From 2d39d7a5bda4566f1668ef8c88f47f63ebbf7de4 Mon Sep 17 00:00:00 2001
From: thePR0M3TH3AN <53631862+PR0M3TH3AN@users.noreply.github.com>
Date: Mon, 28 Jul 2025 13:31:15 -0400
Subject: [PATCH 01/33] feat(stats): refresh triggers background sync

---
 src/main.py                    | 18 +++++++++++++++++-
 src/tests/test_stats_screen.py | 23 ++++++++++++++++++++++-
 2 files changed, 39 insertions(+), 2 deletions(-)

diff --git a/src/main.py b/src/main.py
index 3dea1f7..1fa2482 100644
--- a/src/main.py
+++ b/src/main.py
@@ -275,12 +275,23 @@ def handle_display_npub(password_manager: PasswordManager):
 def _display_live_stats(
     password_manager: PasswordManager, interval: float = 1.0
 ) -> None:
-    """Continuously refresh stats until the user presses Enter."""
+    """Continuously refresh stats until the user presses Enter.
+
+    Each refresh also triggers a background sync so the latest stats are
+    displayed if newer data exists on Nostr.
+    """
 
     display_fn = getattr(password_manager, "display_stats", None)
+    sync_fn = getattr(password_manager, "start_background_sync", None)
     if not callable(display_fn):
         return
 
+    if callable(sync_fn):
+        try:
+            sync_fn()
+        except Exception as exc:  # pragma: no cover - sync best effort
+            logging.debug("Background sync failed during stats display: %s", exc)
+
     if not sys.stdin or not sys.stdin.isatty():
         clear_screen()
         display_fn()
@@ -292,6 +303,11 @@ def _display_live_stats(
         return
 
     while True:
+        if callable(sync_fn):
+            try:
+                sync_fn()
+            except Exception:  # pragma: no cover - sync best effort
+                logging.debug("Background sync failed during stats display")
         clear_screen()
         display_fn()
         note = get_notification_text(password_manager)
diff --git a/src/tests/test_stats_screen.py b/src/tests/test_stats_screen.py
index f65d72d..182c7b9 100644
--- a/src/tests/test_stats_screen.py
+++ b/src/tests/test_stats_screen.py
@@ -9,7 +9,10 @@ import main
 
 
 def _make_pm():
-    return SimpleNamespace(display_stats=lambda: print("stats"))
+    return SimpleNamespace(
+        display_stats=lambda: print("stats"),
+        start_background_sync=lambda: None,
+    )
 
 
 def test_live_stats_shows_message(monkeypatch, capsys):
@@ -36,3 +39,21 @@ def test_live_stats_shows_notification(monkeypatch, capsys):
     main._display_live_stats(pm)
     out = capsys.readouterr().out
     assert "note" in out
+
+
+def test_live_stats_triggers_background_sync(monkeypatch):
+    called = {"sync": 0}
+
+    pm = _make_pm()
+    pm.start_background_sync = lambda: called.__setitem__("sync", called["sync"] + 1)
+
+    monkeypatch.setattr(main, "get_notification_text", lambda *_: "")
+    monkeypatch.setattr(
+        main,
+        "timed_input",
+        lambda *_: (_ for _ in ()).throw(KeyboardInterrupt()),
+    )
+
+    main._display_live_stats(pm)
+
+    assert called["sync"] >= 1

From a3d45a117c2f5cb389f647c31bb37630fa1d7dcf Mon Sep 17 00:00:00 2001
From: thePR0M3TH3AN <53631862+PR0M3TH3AN@users.noreply.github.com>
Date: Mon, 28 Jul 2025 13:55:55 -0400
Subject: [PATCH 02/33] Fix relay URL handling for nostr-sdk 0.43

---
 src/nostr/client.py            | 19 ++++++++++++++++---
 src/tests/test_nostr_client.py |  4 ++--
 2 files changed, 18 insertions(+), 5 deletions(-)

diff --git a/src/nostr/client.py b/src/nostr/client.py
index 0155617..76fdb00 100644
--- a/src/nostr/client.py
+++ b/src/nostr/client.py
@@ -21,6 +21,7 @@ from nostr_sdk import (
     Kind,
     KindStandard,
     Tag,
+    RelayUrl,
 )
 from datetime import timedelta
 from nostr_sdk import EventId, Timestamp
@@ -173,14 +174,26 @@ class NostrClient:
     async def _initialize_client_pool(self) -> None:
         if self.offline_mode or not self.relays:
             return
+
+        formatted = []
+        for relay in self.relays:
+            if isinstance(relay, str):
+                try:
+                    formatted.append(RelayUrl.parse(relay))
+                except Exception:
+                    logger.error("Invalid relay URL: %s", relay)
+            else:
+                formatted.append(relay)
+
         if hasattr(self.client, "add_relays"):
-            await self.client.add_relays(self.relays)
+            await self.client.add_relays(formatted)
         else:
-            for relay in self.relays:
+            for relay in formatted:
                 await self.client.add_relay(relay)
+
         await self.client.connect()
         self._connected = True
-        logger.info(f"NostrClient connected to relays: {self.relays}")
+        logger.info("NostrClient connected to relays: %s", formatted)
 
     async def _ping_relay(self, relay: str, timeout: float) -> bool:
         """Attempt to retrieve the latest event from a single relay."""
diff --git a/src/tests/test_nostr_client.py b/src/tests/test_nostr_client.py
index 1aa998f..0fc5a61 100644
--- a/src/tests/test_nostr_client.py
+++ b/src/tests/test_nostr_client.py
@@ -91,7 +91,7 @@ def test_initialize_client_pool_add_relays_used(tmp_path):
     client = _setup_client(tmp_path, FakeAddRelaysClient)
     fc = client.client
     client.connect()
-    assert fc.added == [client.relays]
+    assert [[str(r) for r in relays] for relays in fc.added] == [client.relays]
     assert fc.connected is True
 
 
@@ -99,7 +99,7 @@ def test_initialize_client_pool_add_relay_fallback(tmp_path):
     client = _setup_client(tmp_path, FakeAddRelayClient)
     fc = client.client
     client.connect()
-    assert fc.added == client.relays
+    assert [str(r) for r in fc.added] == client.relays
     assert fc.connected is True
 
 

From 4a20817094e3d5939f45ff9ac3999c368aef3c56 Mon Sep 17 00:00:00 2001
From: thePR0M3TH3AN <53631862+PR0M3TH3AN@users.noreply.github.com>
Date: Mon, 28 Jul 2025 15:04:56 -0400
Subject: [PATCH 03/33] Add key field to key/value entries

---
 README.md                                     |  2 +-
 .../01-getting-started/01-advanced_cli.md     |  4 ++--
 .../01-getting-started/03-json_entries.md     |  1 +
 docs/docs/content/index.md                    |  2 +-
 src/seedpass/api.py                           |  1 +
 src/seedpass/cli.py                           |  3 ++-
 src/seedpass/core/api.py                      |  8 ++++++--
 src/seedpass/core/entry_management.py         |  9 +++++++++
 src/seedpass/core/manager.py                  | 12 ++++++++++-
 src/seedpass_gui/app.py                       | 11 ++++++++--
 src/tests/test_cli_doc_examples.py            |  2 +-
 src/tests/test_cli_entry_add_commands.py      |  4 ++--
 src/tests/test_entry_add.py                   |  4 ++--
 src/tests/test_gui_headless.py                | 20 +++++++++++--------
 src/tests/test_key_value_entry.py             |  8 +++++---
 src/tests/test_manager_list_entries.py        | 10 +++++-----
 src/tests/test_search_entries.py              |  2 +-
 17 files changed, 71 insertions(+), 32 deletions(-)

diff --git a/README.md b/README.md
index 902914e..7ce92b9 100644
--- a/README.md
+++ b/README.md
@@ -458,7 +458,7 @@ The table below summarizes the extra fields stored for each entry type. Every en
 | Seed Phrase     | `index`, `word_count` *(mnemonic regenerated; never stored)*, `archived`, optional `notes`, optional `tags`                                            |
 | PGP Key         | `index`, `key_type`, `archived`, optional `user_id`, optional `notes`, optional `tags`                                                                 |
 | Nostr Key Pair  | `index`, `archived`, optional `notes`, optional `tags`                                                                                                |
-| Key/Value       | `value`, `archived`, optional `notes`, optional `custom_fields`, optional `tags`                                                                       |
+| Key/Value       | `key`, `value`, `archived`, optional `notes`, optional `custom_fields`, optional `tags`                                                                       |
 | Managed Account | `index`, `word_count`, `fingerprint`, `archived`, optional `notes`, optional `tags`                                                                   |
 
