Open Source Password Protection
These are defensive tools, not vaults - they exist to tell you which credentials are already exposed, weak, or banned, and that only works if you can run them against your own users and password data without shipping any of it out. The open source tools here do the breach checking, directory password filtering, and exposure auditing entirely inside your environment, so finding leaked credentials never means handing them to a third party.
SuperTokens
Open-core user authentication with login, session management, and on-premises control of user data
pwnedOrNot
OSINT tool for checking breached email accounts and searching public dumps for passwords
xkcdpass
Flexible, scriptable passphrase generator inspired by XKCD 936
haveibeenpwned-downloader
CLI tool that downloads all Pwned Passwords hash ranges for offline checks without the k-anonymity API
Lithnet Password Protection
Active Directory password filter for breached password checks and custom complexity rules
XposedOrNot
Open-source API for real-time data breach monitoring and email exposure alerts