[robko]

rand() [1] is not a secure source of randomness. I strongly recommend against using that password manager since it is not secure.

[1] https://github.com/oormicreations/OormiPass/blob/d1d2bf5100f...

[_8j50]

+1 hope this comment is top. They use it for salt and password generation: https://github.com/oormicreations/OormiPass/blob/1a6f0b99613...

Also,

> The master password is not stored. An SHA256 salted hash is stored instead.

Have they heard of scrypt or argon2? And they're not using a KDF(!!!!!!) With sha256.

Dear Authors,if you ever read this,please look at: https://cryptopp.com/wiki/Key_Derivation_Function

And

https://cryptopp.com/wiki/RandomNumberGenerator

[hn_throwaway_99]

All of these top comments remind me of the general adage that encryption and security are really hard, and if you think you know what you're doing you probably don't.

I don't want to be too harsh for a ShowHN, but even if the authors fixed the several bugs that have already been reported here, it's clear they don't have a foundational enough understanding of cryptography and security to be writing a password manager. I would suggest they spend more time understanding the basics first.