 ### Managing Multiple Seeds
diff --git a/docs/docs/content/01-getting-started/01-advanced_cli.md b/docs/docs/content/01-getting-started/01-advanced_cli.md
index 3c86dcc..92d41aa 100644
--- a/docs/docs/content/01-getting-started/01-advanced_cli.md
+++ b/docs/docs/content/01-getting-started/01-advanced_cli.md
@@ -55,7 +55,7 @@ Manage individual entries within a vault.
 | Add a PGP key entry | `entry add-pgp` | `seedpass entry add-pgp Personal --user-id me@example.com` |
 | Add a Nostr key entry | `entry add-nostr` | `seedpass entry add-nostr Chat` |
 | Add a seed phrase entry | `entry add-seed` | `seedpass entry add-seed Backup --words 24` |
-| Add a key/value entry | `entry add-key-value` | `seedpass entry add-key-value "API Token" --value abc123` |
+| Add a key/value entry | `entry add-key-value` | `seedpass entry add-key-value "API Token" --key api --value abc123` |
 | Add a managed account entry | `entry add-managed-account` | `seedpass entry add-managed-account Trading` |
 | Modify an entry | `entry modify` | `seedpass entry modify 1 --username alice` |
 | Archive an entry | `entry archive` | `seedpass entry archive 1` |
@@ -144,7 +144,7 @@ Run or stop the local HTTP API.
 - **`seedpass entry add-pgp <label>`** – Create a PGP key entry. Provide `--user-id` and `--key-type` as needed.
 - **`seedpass entry add-nostr <label>`** – Create a Nostr key entry for decentralised chat.
 - **`seedpass entry add-seed <label>`** – Store a derived seed phrase. Use `--words` to set the word count.
-- **`seedpass entry add-key-value <label>`** – Store arbitrary data with `--value`.
+ - **`seedpass entry add-key-value <label>`** – Store arbitrary data with `--key` and `--value`.
 - **`seedpass entry add-managed-account <label>`** – Store a BIP‑85 derived account seed.
 - **`seedpass entry modify <id>`** – Update an entry's label, username, URL or notes.
 - **`seedpass entry archive <id>`** – Mark an entry as archived so it is hidden from normal lists.
diff --git a/docs/docs/content/01-getting-started/03-json_entries.md b/docs/docs/content/01-getting-started/03-json_entries.md
index e25673e..3551932 100644
--- a/docs/docs/content/01-getting-started/03-json_entries.md
+++ b/docs/docs/content/01-getting-started/03-json_entries.md
@@ -95,6 +95,7 @@ Each entry is stored within `seedpass_entries_db.json.enc` under the `entries` d
 - **custom_fields** (`array`, optional): Additional user-defined fields.
 - **origin** (`string`, optional): Source identifier for imported data.
 - **value** (`string`, optional): For `key_value` entries, stores the secret value.
+- **key** (`string`, optional): Name of the key for `key_value` entries.
 - **index** (`integer`, optional): BIP-85 derivation index for entries that derive material from a seed.
 - **word_count** (`integer`, managed_account only): Number of words in the child seed. Managed accounts always use `12`.
 - **fingerprint** (`string`, managed_account only): Identifier of the child profile, used for its directory name.
diff --git a/docs/docs/content/index.md b/docs/docs/content/index.md
index d272206..00b2aba 100644
--- a/docs/docs/content/index.md
+++ b/docs/docs/content/index.md
@@ -363,7 +363,7 @@ entry includes a `label`, while only password entries track a `url`.
 | Seed Phrase   | `index`, `word_count` *(mnemonic regenerated; never stored)*, `archived`, optional `notes`, optional `tags` |
 | PGP Key       | `index`, `key_type`, `archived`, optional `user_id`, optional `notes`, optional `tags` |
 | Nostr Key Pair| `index`, `archived`, optional `notes`, optional `tags` |
-| Key/Value     | `value`, `archived`, optional `notes`, optional `custom_fields`, optional `tags` |
+| Key/Value     | `key`, `value`, `archived`, optional `notes`, optional `custom_fields`, optional `tags` |
 | Managed Account | `index`, `word_count`, `fingerprint`, `archived`, optional `notes`, optional `tags` |
 
 
diff --git a/src/seedpass/api.py b/src/seedpass/api.py
index 134575a..e848241 100644
--- a/src/seedpass/api.py
+++ b/src/seedpass/api.py
@@ -173,6 +173,7 @@ def create_entry(
     if etype == "key_value":
         index = _pm.entry_manager.add_key_value(
             entry.get("label"),
+            entry.get("key"),
             entry.get("value"),
             notes=entry.get("notes", ""),
         )
diff --git a/src/seedpass/cli.py b/src/seedpass/cli.py
index 7cc3b20..b746729 100644
--- a/src/seedpass/cli.py
+++ b/src/seedpass/cli.py
@@ -315,12 +315,13 @@ def entry_add_seed(
 def entry_add_key_value(
     ctx: typer.Context,
     label: str,
+    key: str = typer.Option(..., "--key", help="Key name"),
     value: str = typer.Option(..., "--value", help="Stored value"),
     notes: str = typer.Option("", "--notes", help="Entry notes"),
 ) -> None:
     """Add a key/value entry and output its index."""
     service = _get_entry_service(ctx)
-    idx = service.add_key_value(label, value, notes=notes)
+    idx = service.add_key_value(label, key, value, notes=notes)
     typer.echo(str(idx))
 
 
diff --git a/src/seedpass/core/api.py b/src/seedpass/core/api.py
index 03e8d99..d43ccc3 100644
--- a/src/seedpass/core/api.py
+++ b/src/seedpass/core/api.py
@@ -379,9 +379,13 @@ class EntryService:
             self._manager.start_background_vault_sync()
             return idx
 
-    def add_key_value(self, label: str, value: str, *, notes: str = "") -> int:
+    def add_key_value(
+        self, label: str, key: str, value: str, *, notes: str = ""
+    ) -> int:
         with self._lock:
-            idx = self._manager.entry_manager.add_key_value(label, value, notes=notes)
+            idx = self._manager.entry_manager.add_key_value(
+                label, key, value, notes=notes
+            )
             self._manager.start_background_vault_sync()
             return idx
 
diff --git a/src/seedpass/core/entry_management.py b/src/seedpass/core/entry_management.py
index 260fe17..bbac6a4 100644
--- a/src/seedpass/core/entry_management.py
+++ b/src/seedpass/core/entry_management.py
@@ -412,6 +412,7 @@ class EntryManager:
     def add_key_value(
         self,
         label: str,
+        key: str,
         value: str,
         *,
         notes: str = "",
@@ -429,6 +430,7 @@ class EntryManager:
             "type": EntryType.KEY_VALUE.value,
             "kind": EntryType.KEY_VALUE.value,
             "label": label,
+            "key": key,
             "modified_ts": int(time.time()),
             "value": value,
             "notes": notes,
@@ -720,6 +722,7 @@ class EntryManager:
         label: Optional[str] = None,
         period: Optional[int] = None,
         digits: Optional[int] = None,
+        key: Optional[str] = None,
         value: Optional[str] = None,
         custom_fields: List[Dict[str, Any]] | None = None,
         tags: list[str] | None = None,
@@ -736,6 +739,7 @@ class EntryManager:
         :param label: (Optional) The new label for the entry.
         :param period: (Optional) The new TOTP period in seconds.
         :param digits: (Optional) The new number of digits for TOTP codes.
+        :param key: (Optional) New key for key/value entries.
         :param value: (Optional) New value for key/value entries.
         """
         try:
@@ -764,6 +768,7 @@ class EntryManager:
                 "label": label,
                 "period": period,
                 "digits": digits,
+                "key": key,
                 "value": value,
                 "custom_fields": custom_fields,
                 "tags": tags,
@@ -790,6 +795,7 @@ class EntryManager:
                 },
                 EntryType.KEY_VALUE.value: {
                     "label",
+                    "key",
                     "value",
                     "archived",
                     "notes",
@@ -870,6 +876,9 @@ class EntryManager:
                     EntryType.KEY_VALUE.value,
                     EntryType.MANAGED_ACCOUNT.value,
                 ):
+                    if key is not None and entry_type == EntryType.KEY_VALUE.value:
+                        entry["key"] = key
+                        logger.debug(f"Updated key for index {index}.")
                     if value is not None:
                         entry["value"] = value
                         logger.debug(f"Updated value for index {index}.")
diff --git a/src/seedpass/core/manager.py b/src/seedpass/core/manager.py
index 0af2fb8..b44ff4e 100644
--- a/src/seedpass/core/manager.py
+++ b/src/seedpass/core/manager.py
@@ -1888,6 +1888,10 @@ class PasswordManager:
             if not label:
                 print(colored("Error: Label cannot be empty.", "red"))
                 return
+            key_field = input("Key: ").strip()
+            if not key_field:
+                print(colored("Error: Key cannot be empty.", "red"))
+                return
             value = input("Value: ").strip()
             notes = input("Notes (optional): ").strip()
             tags_input = input("Enter tags (comma-separated, optional): ").strip()
@@ -1915,6 +1919,7 @@ class PasswordManager:
 
             index = self.entry_manager.add_key_value(
                 label,
+                key_field,
                 value,
                 notes=notes,
                 custom_fields=custom_fields,
@@ -2886,6 +2891,9 @@ class PasswordManager:
                     input(f'Enter new label (leave blank to keep "{label}"): ').strip()
                     or label
                 )
+                new_key = input(
+                    f'Enter new key (leave blank to keep "{entry.get("key", "")}"): '
+                ).strip() or entry.get("key", "")
                 new_value = (
                     input("Enter new value (leave blank to keep current): ").strip()
                     or value
@@ -2947,6 +2955,7 @@ class PasswordManager:
                     archived=new_blacklisted,
                     notes=new_notes,
                     label=new_label,
+                    key=new_key,
                     value=new_value,
                     custom_fields=custom_fields,
                     tags=tags,
@@ -3237,7 +3246,8 @@ class PasswordManager:
                 print(color_text(f"  Tags: {', '.join(tags)}", "index"))
         elif etype == EntryType.KEY_VALUE.value:
             print(color_text("  Type: Key/Value", "index"))
-            print(color_text(f"  Label (key): {entry.get('label', '')}", "index"))
+            print(color_text(f"  Label: {entry.get('label', '')}", "index"))
+            print(color_text(f"  Key: {entry.get('key', '')}", "index"))
             print(color_text(f"  Value: {entry.get('value', '')}", "index"))
             notes = entry.get("notes", "")
             if notes:
diff --git a/src/seedpass_gui/app.py b/src/seedpass_gui/app.py
index b3041f5..d0894ab 100644
--- a/src/seedpass_gui/app.py
+++ b/src/seedpass_gui/app.py
@@ -217,6 +217,7 @@ class EntryDialog(toga.Window):
         self.length_input = toga.NumberInput(
             min=8, max=128, style=Pack(width=80), value=16
         )
+        self.key_input = toga.TextInput(style=Pack(flex=1))
         self.value_input = toga.TextInput(style=Pack(flex=1))
 
         save_button = toga.Button(
@@ -234,6 +235,8 @@ class EntryDialog(toga.Window):
         box.add(self.url_input)
         box.add(toga.Label("Length"))
         box.add(self.length_input)
+        box.add(toga.Label("Key"))
+        box.add(self.key_input)
         box.add(toga.Label("Value"))
         box.add(self.value_input)
         box.add(save_button)
@@ -249,6 +252,7 @@ class EntryDialog(toga.Window):
                 self.username_input.value = entry.get("username", "") or ""
                 self.url_input.value = entry.get("url", "") or ""
                 self.length_input.value = entry.get("length", 16)
+                self.key_input.value = entry.get("key", "")
                 self.value_input.value = entry.get("value", "")
 
     def save(self, widget: toga.Widget) -> None:
@@ -257,6 +261,7 @@ class EntryDialog(toga.Window):
         url = self.url_input.value or None
         length = int(self.length_input.value or 16)
         kind = self.kind_input.value
+        key = self.key_input.value or None
         value = self.value_input.value or None
 
         if self.entry_id is None:
@@ -275,7 +280,9 @@ class EntryDialog(toga.Window):
             elif kind == EntryType.NOSTR.value:
                 entry_id = self.main.entries.add_nostr_key(label)
             elif kind == EntryType.KEY_VALUE.value:
-                entry_id = self.main.entries.add_key_value(label, value or "")
+                entry_id = self.main.entries.add_key_value(
+                    label, key or "", value or ""
+                )
             elif kind == EntryType.MANAGED_ACCOUNT.value:
                 entry_id = self.main.entries.add_managed_account(label)
         else:
@@ -284,7 +291,7 @@ class EntryDialog(toga.Window):
             if kind == EntryType.PASSWORD.value:
                 kwargs.update({"username": username, "url": url})
             elif kind == EntryType.KEY_VALUE.value:
-                kwargs.update({"value": value})
+                kwargs.update({"key": key, "value": value})
             self.main.entries.modify_entry(entry_id, **kwargs)
 
