The Roadmap.

We're building Tengen in the open. Here is exactly what we are working on next, and where the project is headed over the next year.

v1.0 — Core

Current Focus

The foundation. Everything you need, nothing you don't.

Username + master password authentication
Argon2id key derivation + AES-256-GCM encryption
Full vault CRUD (add, edit, delete, view entries)
Password generator (configurable length, symbols, digits)
Password strength meter (zxcvbn)
HaveIBeenPwned breach detection (auto + manual)
Tags, search, filtering, sorting
Copy to clipboard with 30s auto-clear
Auto-lock after 15 minutes of inactivity
Password Health dashboard (weak, pwned, reused, old)
Dark / light theme
Docker Compose — one command setup
Security headers + CSP

v1.1

Polish & Import

Making it easier to switch to Tengen and day-to-day use smoother.

Import from CSV
Import from Bitwarden export
Import from 1Password export
Encrypted vault backup / export
Favicon fetching for entry URLs
Keyboard shortcuts
Duplicate password warnings on entry cards
Password age warnings (flag entries older than 90 days)
Vault search improvements (search by username, notes)

v1.2

Security Hardening

Going deeper on the security layer.

HTTPS support with self-signed cert auto-generation
Vault unlock with biometrics (browser WebAuthn API)
Login attempt rate limiting + lockout
Audit log (track when entries were accessed/modified)
Argon2id parameter tuning via config
Optional two-factor authentication (TOTP)
Session management (view and revoke active sessions)

v2.0

Mobile

Tengen in your pocket.

React Native mobile app (Android APK first)
Connects to your self-hosted Tengen instance
Biometric unlock on mobile
Autofill support (Android)
iOS support (v2.1)

Future

Considering

Ideas being explored. No promises yet.

Browser extension (Chrome + Firefox)
Multi-user support with separate encrypted vaults
Shared vault entries (for families/small teams)
Emergency access (trusted contact can request access after a timeout)
CLI tool (`tengen get gmail`, `tengen add`, etc.)
Encrypted file attachments per entry
Self-hosted sync between multiple devices
Third-party security audit (codebase review by Cure53 or similar)