For short, clearly labeled items — such as a 4-digit PIN code labeled 'Visa card ending 1234' — it is trivial for a rogue server operator or adversary to brute-force compute the hash offline even with a strong hashing algorithm. Therefore, there is really no technical solution to this problem if you do not trust the party hosting the application."

Because trust in the host is fundamental, self-hosting is strongly recommended. pwdflash was specifically engineered to make self-hosting effortless using Docker Compose, local SQLite persistent storage, and zero external runtime dependencies.