         entry = self.main.entries.retrieve_entry(entry_id) or {}
diff --git a/src/tests/test_cli_doc_examples.py b/src/tests/test_cli_doc_examples.py
index ac5ebb1..63b6794 100644
--- a/src/tests/test_cli_doc_examples.py
+++ b/src/tests/test_cli_doc_examples.py
@@ -26,7 +26,7 @@ class DummyPM:
             add_pgp_key=lambda label, seed, index=None, key_type="ed25519", user_id="", notes="": 3,
             add_nostr_key=lambda label, index=None, notes="": 4,
             add_seed=lambda label, seed, index=None, words_num=24, notes="": 5,
-            add_key_value=lambda label, value, notes="": 6,
+            add_key_value=lambda label, key, value, notes="": 6,
             add_managed_account=lambda label, seed, index=None, notes="": 7,
             modify_entry=lambda *a, **kw: None,
             archive_entry=lambda i: None,
diff --git a/src/tests/test_cli_entry_add_commands.py b/src/tests/test_cli_entry_add_commands.py
index dd482b3..53d2345 100644
--- a/src/tests/test_cli_entry_add_commands.py
+++ b/src/tests/test_cli_entry_add_commands.py
@@ -90,8 +90,8 @@ runner = CliRunner()
         (
             "add-key-value",
             "add_key_value",
-            ["Label", "--value", "val", "--notes", "note"],
-            ("Label", "val"),
+            ["Label", "--key", "k1", "--value", "val", "--notes", "note"],
+            ("Label", "k1", "val"),
             {"notes": "note"},
             "7",
         ),
diff --git a/src/tests/test_entry_add.py b/src/tests/test_entry_add.py
index c7a966a..6ea223c 100644
--- a/src/tests/test_entry_add.py
+++ b/src/tests/test_entry_add.py
@@ -73,7 +73,7 @@ def test_round_trip_entry_types(method, expected_type):
             entry_mgr.add_totp("example", TEST_SEED)
             index = 0
         elif method == "add_key_value":
-            index = entry_mgr.add_key_value("label", "val")
+            index = entry_mgr.add_key_value("label", "k1", "val")
         else:
             if method == "add_ssh_key":
                 index = entry_mgr.add_ssh_key("ssh", TEST_SEED)
@@ -118,7 +118,7 @@ def test_legacy_entry_defaults_to_password():
         ("add_pgp_key", ("pgp", TEST_SEED)),
         ("add_nostr_key", ("nostr",)),
         ("add_seed", ("seed", TEST_SEED)),
-        ("add_key_value", ("label", "val")),
+        ("add_key_value", ("label", "k1", "val")),
         ("add_managed_account", ("acct", TEST_SEED)),
     ],
 )
diff --git a/src/tests/test_gui_headless.py b/src/tests/test_gui_headless.py
index dc895a8..635148a 100644
--- a/src/tests/test_gui_headless.py
+++ b/src/tests/test_gui_headless.py
@@ -53,16 +53,18 @@ class FakeEntries:
         self.added.append(("nostr", label))
         return 1
 
-    def add_key_value(self, label, value):
-        self.added.append(("key_value", label, value))
+    def add_key_value(self, label, key, value):
+        self.added.append(("key_value", label, key, value))
         return 1
 
     def add_managed_account(self, label):
         self.added.append(("managed_account", label))
         return 1
 
-    def modify_entry(self, entry_id, username=None, url=None, label=None, value=None):
-        self.modified.append((entry_id, username, url, label, value))
+    def modify_entry(
+        self, entry_id, username=None, url=None, label=None, key=None, value=None
+    ):
+        self.modified.append((entry_id, username, url, label, key, value))
 
 
 def setup_module(module):
@@ -106,7 +108,7 @@ def test_unlock_creates_main_window():
         (EntryType.SEED.value, ("seed", "L")),
         (EntryType.PGP.value, ("pgp", "L")),
         (EntryType.NOSTR.value, ("nostr", "L")),
-        (EntryType.KEY_VALUE.value, ("key_value", "L", "val")),
+        (EntryType.KEY_VALUE.value, ("key_value", "L", "k1", "val")),
         (EntryType.MANAGED_ACCOUNT.value, ("managed_account", "L")),
     ],
 )
@@ -123,6 +125,7 @@ def test_entrydialog_add_calls_service(kind, expect):
     dlg.username_input.value = "u"
     dlg.url_input.value = "x"
     dlg.length_input.value = 12
+    dlg.key_input.value = "k1"
     dlg.value_input.value = "val"
     dlg.save(None)
 
@@ -136,9 +139,9 @@ def test_entrydialog_add_calls_service(kind, expect):
 @pytest.mark.parametrize(
     "kind,expected",
     [
-        (EntryType.PASSWORD.value, (1, "newu", "newx", "New", None)),
-        (EntryType.KEY_VALUE.value, (1, None, None, "New", "val2")),
-        (EntryType.TOTP.value, (1, None, None, "New", None)),
+        (EntryType.PASSWORD.value, (1, "newu", "newx", "New", None, None)),
+        (EntryType.KEY_VALUE.value, (1, None, None, "New", "k2", "val2")),
+        (EntryType.TOTP.value, (1, None, None, "New", None, None)),
     ],
 )
 def test_entrydialog_edit_calls_service(kind, expected):
@@ -157,6 +160,7 @@ def test_entrydialog_edit_calls_service(kind, expected):
     dlg.kind_input.value = kind
     dlg.username_input.value = "newu"
     dlg.url_input.value = "newx"
+    dlg.key_input.value = "k2"
     dlg.value_input.value = "val2"
     dlg.save(None)
 
diff --git a/src/tests/test_key_value_entry.py b/src/tests/test_key_value_entry.py
index ededd03..56f1e8e 100644
--- a/src/tests/test_key_value_entry.py
+++ b/src/tests/test_key_value_entry.py
@@ -23,12 +23,13 @@ def test_add_and_modify_key_value():
         tmp_path = Path(tmpdir)
         em = setup_entry_mgr(tmp_path)
 
-        idx = em.add_key_value("API", "abc123", notes="token")
+        idx = em.add_key_value("API entry", "api_key", "abc123", notes="token")
         entry = em.retrieve_entry(idx)
         assert entry == {
             "type": "key_value",
             "kind": "key_value",
-            "label": "API",
+            "label": "API entry",
+            "key": "api_key",
             "value": "abc123",
             "notes": "token",
             "archived": False,
@@ -36,8 +37,9 @@ def test_add_and_modify_key_value():
             "tags": [],
         }
 
-        em.modify_entry(idx, value="def456")
+        em.modify_entry(idx, key="api_key2", value="def456")
         updated = em.retrieve_entry(idx)
+        assert updated["key"] == "api_key2"
         assert updated["value"] == "def456"
 
         results = em.search_entries("def456")
diff --git a/src/tests/test_manager_list_entries.py b/src/tests/test_manager_list_entries.py
index 6e39282..58dca43 100644
--- a/src/tests/test_manager_list_entries.py
+++ b/src/tests/test_manager_list_entries.py
@@ -38,7 +38,7 @@ def test_handle_list_entries(monkeypatch, capsys):
 
         entry_mgr.add_totp("Example", TEST_SEED)
         entry_mgr.add_entry("example.com", 12)
-        entry_mgr.add_key_value("API", "abc123")
+        entry_mgr.add_key_value("API entry", "api", "abc123")
         entry_mgr.add_managed_account("acct", TEST_SEED)
 
         inputs = iter(["1", ""])  # list all, then exit
@@ -72,7 +72,7 @@ def test_list_entries_show_details(monkeypatch, capsys):
         pm.secret_mode_enabled = False
 
         entry_mgr.add_totp("Example", TEST_SEED)
-        entry_mgr.add_key_value("API", "val")
+        entry_mgr.add_key_value("API entry", "api", "val")
         entry_mgr.add_managed_account("acct", TEST_SEED)
 
         monkeypatch.setattr(pm.entry_manager, "get_totp_code", lambda *a, **k: "123456")
@@ -353,7 +353,7 @@ def test_show_entry_details_sensitive(monkeypatch, capsys, entry_type):
             )
             expected = "123456"
         elif entry_type == "key_value":
-            idx = entry_mgr.add_key_value("API", "abc")
+            idx = entry_mgr.add_key_value("API entry", "api", "abc")
             expected = "abc"
         else:  # managed_account
             idx = entry_mgr.add_managed_account("acct", TEST_SEED)
@@ -390,8 +390,8 @@ def test_show_entry_details_with_enum_type(monkeypatch, capsys, entry_type):
             )
             expect = "Label: Example"
         else:  # KEY_VALUE
-            idx = entry_mgr.add_key_value("API", "abc")
-            expect = "API"
+            idx = entry_mgr.add_key_value("API entry", "api", "abc")
+            expect = "API entry"
 
         data = entry_mgr._load_index(force_reload=True)
         data["entries"][str(idx)]["type"] = entry_type
diff --git a/src/tests/test_search_entries.py b/src/tests/test_search_entries.py
index 9db94a2..08541f7 100644
--- a/src/tests/test_search_entries.py
+++ b/src/tests/test_search_entries.py
@@ -93,7 +93,7 @@ def test_search_key_value_value():
         tmp_path = Path(tmpdir)
         entry_mgr = setup_entry_manager(tmp_path)
 
-        idx = entry_mgr.add_key_value("API", "token123")
+        idx = entry_mgr.add_key_value("API entry", "api", "token123")
 
         result = entry_mgr.search_entries("token123")
         assert result == []

From bcd8002e1d79102f7aa0b6e35f09639a8b6ad2b9 Mon Sep 17 00:00:00 2001
From: thePR0M3TH3AN <53631862+PR0M3TH3AN@users.noreply.github.com>
Date: Wed, 30 Jul 2025 14:45:53 -0400
Subject: [PATCH 04/33] Pin nostr-sdk to 0.42.x

