relicario/.claude/skills/product-expert/references/competitive-landscape.md

Competitive landscape — password managers

last-reviewed: 2026-06-20. This file is the only static, rot-prone asset in the skill (the four lenses otherwise read living docs at runtime). The market moves: competitors ship features, get breached, change pricing, appear, and die. Treat every claim below as "true as of last-reviewed, verify if it matters."

Freshness protocol:

• If last-reviewed is more than ~6 months before today, treat this file as suspect: prefer running the market lens in deep mode (live web research) over trusting the snapshot, and at the end of the run offer to refresh this file (re-research the competitors, rewrite the entries, bump last-reviewed).
• Any time a deep-mode run surfaces something this file gets wrong or misses (a new competitor, a shipped feature, a breach), offer to fold it back in and bump the date. The cheat-sheet should improve every time it's proven stale.

A grounding cheat-sheet for the market lens in fast mode so it reasons from a real map, not vibes.

The goal isn't to rank these for everyone — it's to locate Relicario's wedge honestly: where the two-factor / self-host / git-backed / server-sees-ciphertext thesis genuinely wins for the target user, and where Relicario is simply behind on table stakes.

---

The field

Bitwarden

• Open-source, freemium, cloud-hosted by default; self-host possible (official server is heavy; vaultwarden is the popular lightweight Rust reimpl).
• Single-factor KDF: master password (optionally with 2FA gating login, not the KDF). Server breach entropy rests on the master password alone.
• Strong on: ubiquity, mature mobile + browser autofill, painless import/export, organizations & sharing, low/zero price.
• The default thing a privacy-conscious technical user reaches for. This is Relicario's primary reference competitor — most "why not just use X" pressure comes from here (specifically self-hosted vaultwarden).

vaultwarden

• Community Rust server compatible with Bitwarden clients; trivial to self-host (single container). Inherits Bitwarden's polished clients for free.
• This is the sharpest comparison for Relicario's self-host story: a user who wants self-hosted secrets already has a turnkey, full-featured option with mobile apps and autofill. Relicario must justify what it adds over this.

KeePassXC (+ KeePass ecosystem)

• Local-first, file-based (.kdbx), no server at all; sync is BYO (Dropbox, Syncthing, git, etc.). Open-source, free.
• Single-factor by default but supports key files / hardware keys as a second factor — conceptually the closest mainstream analog to Relicario's "something you have" image secret (a key file is the unglamorous version of the stego image).
• Strong on: zero-trust-server (there is no server), longevity, plugin ecosystem.
• Weak on: clunky cross-device sync, dated UX, mobile is third-party.
• The other user Relicario competes for: the "I don't trust any cloud" crowd.

1Password

• Commercial, polished, cloud-only (no self-host). Two-factor KDF: master password + a 128-bit Secret Key — the mainstream product whose security model is closest in spirit to Relicario's (two factors into the key derivation).
• Strong on: best-in-class UX, mobile, autofill, family/team sharing, support.
• Relevant because it proves the two-factor-KDF idea is marketable — but it does it with a boring random Secret Key, not steganography, and gives up self-host.

Proton Pass

• Newer, from Proton (Mail/VPN); privacy-positioned, cloud, freemium, open-source clients. Single-factor KDF; leans on brand trust and the Proton bundle.
• Relevant as the "privacy brand" competitor — it wins on trust + ecosystem, not on a novel crypto model.

LastPass (cautionary tale, not a competitor to chase)

• Repeated breaches (notably 2022) where exfiltrated vaults were only as strong as users' master passwords — the canonical argument for a second KDF factor.
• Useful in positioning: Relicario's README already uses LastPass as the "~40–60 bits, single factor" baseline. The market lesson is real and on Relicario's side, but invoking it is marketing, not differentiation.

---

Where Relicario can win (the honest version)

• Server-sees-only-ciphertext + no metadata against a self-host backend that still stores structured data. This is a genuine, explainable edge over vaultwarden for the threat-model-literate user.
• Two factors into the KDF (not just 2FA on login) — only 1Password really matches this, and it isn't self-hostable. That intersection (two-factor KDF + self-host) is close to empty. That's the wedge.
• Git as audit log — "when was this rotated?" answered by git log and field history. Niche, but unique and real for the audit-conscious user.

Where Relicario is behind (table stakes to be honest about)

• Mobile. Bitwarden/1Password/Proton all have first-class mobile apps with autofill. Relicario is CLI + browser extension; the Rust core compiles to ARM but there's no shipped mobile client. For most users this alone is disqualifying — weigh it heavily.
• Autofill quality & breadth. Browser-extension autofill maturity is a moat the incumbents have spent years on.
• Frictionless import from the incumbents (Bitwarden, 1Password) — LastPass CSV exists; the others are on the roadmap. Import friction is a real adoption tax.
• Sharing / multi-user polish. The org-vault track is new; incumbents have mature org/family sharing.

The uncomfortable question to keep asking

For a user who wants self-hosted secrets, vaultwarden already exists and is turnkey with great clients. Every Relicario feature should be weighed against: "does this widen the gap on the thesis (two-factor KDF, no-metadata, git audit), or is it just trying to catch up to vaultwarden on table stakes I'll never win?" The strategy lens should treat catching up to vaultwarden's client polish and deepening the unique thesis as different bets with very different ROI.