---
 pyproject.toml               | 2 +-
 src/requirements.txt         | 2 +-
 src/runtime_requirements.txt | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/pyproject.toml b/pyproject.toml
index 880a5c7..7ebde26 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -31,7 +31,7 @@ requires = [
     "aiohttp>=3.12.14",
     "bcrypt",
     "portalocker>=2.8",
-    "nostr-sdk>=0.42.1",
+    "nostr-sdk>=0.42.1,<0.43",
     "websocket-client==1.7.0",
     "websockets>=15.0.0",
     "tomli",
diff --git a/src/requirements.txt b/src/requirements.txt
index 4008154..ac9a950 100644
--- a/src/requirements.txt
+++ b/src/requirements.txt
@@ -11,7 +11,7 @@ pytest>=7.0
 pytest-cov
 pytest-xdist
 portalocker>=2.8
-nostr-sdk>=0.42.1
+nostr-sdk>=0.42.1,<0.43
 websocket-client==1.7.0
 
 websockets>=15.0.0
diff --git a/src/runtime_requirements.txt b/src/runtime_requirements.txt
index 1bde15f..f1b13ec 100644
--- a/src/runtime_requirements.txt
+++ b/src/runtime_requirements.txt
@@ -10,7 +10,7 @@ mnemonic
 aiohttp>=3.12.14
 bcrypt
 portalocker>=2.8
-nostr-sdk>=0.42.1
+nostr-sdk>=0.42.1,<0.43
 websocket-client==1.7.0
 
 websockets>=15.0.0

From acb1126287e82bffb4348711aee2ba6131228d3b Mon Sep 17 00:00:00 2001
From: thePR0M3TH3AN <53631862+PR0M3TH3AN@users.noreply.github.com>
Date: Wed, 30 Jul 2025 15:14:11 -0400
Subject: [PATCH 05/33] Fix nostr dependency

---
 pyproject.toml               | 2 +-
 requirements.lock            | 2 +-
 src/requirements.txt         | 2 +-
 src/runtime_requirements.txt | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/pyproject.toml b/pyproject.toml
index 7ebde26..28115bb 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -31,7 +31,7 @@ requires = [
     "aiohttp>=3.12.14",
     "bcrypt",
     "portalocker>=2.8",
-    "nostr-sdk>=0.42.1,<0.43",
+    "nostr-sdk>=0.43",
     "websocket-client==1.7.0",
     "websockets>=15.0.0",
     "tomli",
diff --git a/requirements.lock b/requirements.lock
index dd2ae0f..2962cf1 100644
--- a/requirements.lock
+++ b/requirements.lock
@@ -32,7 +32,7 @@ mnemonic==0.21
 monero==1.1.1
 multidict==6.6.3
 mutmut==2.4.4
-nostr-sdk==0.42.1
+nostr-sdk==0.43.0
 orjson==3.10.18
 packaging==25.0
 parso==0.8.4
diff --git a/src/requirements.txt b/src/requirements.txt
index ac9a950..b4f5c96 100644
--- a/src/requirements.txt
+++ b/src/requirements.txt
@@ -11,7 +11,7 @@ pytest>=7.0
 pytest-cov
 pytest-xdist
 portalocker>=2.8
-nostr-sdk>=0.42.1,<0.43
+nostr-sdk>=0.43
 websocket-client==1.7.0
 
 websockets>=15.0.0
diff --git a/src/runtime_requirements.txt b/src/runtime_requirements.txt
index f1b13ec..3f0d4f2 100644
--- a/src/runtime_requirements.txt
+++ b/src/runtime_requirements.txt
@@ -10,7 +10,7 @@ mnemonic
 aiohttp>=3.12.14
 bcrypt
 portalocker>=2.8
-nostr-sdk>=0.42.1,<0.43
+nostr-sdk>=0.43
 websocket-client==1.7.0
 
 websockets>=15.0.0

From 715952fba657081a6a1838a5058ec05d875d9e71 Mon Sep 17 00:00:00 2001
From: thePR0M3TH3AN <53631862+PR0M3TH3AN@users.noreply.github.com>
Date: Wed, 30 Jul 2025 15:25:47 -0400
Subject: [PATCH 06/33] Ignore ecdsa advisory

---
 .github/workflows/python-ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/python-ci.yml b/.github/workflows/python-ci.yml
index edd768f..fd0608f 100644
--- a/.github/workflows/python-ci.yml
+++ b/.github/workflows/python-ci.yml
@@ -70,7 +70,7 @@ jobs:
       - name: Run pip-audit
         run: |
           pip install pip-audit
-          pip-audit -r requirements.lock
+          pip-audit -r requirements.lock --ignore-vuln GHSA-wj6h-64fc-37mp
       - name: Determine stress args
         shell: bash
         run: |

From 3937ccfb75fbea57bd4d164471fb647bbddb70eb Mon Sep 17 00:00:00 2001
From: thePR0M3TH3AN <53631862+PR0M3TH3AN@users.noreply.github.com>
Date: Wed, 30 Jul 2025 15:50:48 -0400
Subject: [PATCH 07/33] Allow editing Key field in Key/Value entries

---
 src/seedpass/core/manager.py | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/src/seedpass/core/manager.py b/src/seedpass/core/manager.py
index b44ff4e..7dc2788 100644
--- a/src/seedpass/core/manager.py
+++ b/src/seedpass/core/manager.py
@@ -2173,7 +2173,9 @@ class PasswordManager:
                 child_fingerprint=child_fp,
             )
             print(colored("\n[+] Edit Menu:", "green"))
-            print(colored("L. Edit Label (key)", "cyan"))
+            print(colored("L. Edit Label", "cyan"))
+            if entry_type == EntryType.KEY_VALUE.value:
+                print(colored("K. Edit Key", "cyan"))
             if entry_type == EntryType.PASSWORD.value:
                 print(colored("U. Edit Username", "cyan"))
                 print(colored("R. Edit URL", "cyan"))
@@ -2184,11 +2186,17 @@ class PasswordManager:
             if not choice:
                 break
             if choice == "l":
-                new_label = input("New label (key): ").strip()
+                new_label = input("New label: ").strip()
                 if new_label:
                     self.entry_manager.modify_entry(index, label=new_label)
                     self.is_dirty = True
                     self.last_update = time.time()
+            elif entry_type == EntryType.KEY_VALUE.value and choice == "k":
+                new_key = input("New key: ").strip()
+                if new_key:
+                    self.entry_manager.modify_entry(index, key=new_key)
+                    self.is_dirty = True
+                    self.last_update = time.time()
             elif entry_type == EntryType.PASSWORD.value and choice == "u":
                 new_username = input("New username: ").strip()
                 self.entry_manager.modify_entry(index, username=new_username)

From bb1d6927989c4ddf9aeac4e4bbd7dbedaea56e60 Mon Sep 17 00:00:00 2001
From: thePR0M3TH3AN <53631862+PR0M3TH3AN@users.noreply.github.com>
Date: Wed, 30 Jul 2025 16:05:01 -0400
Subject: [PATCH 08/33] Add value editing for Key/Value entries

---
 src/seedpass/core/manager.py | 19 +++++++++++++++++--
 1 file changed, 17 insertions(+), 2 deletions(-)

diff --git a/src/seedpass/core/manager.py b/src/seedpass/core/manager.py
index b44ff4e..98b0145 100644
--- a/src/seedpass/core/manager.py
+++ b/src/seedpass/core/manager.py
@@ -2173,7 +2173,10 @@ class PasswordManager:
                 child_fingerprint=child_fp,
             )
             print(colored("\n[+] Edit Menu:", "green"))
-            print(colored("L. Edit Label (key)", "cyan"))
+            print(colored("L. Edit Label", "cyan"))
+            if entry_type == EntryType.KEY_VALUE.value:
+                print(colored("K. Edit Key", "cyan"))
+                print(colored("V. Edit Value", "cyan"))
             if entry_type == EntryType.PASSWORD.value:
                 print(colored("U. Edit Username", "cyan"))
                 print(colored("R. Edit URL", "cyan"))
@@ -2184,11 +2187,23 @@ class PasswordManager:
             if not choice:
                 break
             if choice == "l":
-                new_label = input("New label (key): ").strip()
+                new_label = input("New label: ").strip()
                 if new_label:
                     self.entry_manager.modify_entry(index, label=new_label)
                     self.is_dirty = True
                     self.last_update = time.time()
+            elif entry_type == EntryType.KEY_VALUE.value and choice == "k":
+                new_key = input("New key: ").strip()
+                if new_key:
+                    self.entry_manager.modify_entry(index, key=new_key)
+                    self.is_dirty = True
+                    self.last_update = time.time()
+            elif entry_type == EntryType.KEY_VALUE.value and choice == "v":
+                new_value = input("New value: ").strip()
+                if new_value:
+                    self.entry_manager.modify_entry(index, value=new_value)
+                    self.is_dirty = True
+                    self.last_update = time.time()
             elif entry_type == EntryType.PASSWORD.value and choice == "u":
                 new_username = input("New username: ").strip()
                 self.entry_manager.modify_entry(index, username=new_username)

From 627d69cf30a999143ea3d9af7bcfbfb06ff8c040 Mon Sep 17 00:00:00 2001
From: thePR0M3TH3AN <53631862+PR0M3TH3AN@users.noreply.github.com>
Date: Wed, 30 Jul 2025 16:51:53 -0400
Subject: [PATCH 09/33] Add edit options for key/value entries

---
 docs/docs/content/01-getting-started/01-advanced_cli.md | 4 ++--
 src/seedpass/api.py                                     | 1 +
 src/seedpass/cli.py                                     | 2 ++
 src/seedpass/core/api.py                                | 2 ++
 src/tests/test_typer_cli.py                             | 8 +++++---
 5 files changed, 12 insertions(+), 5 deletions(-)

diff --git a/docs/docs/content/01-getting-started/01-advanced_cli.md b/docs/docs/content/01-getting-started/01-advanced_cli.md
index 92d41aa..0b5279c 100644
--- a/docs/docs/content/01-getting-started/01-advanced_cli.md
+++ b/docs/docs/content/01-getting-started/01-advanced_cli.md
@@ -57,7 +57,7 @@ Manage individual entries within a vault.
 | Add a seed phrase entry | `entry add-seed` | `seedpass entry add-seed Backup --words 24` |
 | Add a key/value entry | `entry add-key-value` | `seedpass entry add-key-value "API Token" --key api --value abc123` |
 | Add a managed account entry | `entry add-managed-account` | `seedpass entry add-managed-account Trading` |
-| Modify an entry | `entry modify` | `seedpass entry modify 1 --username alice` |
+| Modify an entry | `entry modify` | `seedpass entry modify 1 --key new --value updated` |
 | Archive an entry | `entry archive` | `seedpass entry archive 1` |
 | Unarchive an entry | `entry unarchive` | `seedpass entry unarchive 1` |
 | Export all TOTP secrets | `entry export-totp` | `seedpass entry export-totp --file totp.json` |
@@ -146,7 +146,7 @@ Run or stop the local HTTP API.
 - **`seedpass entry add-seed <label>`** – Store a derived seed phrase. Use `--words` to set the word count.
  - **`seedpass entry add-key-value <label>`** – Store arbitrary data with `--key` and `--value`.
 - **`seedpass entry add-managed-account <label>`** – Store a BIP‑85 derived account seed.
-- **`seedpass entry modify <id>`** – Update an entry's label, username, URL or notes.
+- **`seedpass entry modify <id>`** – Update an entry's fields. For key/value entries you can change the label, key and value.
 - **`seedpass entry archive <id>`** – Mark an entry as archived so it is hidden from normal lists.
 - **`seedpass entry unarchive <id>`** – Restore an archived entry.
 - **`seedpass entry export-totp --file <path>`** – Export all stored TOTP secrets to a JSON file.
diff --git a/src/seedpass/api.py b/src/seedpass/api.py
index e848241..a0a729d 100644
--- a/src/seedpass/api.py
+++ b/src/seedpass/api.py
@@ -218,6 +218,7 @@ def update_entry(
             label=entry.get("label"),
             period=entry.get("period"),
             digits=entry.get("digits"),
+            key=entry.get("key"),
             value=entry.get("value"),
         )
     except ValueError as e:
diff --git a/src/seedpass/cli.py b/src/seedpass/cli.py
index b746729..4ab377d 100644
--- a/src/seedpass/cli.py
+++ b/src/seedpass/cli.py
@@ -354,6 +354,7 @@ def entry_modify(
         None, "--period", help="TOTP period in seconds"
     ),
     digits: Optional[int] = typer.Option(None, "--digits", help="TOTP digits"),
+    key: Optional[str] = typer.Option(None, "--key", help="New key"),
     value: Optional[str] = typer.Option(None, "--value", help="New value"),
 ) -> None:
     """Modify an existing entry."""
@@ -367,6 +368,7 @@ def entry_modify(
             label=label,
             period=period,
             digits=digits,
+            key=key,
             value=value,
         )
     except ValueError as e:
diff --git a/src/seedpass/core/api.py b/src/seedpass/core/api.py
index d43ccc3..eb77092 100644
--- a/src/seedpass/core/api.py
+++ b/src/seedpass/core/api.py
@@ -416,6 +416,7 @@ class EntryService:
         label: str | None = None,
         period: int | None = None,
         digits: int | None = None,
+        key: str | None = None,
         value: str | None = None,
     ) -> None:
         with self._lock:
@@ -427,6 +428,7 @@ class EntryService:
                 label=label,
                 period=period,
                 digits=digits,
+                key=key,
                 value=value,
             )
             self._manager.start_background_vault_sync()
diff --git a/src/tests/test_typer_cli.py b/src/tests/test_typer_cli.py
index d49803c..c9d0dab 100644
--- a/src/tests/test_typer_cli.py
+++ b/src/tests/test_typer_cli.py
@@ -402,8 +402,10 @@ def test_entry_add(monkeypatch):
 def test_entry_modify(monkeypatch):
     called = {}
 
-    def modify_entry(index, username=None, url=None, notes=None, label=None, **kwargs):
-        called["args"] = (index, username, url, notes, label, kwargs)
+    def modify_entry(
+        index, username=None, url=None, notes=None, label=None, key=None, **kwargs
+    ):
+        called["args"] = (index, username, url, notes, label, key, kwargs)
 
     pm = SimpleNamespace(
         entry_manager=SimpleNamespace(modify_entry=modify_entry),
@@ -413,7 +415,7 @@ def test_entry_modify(monkeypatch):
     monkeypatch.setattr(cli, "PasswordManager", lambda: pm)
     result = runner.invoke(app, ["entry", "modify", "1", "--username", "alice"])
     assert result.exit_code == 0
-    assert called["args"][:5] == (1, "alice", None, None, None)
+    assert called["args"][:6] == (1, "alice", None, None, None, None)
 
 
 def test_entry_modify_invalid(monkeypatch):

From dcb5c6e805800fd615ff758465050fcd34e6042e Mon Sep 17 00:00:00 2001
From: thePR0M3TH3AN <53631862+PR0M3TH3AN@users.noreply.github.com>
Date: Wed, 30 Jul 2025 18:44:41 -0400
Subject: [PATCH 10/33] Extend password policy and generator

---
 src/constants.py                             |  3 +
 src/seedpass/core/password_generation.py     | 96 +++++++++++++++-----
 src/tests/test_password_generation_policy.py |  4 +-
 src/tests/test_password_helpers.py           |  2 +-
 src/tests/test_password_special_chars.py     | 49 ++++++++++
 5 files changed, 130 insertions(+), 24 deletions(-)
 create mode 100644 src/tests/test_password_special_chars.py

diff --git a/src/constants.py b/src/constants.py
index e221288..4843ecd 100644
--- a/src/constants.py
+++ b/src/constants.py
@@ -50,6 +50,9 @@ DEFAULT_PASSWORD_LENGTH = 16  # Default length for generated passwords
 MIN_PASSWORD_LENGTH = 8  # Minimum allowed password length
 MAX_PASSWORD_LENGTH = 128  # Maximum allowed password length
 
+# Characters considered safe for passwords when limiting punctuation
+SAFE_SPECIAL_CHARS = "!@#$%^*-_+=?"
+
 # Timeout in seconds before the vault locks due to inactivity
 INACTIVITY_TIMEOUT = 15 * 60  # 15 minutes
 
diff --git a/src/seedpass/core/password_generation.py b/src/seedpass/core/password_generation.py
index a70ab0b..61617b0 100644
--- a/src/seedpass/core/password_generation.py
+++ b/src/seedpass/core/password_generation.py
@@ -51,12 +51,27 @@ logger = logging.getLogger(__name__)
 
 @dataclass
 class PasswordPolicy:
-    """Minimum complexity requirements for generated passwords."""
+    """Minimum complexity requirements for generated passwords.
+
+    Attributes:
+        min_uppercase: Minimum required uppercase letters.
+        min_lowercase: Minimum required lowercase letters.
+        min_digits: Minimum required digits.
+        min_special: Minimum required special characters.
+        include_special_chars: Whether to include any special characters.
+        allowed_special_chars: Explicit set of allowed special characters.
+        special_mode: Preset mode for special characters (e.g. "safe").
+        exclude_ambiguous: Exclude easily confused characters like ``O`` and ``0``.
+    """
 
     min_uppercase: int = 2
     min_lowercase: int = 2
     min_digits: int = 2
     min_special: int = 2
+    include_special_chars: bool = True
+    allowed_special_chars: str | None = None
+    special_mode: str | None = None
+    exclude_ambiguous: bool = False
 
 
 class PasswordGenerator:
@@ -175,9 +190,28 @@ class PasswordGenerator:
 
             dk = self._derive_password_entropy(index=index)
 
-            all_allowed = string.ascii_letters + string.digits + string.punctuation
+            letters = string.ascii_letters
+            digits = string.digits
+
+            if self.policy.exclude_ambiguous:
+                ambiguous = "O0Il1"
+                letters = "".join(c for c in letters if c not in ambiguous)
+                digits = "".join(c for c in digits if c not in ambiguous)
+
+            if not self.policy.include_special_chars:
+                allowed_special = ""
+            elif self.policy.allowed_special_chars is not None:
+                allowed_special = self.policy.allowed_special_chars
+            elif self.policy.special_mode == "safe":
+                allowed_special = SAFE_SPECIAL_CHARS
+            else:
+                allowed_special = string.punctuation
+
+            all_allowed = letters + digits + allowed_special
             password = self._map_entropy_to_chars(dk, all_allowed)
-            password = self._enforce_complexity(password, all_allowed, dk)
+            password = self._enforce_complexity(
+                password, all_allowed, allowed_special, dk
+            )
             password = self._shuffle_deterministically(password, dk)
 
             # Ensure password length by extending if necessary
@@ -195,7 +229,9 @@ class PasswordGenerator:
             # produced above when the requested length is shorter than the
             # initial entropy size.
             password = password[:length]
-            password = self._enforce_complexity(password, all_allowed, dk)
+            password = self._enforce_complexity(
+                password, all_allowed, allowed_special, dk
+            )
             password = self._shuffle_deterministically(password, dk)
             logger.debug(
                 f"Final password (trimmed to {length} chars with complexity enforced): {password}"
@@ -208,7 +244,9 @@ class PasswordGenerator:
             print(colored(f"Error: Failed to generate password: {e}", "red"))
             raise
 
-    def _enforce_complexity(self, password: str, alphabet: str, dk: bytes) -> str:
+    def _enforce_complexity(
+        self, password: str, alphabet: str, allowed_special: str, dk: bytes
+    ) -> str:
         """
         Ensures that the password contains at least two uppercase letters, two lowercase letters,
         two digits, and two special characters, modifying it deterministically if necessary.
@@ -226,7 +264,13 @@ class PasswordGenerator:
             uppercase = string.ascii_uppercase
             lowercase = string.ascii_lowercase
             digits = string.digits
-            special = string.punctuation
+            special = allowed_special
+
+            if self.policy.exclude_ambiguous:
+                ambiguous = "O0Il1"
+                uppercase = "".join(c for c in uppercase if c not in ambiguous)
+                lowercase = "".join(c for c in lowercase if c not in ambiguous)
+                digits = "".join(c for c in digits if c not in ambiguous)
 
             password_chars = list(password)
 
@@ -244,7 +288,7 @@ class PasswordGenerator:
             min_upper = self.policy.min_uppercase
             min_lower = self.policy.min_lowercase
             min_digits = self.policy.min_digits
-            min_special = self.policy.min_special
+            min_special = self.policy.min_special if special else 0
 
             # Initialize derived key index
             dk_index = 0
@@ -282,7 +326,7 @@ class PasswordGenerator:
                     password_chars[index] = char
                     logger.debug(f"Added digit '{char}' at position {index}.")
 
-            if current_special < min_special:
+            if special and current_special < min_special:
                 for _ in range(min_special - current_special):
                     index = get_dk_value() % len(password_chars)
                     char = special[get_dk_value() % len(special)]
@@ -292,23 +336,29 @@ class PasswordGenerator:
                     )
 
             # Additional deterministic inclusion of symbols to increase score
-            symbol_target = 3  # Increase target number of symbols
-            current_symbols = sum(1 for c in password_chars if c in special)
-            additional_symbols_needed = max(symbol_target - current_symbols, 0)
+            if special:
+                symbol_target = 3  # Increase target number of symbols
+                current_symbols = sum(1 for c in password_chars if c in special)
+                additional_symbols_needed = max(symbol_target - current_symbols, 0)
 
-            for _ in range(additional_symbols_needed):
-                if dk_index >= dk_length:
-                    break  # Avoid exceeding the derived key length
-                index = get_dk_value() % len(password_chars)
-                char = special[get_dk_value() % len(special)]
-                password_chars[index] = char
-                logger.debug(f"Added additional symbol '{char}' at position {index}.")
+                for _ in range(additional_symbols_needed):
+                    if dk_index >= dk_length:
+                        break  # Avoid exceeding the derived key length
+                    index = get_dk_value() % len(password_chars)
+                    char = special[get_dk_value() % len(special)]
+                    password_chars[index] = char
+                    logger.debug(
+                        f"Added additional symbol '{char}' at position {index}."
+                    )
 
             # Ensure balanced distribution by assigning different character types to specific segments
             # Example: Divide password into segments and assign different types
-            segment_length = len(password_chars) // 4
+            char_types = [uppercase, lowercase, digits]
+            if special:
+                char_types.append(special)
+            segment_length = len(password_chars) // len(char_types)
             if segment_length > 0:
-                for i, char_type in enumerate([uppercase, lowercase, digits, special]):
+                for i, char_type in enumerate(char_types):
                     segment_start = i * segment_length
                     segment_end = segment_start + segment_length
                     if segment_end > len(password_chars):
@@ -330,7 +380,11 @@ class PasswordGenerator:
                             char = digits[get_dk_value() % len(digits)]
                             password_chars[j] = char
                             logger.debug(f"Assigned digit '{char}' to position {j}.")
-                        elif i == 3 and password_chars[j] not in special:
+                        elif (
+                            special
+                            and i == len(char_types) - 1
+                            and password_chars[j] not in special
+                        ):
                             char = special[get_dk_value() % len(special)]
                             password_chars[j] = char
                             logger.debug(
diff --git a/src/tests/test_password_generation_policy.py b/src/tests/test_password_generation_policy.py
index a4df419..0a90101 100644
--- a/src/tests/test_password_generation_policy.py
+++ b/src/tests/test_password_generation_policy.py
@@ -39,7 +39,7 @@ def test_zero_policy_preserves_length():
     pg = make_generator(policy)
     alphabet = string.ascii_lowercase
     dk = bytes(range(32))
-    result = pg._enforce_complexity("a" * 32, alphabet, dk)
+    result = pg._enforce_complexity("a" * 32, alphabet, "", dk)
     assert len(result) == 32
 
 
@@ -50,7 +50,7 @@ def test_custom_policy_applied():
     pg = make_generator(policy)
     alphabet = string.ascii_letters + string.digits + string.punctuation
     dk = bytes(range(32))
-    result = pg._enforce_complexity("a" * 32, alphabet, dk)
+    result = pg._enforce_complexity("a" * 32, alphabet, string.punctuation, dk)
     counts = count_types(result)
     assert counts[0] >= 4
     assert counts[1] >= 1
diff --git a/src/tests/test_password_helpers.py b/src/tests/test_password_helpers.py
index 080e363..b41f186 100644
--- a/src/tests/test_password_helpers.py
+++ b/src/tests/test_password_helpers.py
@@ -41,7 +41,7 @@ def test_enforce_complexity_minimum_counts():
     pg = make_generator()
     alphabet = string.ascii_letters + string.digits + string.punctuation
     dk = bytes(range(32))
-    result = pg._enforce_complexity("a" * 32, alphabet, dk)
+    result = pg._enforce_complexity("a" * 32, alphabet, string.punctuation, dk)
     assert sum(1 for c in result if c.isupper()) >= 2
     assert sum(1 for c in result if c.islower()) >= 2
     assert sum(1 for c in result if c.isdigit()) >= 2
diff --git a/src/tests/test_password_special_chars.py b/src/tests/test_password_special_chars.py
new file mode 100644
index 0000000..707e156
--- /dev/null
+++ b/src/tests/test_password_special_chars.py
@@ -0,0 +1,49 @@
+import string
+from pathlib import Path
+import sys
+
+sys.path.append(str(Path(__file__).resolve().parents[1]))
+
+from seedpass.core.password_generation import PasswordGenerator, PasswordPolicy
+
+
+class DummyEnc:
+    def derive_seed_from_mnemonic(self, mnemonic):
+        return b"\x00" * 32
+
+
+class DummyBIP85:
+    def derive_entropy(self, index: int, bytes_len: int, app_no: int = 32) -> bytes:
+        return bytes((index + i) % 256 for i in range(bytes_len))
+
+
+def make_generator(policy=None):
+    pg = PasswordGenerator.__new__(PasswordGenerator)
+    pg.encryption_manager = DummyEnc()
+    pg.bip85 = DummyBIP85()
+    pg.policy = policy or PasswordPolicy()
+    return pg
+
+
+def test_no_special_chars():
+    policy = PasswordPolicy(include_special_chars=False)
+    pg = make_generator(policy)
+    pw = pg.generate_password(length=16, index=0)
+    assert not any(c in string.punctuation for c in pw)
+
+
+def test_allowed_special_chars_only():
+    allowed = "@$"
+    policy = PasswordPolicy(allowed_special_chars=allowed)
+    pg = make_generator(policy)
+    pw = pg.generate_password(length=32, index=1)
+    specials = [c for c in pw if c in string.punctuation]
+    assert specials and all(c in allowed for c in specials)
+
+
+def test_exclude_ambiguous_chars():
+    policy = PasswordPolicy(exclude_ambiguous=True)
+    pg = make_generator(policy)
+    pw = pg.generate_password(length=32, index=2)
+    for ch in "O0Il1":
+        assert ch not in pw

From 7dba8e138df96da6f32e008851c2ee85fa95e955 Mon Sep 17 00:00:00 2001
From: thePR0M3TH3AN <53631862+PR0M3TH3AN@users.noreply.github.com>
Date: Wed, 30 Jul 2025 19:10:10 -0400
Subject: [PATCH 11/33] Add password policy config options

---
 src/seedpass/core/api.py            | 10 ++++++++
 src/seedpass/core/config_manager.py | 36 ++++++++++++++++++++++++++
 src/tests/test_config_manager.py    | 40 +++++++++++++++++++++++++++++
 3 files changed, 86 insertions(+)

diff --git a/src/seedpass/core/api.py b/src/seedpass/core/api.py
index eb77092..7415bce 100644
--- a/src/seedpass/core/api.py
+++ b/src/seedpass/core/api.py
@@ -488,6 +488,16 @@ class ConfigService:
             "min_lowercase": ("set_min_lowercase", int),
             "min_digits": ("set_min_digits", int),
             "min_special": ("set_min_special", int),
+            "include_special_chars": (
+                "set_include_special_chars",
+                lambda v: v.lower() in ("1", "true", "yes", "y", "on"),
+            ),
+            "allowed_special_chars": ("set_allowed_special_chars", lambda v: v),
+            "special_mode": ("set_special_mode", lambda v: v),
+            "exclude_ambiguous": (
+                "set_exclude_ambiguous",
+                lambda v: v.lower() in ("1", "true", "yes", "y", "on"),
+            ),
             "quick_unlock": (
                 "set_quick_unlock",
                 lambda v: v.lower() in ("1", "true", "yes", "y", "on"),
diff --git a/src/seedpass/core/config_manager.py b/src/seedpass/core/config_manager.py
index a474277..31b469c 100644
--- a/src/seedpass/core/config_manager.py
+++ b/src/seedpass/core/config_manager.py
@@ -58,6 +58,10 @@ class ConfigManager:
                 "min_lowercase": 2,
                 "min_digits": 2,
                 "min_special": 2,
+                "include_special_chars": True,
+                "allowed_special_chars": "",
+                "special_mode": "standard",
+                "exclude_ambiguous": False,
                 "verbose_timing": False,
             }
         try:
@@ -83,6 +87,10 @@ class ConfigManager:
             data.setdefault("min_lowercase", 2)
             data.setdefault("min_digits", 2)
             data.setdefault("min_special", 2)
+            data.setdefault("include_special_chars", True)
+            data.setdefault("allowed_special_chars", "")
+            data.setdefault("special_mode", "standard")
+            data.setdefault("exclude_ambiguous", False)
             data.setdefault("verbose_timing", False)
 
             # Migrate legacy hashed_password.enc if present and password_hash is missing
@@ -259,6 +267,10 @@ class ConfigManager:
             min_lowercase=int(cfg.get("min_lowercase", 2)),
             min_digits=int(cfg.get("min_digits", 2)),
             min_special=int(cfg.get("min_special", 2)),
+            include_special_chars=bool(cfg.get("include_special_chars", True)),
+            allowed_special_chars=cfg.get("allowed_special_chars") or None,
+            special_mode=cfg.get("special_mode") or None,
+            exclude_ambiguous=bool(cfg.get("exclude_ambiguous", False)),
         )
 
     def set_min_uppercase(self, count: int) -> None:
@@ -281,6 +293,30 @@ class ConfigManager:
         cfg["min_special"] = int(count)
         self.save_config(cfg)
 
+    def set_include_special_chars(self, enabled: bool) -> None:
+        """Persist whether special characters are allowed."""
+        cfg = self.load_config(require_pin=False)
+        cfg["include_special_chars"] = bool(enabled)
+        self.save_config(cfg)
+
+    def set_allowed_special_chars(self, chars: str | None) -> None:
+        """Persist the set of allowed special characters."""
+        cfg = self.load_config(require_pin=False)
+        cfg["allowed_special_chars"] = chars or ""
+        self.save_config(cfg)
+
+    def set_special_mode(self, mode: str) -> None:
+        """Persist the special character mode."""
+        cfg = self.load_config(require_pin=False)
+        cfg["special_mode"] = mode
+        self.save_config(cfg)
+
+    def set_exclude_ambiguous(self, enabled: bool) -> None:
+        """Persist whether ambiguous characters are excluded."""
+        cfg = self.load_config(require_pin=False)
+        cfg["exclude_ambiguous"] = bool(enabled)
+        self.save_config(cfg)
+
     def set_quick_unlock(self, enabled: bool) -> None:
         """Persist the quick unlock toggle."""
         cfg = self.load_config(require_pin=False)
diff --git a/src/tests/test_config_manager.py b/src/tests/test_config_manager.py
index c6ee18e..f1f4b0e 100644
--- a/src/tests/test_config_manager.py
+++ b/src/tests/test_config_manager.py
@@ -196,3 +196,43 @@ def test_nostr_retry_settings_round_trip():
         cfg_mgr.set_nostr_retry_delay(3.5)
         assert cfg_mgr.get_nostr_max_retries() == 5
         assert cfg_mgr.get_nostr_retry_delay() == 3.5
+
+
+def test_special_char_settings_round_trip():
+    with TemporaryDirectory() as tmpdir:
+        vault, _ = create_vault(Path(tmpdir), TEST_SEED, TEST_PASSWORD)
+        cfg_mgr = ConfigManager(vault, Path(tmpdir))
+
+        cfg = cfg_mgr.load_config(require_pin=False)
+        assert cfg["include_special_chars"] is True
+        assert cfg["allowed_special_chars"] == ""
+        assert cfg["special_mode"] == "standard"
+        assert cfg["exclude_ambiguous"] is False
+
+        cfg_mgr.set_include_special_chars(False)
+        cfg_mgr.set_allowed_special_chars("@$")
+        cfg_mgr.set_special_mode("safe")
+        cfg_mgr.set_exclude_ambiguous(True)
+
+        cfg2 = cfg_mgr.load_config(require_pin=False)
+        assert cfg2["include_special_chars"] is False
+        assert cfg2["allowed_special_chars"] == "@$"
+        assert cfg2["special_mode"] == "safe"
+        assert cfg2["exclude_ambiguous"] is True
+
+
+def test_password_policy_extended_fields():
+    with TemporaryDirectory() as tmpdir:
+        vault, _ = create_vault(Path(tmpdir), TEST_SEED, TEST_PASSWORD)
+        cfg_mgr = ConfigManager(vault, Path(tmpdir))
+
+        cfg_mgr.set_include_special_chars(False)
+        cfg_mgr.set_allowed_special_chars("()")
+        cfg_mgr.set_special_mode("safe")
+        cfg_mgr.set_exclude_ambiguous(True)
+
+        policy = cfg_mgr.get_password_policy()
+        assert policy.include_special_chars is False
+        assert policy.allowed_special_chars == "()"
+        assert policy.special_mode == "safe"
+        assert policy.exclude_ambiguous is True

From b4d60782af0f8aba8e1f8d686fba7da4f0d846b0 Mon Sep 17 00:00:00 2001
From: thePR0M3TH3AN <53631862+PR0M3TH3AN@users.noreply.github.com>
Date: Wed, 30 Jul 2025 19:57:38 -0400
Subject: [PATCH 12/33] Add per-entry password policy overrides

---
 src/seedpass/core/api.py                |  6 +-
 src/seedpass/core/entry_management.py   | 79 ++++++++++++++++++++++++-
 src/seedpass/core/manager.py            | 37 ++++++++++--
 src/tests/test_entry_policy_override.py | 67 +++++++++++++++++++++
 4 files changed, 183 insertions(+), 6 deletions(-)
 create mode 100644 src/tests/test_entry_policy_override.py

diff --git a/src/seedpass/core/api.py b/src/seedpass/core/api.py
index 7415bce..04c5837 100644
--- a/src/seedpass/core/api.py
+++ b/src/seedpass/core/api.py
@@ -265,7 +265,11 @@ class EntryService:
 
     def generate_password(self, length: int, index: int) -> str:
         with self._lock:
-            return self._manager.password_generator.generate_password(length, index)
+            entry = self._manager.entry_manager.retrieve_entry(index)
+            gen_fn = getattr(self._manager, "_generate_password_for_entry", None)
+            if gen_fn is None:
+                return self._manager.password_generator.generate_password(length, index)
+            return gen_fn(entry, index, length)
 
     def get_totp_code(self, entry_id: int) -> str:
         with self._lock:
diff --git a/src/seedpass/core/entry_management.py b/src/seedpass/core/entry_management.py
index bbac6a4..c4e6d53 100644
--- a/src/seedpass/core/entry_management.py
+++ b/src/seedpass/core/entry_management.py
@@ -152,6 +152,15 @@ class EntryManager:
         notes: str = "",
         custom_fields: List[Dict[str, Any]] | None = None,
         tags: list[str] | None = None,
+        *,
+        include_special_chars: bool | None = None,
+        allowed_special_chars: str | None = None,
+        special_mode: str | None = None,
+        exclude_ambiguous: bool | None = None,
+        min_uppercase: int | None = None,
+        min_lowercase: int | None = None,
+        min_digits: int | None = None,
+        min_special: int | None = None,
     ) -> int:
         """
         Adds a new entry to the encrypted JSON index file.
@@ -169,7 +178,7 @@ class EntryManager:
             data = self._load_index()
 
             data.setdefault("entries", {})
-            data["entries"][str(index)] = {
+            entry = {
                 "label": label,
                 "length": length,
                 "username": username if username else "",
@@ -183,6 +192,28 @@ class EntryManager:
                 "tags": tags or [],
             }
 
+            policy: dict[str, Any] = {}
+            if include_special_chars is not None:
+                policy["include_special_chars"] = include_special_chars
+            if allowed_special_chars is not None:
+                policy["allowed_special_chars"] = allowed_special_chars
+            if special_mode is not None:
+                policy["special_mode"] = special_mode
+            if exclude_ambiguous is not None:
+                policy["exclude_ambiguous"] = exclude_ambiguous
+            if min_uppercase is not None:
+                policy["min_uppercase"] = int(min_uppercase)
+            if min_lowercase is not None:
+                policy["min_lowercase"] = int(min_lowercase)
+            if min_digits is not None:
+                policy["min_digits"] = int(min_digits)
+            if min_special is not None:
+                policy["min_special"] = int(min_special)
+            if policy:
+                entry["policy"] = policy
+
+            data["entries"][str(index)] = entry
+
             logger.debug(f"Added entry at index {index}: {data['entries'][str(index)]}")
 
             self._save_index(data)
@@ -726,6 +757,14 @@ class EntryManager:
         value: Optional[str] = None,
         custom_fields: List[Dict[str, Any]] | None = None,
         tags: list[str] | None = None,
+        include_special_chars: bool | None = None,
+        allowed_special_chars: str | None = None,
+        special_mode: str | None = None,
+        exclude_ambiguous: bool | None = None,
+        min_uppercase: int | None = None,
+        min_lowercase: int | None = None,
+        min_digits: int | None = None,
+        min_special: int | None = None,
         **legacy,
     ) -> None:
         """
@@ -772,6 +811,14 @@ class EntryManager:
                 "value": value,
                 "custom_fields": custom_fields,
                 "tags": tags,
+                "include_special_chars": include_special_chars,
+                "allowed_special_chars": allowed_special_chars,
+                "special_mode": special_mode,
+                "exclude_ambiguous": exclude_ambiguous,
+                "min_uppercase": min_uppercase,
+                "min_lowercase": min_lowercase,
+                "min_digits": min_digits,
+                "min_special": min_special,
             }
 
             allowed = {
@@ -783,6 +830,14 @@ class EntryManager:
                     "notes",
                     "custom_fields",
                     "tags",
+                    "include_special_chars",
+                    "allowed_special_chars",
+                    "special_mode",
+                    "exclude_ambiguous",
+                    "min_uppercase",
+                    "min_lowercase",
+                    "min_digits",
+                    "min_special",
                 },
                 EntryType.TOTP.value: {
                     "label",
@@ -908,6 +963,28 @@ class EntryManager:
                 entry["tags"] = tags
                 logger.debug(f"Updated tags for index {index}: {tags}")
 
+            policy_updates: dict[str, Any] = {}
+            if include_special_chars is not None:
+                policy_updates["include_special_chars"] = include_special_chars
+            if allowed_special_chars is not None:
+                policy_updates["allowed_special_chars"] = allowed_special_chars
+            if special_mode is not None:
+                policy_updates["special_mode"] = special_mode
+            if exclude_ambiguous is not None:
+                policy_updates["exclude_ambiguous"] = exclude_ambiguous
+            if min_uppercase is not None:
+                policy_updates["min_uppercase"] = int(min_uppercase)
+            if min_lowercase is not None:
+                policy_updates["min_lowercase"] = int(min_lowercase)
+            if min_digits is not None:
+                policy_updates["min_digits"] = int(min_digits)
+            if min_special is not None:
+                policy_updates["min_special"] = int(min_special)
+            if policy_updates:
+                entry_policy = entry.get("policy", {})
+                entry_policy.update(policy_updates)
+                entry["policy"] = entry_policy
+
             entry["modified_ts"] = int(time.time())
 
             data["entries"][str(index)] = entry
diff --git a/src/seedpass/core/manager.py b/src/seedpass/core/manager.py
index 1491e98..dc61107 100644
--- a/src/seedpass/core/manager.py
+++ b/src/seedpass/core/manager.py
@@ -21,6 +21,7 @@ import builtins
 import threading
 import queue
 from dataclasses import dataclass
+import dataclasses
 from termcolor import colored
 from utils.color_scheme import color_text
 from utils.input_utils import timed_input
@@ -1457,7 +1458,8 @@ class PasswordManager:
             self.last_update = time.time()
 
             # Generate the password using the assigned index
-            password = self.password_generator.generate_password(length, index)
+            entry = self.entry_manager.retrieve_entry(index)
+            password = self._generate_password_for_entry(entry, index, length)
 
             # Provide user feedback
             print(
@@ -2067,6 +2069,29 @@ class PasswordManager:
             entry_type = entry_type.value
         return str(entry_type).lower()
 
+    def _generate_password_for_entry(
+        self, entry: dict, index: int, length: int | None = None
+    ) -> str:
+        """Generate a password for ``entry`` honoring any policy overrides."""
+        if length is None:
+            length = int(entry.get("length", DEFAULT_PASSWORD_LENGTH))
+        overrides = entry.get("policy", {})
+
+        pg = self.password_generator
+        if not hasattr(pg, "policy") or not isinstance(overrides, dict):
+            return pg.generate_password(length, index)
+
+        base_policy = pg.policy
+        merged = dataclasses.replace(
+            base_policy,
+            **{k: overrides[k] for k in overrides if hasattr(base_policy, k)},
+        )
+        pg.policy = merged
+        try:
+            return pg.generate_password(length, index)
+        finally:
+            pg.policy = base_policy
+
     def _entry_actions_menu(self, index: int, entry: dict) -> None:
         """Provide actions for a retrieved entry."""
         while True:
@@ -2176,7 +2201,9 @@ class PasswordManager:
             print(colored("L. Edit Label", "cyan"))
             if entry_type == EntryType.KEY_VALUE.value:
                 print(colored("K. Edit Key", "cyan"))
-                print(colored("V. Edit Value", "cyan"))  # 🔧 merged conflicting changes from feature-X vs main
+                print(
+                    colored("V. Edit Value", "cyan")
+                )  # 🔧 merged conflicting changes from feature-X vs main
             if entry_type == EntryType.PASSWORD.value:
                 print(colored("U. Edit Username", "cyan"))
                 print(colored("R. Edit URL", "cyan"))
@@ -2203,7 +2230,9 @@ class PasswordManager:
                 if new_value:
                     self.entry_manager.modify_entry(index, value=new_value)
                     self.is_dirty = True
-                    self.last_update = time.time()   # 🔧 merged conflicting changes from feature-X vs main
+                    self.last_update = (
+                        time.time()
+                    )  # 🔧 merged conflicting changes from feature-X vs main
             elif entry_type == EntryType.PASSWORD.value and choice == "u":
                 new_username = input("New username: ").strip()
                 self.entry_manager.modify_entry(index, username=new_username)
@@ -2649,7 +2678,7 @@ class PasswordManager:
                 level="WARNING",
             )
 
-        password = self.password_generator.generate_password(length, index)
+        password = self._generate_password_for_entry(entry, index, length)
 
         if password:
             if self.secret_mode_enabled:
diff --git a/src/tests/test_entry_policy_override.py b/src/tests/test_entry_policy_override.py
new file mode 100644
index 0000000..c23c1c8
--- /dev/null
+++ b/src/tests/test_entry_policy_override.py
@@ -0,0 +1,67 @@
+import sys
+from pathlib import Path
+from tempfile import TemporaryDirectory
+from types import SimpleNamespace
+import string
+
+from helpers import create_vault, TEST_SEED, TEST_PASSWORD
+
+sys.path.append(str(Path(__file__).resolve().parents[1]))
+
+from seedpass.core.entry_management import EntryManager
+from seedpass.core.backup import BackupManager
+from seedpass.core.manager import PasswordManager, EncryptionMode
+from seedpass.core.config_manager import ConfigManager
+from seedpass.core.password_generation import PasswordGenerator, PasswordPolicy
+
+
+class DummyEnc:
+    def derive_seed_from_mnemonic(self, mnemonic):
+        return b"\x00" * 32
+
+
+class DummyBIP85:
+    def derive_entropy(self, index: int, bytes_len: int, app_no: int = 32) -> bytes:
+        return bytes((index + i) % 256 for i in range(bytes_len))
+
+
+def make_manager(tmp_path: Path) -> PasswordManager:
+    vault, enc_mgr = create_vault(tmp_path, TEST_SEED, TEST_PASSWORD)
+    cfg_mgr = ConfigManager(vault, tmp_path)
+    backup_mgr = BackupManager(tmp_path, cfg_mgr)
+    entry_mgr = EntryManager(vault, backup_mgr)
+
+    pg = PasswordGenerator.__new__(PasswordGenerator)
+    pg.encryption_manager = DummyEnc()
+    pg.bip85 = DummyBIP85()
+    pg.policy = PasswordPolicy(
+        min_uppercase=0, min_lowercase=0, min_digits=1, min_special=0
+    )
+
+    pm = PasswordManager.__new__(PasswordManager)
+    pm.encryption_mode = EncryptionMode.SEED_ONLY
+    pm.password_generator = pg
+    pm.entry_manager = entry_mgr
+    pm.parent_seed = TEST_SEED
+    pm.vault = vault
+    pm.backup_manager = backup_mgr
+    pm.nostr_client = SimpleNamespace()
+    pm.fingerprint_dir = tmp_path
+    pm.secret_mode_enabled = False
+    return pm
+
+
+def test_entry_policy_override_changes_password():
+    with TemporaryDirectory() as tmpdir:
+        tmp_path = Path(tmpdir)
+        pm = make_manager(tmp_path)
+        idx = pm.entry_manager.add_entry(
+            "site",
+            16,
+            min_digits=5,
+            include_special_chars=False,
+        )
+        entry = pm.entry_manager.retrieve_entry(idx)
+        pw = pm._generate_password_for_entry(entry, idx)
+        assert sum(c.isdigit() for c in pw) >= 5
+        assert not any(c in string.punctuation for c in pw)

From b57e19b65738a6aec84e345dd529b50f73761ba4 Mon Sep 17 00:00:00 2001
From: thePR0M3TH3AN <53631862+PR0M3TH3AN@users.noreply.github.com>
Date: Wed, 30 Jul 2025 20:22:53 -0400
Subject: [PATCH 13/33] feat: extend password options

---
 src/seedpass/cli.py                      | 87 +++++++++++++++++++++++-
 src/seedpass/core/api.py                 | 83 ++++++++++++++++++++--
 src/tests/test_cli_entry_add_commands.py | 25 ++++++-
 src/tests/test_typer_cli.py              | 75 ++++++++++++++++++--
 4 files changed, 255 insertions(+), 15 deletions(-)

diff --git a/src/seedpass/cli.py b/src/seedpass/cli.py
index 4ab377d..b989905 100644
--- a/src/seedpass/cli.py
+++ b/src/seedpass/cli.py
@@ -209,10 +209,49 @@ def entry_add(
     length: int = typer.Option(12, "--length"),
     username: Optional[str] = typer.Option(None, "--username"),
     url: Optional[str] = typer.Option(None, "--url"),
+    no_special: bool = typer.Option(
+        False, "--no-special", help="Exclude special characters", is_flag=True
+    ),
+    allowed_special_chars: Optional[str] = typer.Option(
+        None, "--allowed-special-chars", help="Explicit set of special characters"
+    ),
+    special_mode: Optional[str] = typer.Option(
+        None,
+        "--special-mode",
+        help="Special character mode",
+    ),
+    exclude_ambiguous: bool = typer.Option(
+        False,
+        "--exclude-ambiguous",
+        help="Exclude ambiguous characters",
+        is_flag=True,
+    ),
+    min_uppercase: Optional[int] = typer.Option(None, "--min-uppercase"),
+    min_lowercase: Optional[int] = typer.Option(None, "--min-lowercase"),
+    min_digits: Optional[int] = typer.Option(None, "--min-digits"),
+    min_special: Optional[int] = typer.Option(None, "--min-special"),
 ) -> None:
     """Add a new password entry and output its index."""
     service = _get_entry_service(ctx)
-    index = service.add_entry(label, length, username, url)
+    kwargs = {}
+    if no_special:
+        kwargs["include_special_chars"] = False
+    if allowed_special_chars is not None:
+        kwargs["allowed_special_chars"] = allowed_special_chars
+    if special_mode is not None:
+        kwargs["special_mode"] = special_mode
+    if exclude_ambiguous:
+        kwargs["exclude_ambiguous"] = True
+    if min_uppercase is not None:
+        kwargs["min_uppercase"] = min_uppercase
+    if min_lowercase is not None:
+        kwargs["min_lowercase"] = min_lowercase
+    if min_digits is not None:
+        kwargs["min_digits"] = min_digits
+    if min_special is not None:
+        kwargs["min_special"] = min_special
+
+    index = service.add_entry(label, length, username, url, **kwargs)
     typer.echo(str(index))
 
 
@@ -708,10 +747,52 @@ def fingerprint_switch(ctx: typer.Context, fingerprint: str) -> None:
 
 
 @util_app.command("generate-password")
-def generate_password(ctx: typer.Context, length: int = 24) -> None:
+def generate_password(
+    ctx: typer.Context,
+    length: int = 24,
+    no_special: bool = typer.Option(
+        False, "--no-special", help="Exclude special characters", is_flag=True
+    ),
+    allowed_special_chars: Optional[str] = typer.Option(
+        None, "--allowed-special-chars", help="Explicit set of special characters"
+    ),
+    special_mode: Optional[str] = typer.Option(
+        None,
+        "--special-mode",
+        help="Special character mode",
+    ),
+    exclude_ambiguous: bool = typer.Option(
+        False,
+        "--exclude-ambiguous",
+        help="Exclude ambiguous characters",
+        is_flag=True,
+    ),
+    min_uppercase: Optional[int] = typer.Option(None, "--min-uppercase"),
+    min_lowercase: Optional[int] = typer.Option(None, "--min-lowercase"),
+    min_digits: Optional[int] = typer.Option(None, "--min-digits"),
+    min_special: Optional[int] = typer.Option(None, "--min-special"),
+) -> None:
     """Generate a strong password."""
     service = _get_util_service(ctx)
-    password = service.generate_password(length)
+    kwargs = {}
+    if no_special:
+        kwargs["include_special_chars"] = False
+    if allowed_special_chars is not None:
+        kwargs["allowed_special_chars"] = allowed_special_chars
+    if special_mode is not None:
+        kwargs["special_mode"] = special_mode
+    if exclude_ambiguous:
+        kwargs["exclude_ambiguous"] = True
+    if min_uppercase is not None:
+        kwargs["min_uppercase"] = min_uppercase
+    if min_lowercase is not None:
+        kwargs["min_lowercase"] = min_lowercase
+    if min_digits is not None:
+        kwargs["min_digits"] = min_digits
+    if min_special is not None:
+        kwargs["min_special"] = min_special
+
+    password = service.generate_password(length, **kwargs)
     typer.echo(password)
 
 
diff --git a/src/seedpass/core/api.py b/src/seedpass/core/api.py
index 04c5837..5fa4ae8 100644
--- a/src/seedpass/core/api.py
+++ b/src/seedpass/core/api.py
@@ -9,7 +9,8 @@ allow easy validation and documentation.
 
 from pathlib import Path
 from threading import Lock
-from typing import List, Optional, Dict
+from typing import List, Optional, Dict, Any
+import dataclasses
 import json
 
 from pydantic import BaseModel
@@ -283,9 +284,42 @@ class EntryService:
         length: int,
         username: str | None = None,
         url: str | None = None,
+        *,
+        include_special_chars: bool | None = None,
+        allowed_special_chars: str | None = None,
+        special_mode: str | None = None,
+        exclude_ambiguous: bool | None = None,
+        min_uppercase: int | None = None,
+        min_lowercase: int | None = None,
+        min_digits: int | None = None,
+        min_special: int | None = None,
     ) -> int:
         with self._lock:
-            idx = self._manager.entry_manager.add_entry(label, length, username, url)
+            kwargs: dict[str, Any] = {}
+            if include_special_chars is not None:
+                kwargs["include_special_chars"] = include_special_chars
+            if allowed_special_chars is not None:
+                kwargs["allowed_special_chars"] = allowed_special_chars
+            if special_mode is not None:
+                kwargs["special_mode"] = special_mode
+            if exclude_ambiguous is not None:
+                kwargs["exclude_ambiguous"] = exclude_ambiguous
+            if min_uppercase is not None:
+                kwargs["min_uppercase"] = min_uppercase
+            if min_lowercase is not None:
+                kwargs["min_lowercase"] = min_lowercase
+            if min_digits is not None:
+                kwargs["min_digits"] = min_digits
+            if min_special is not None:
+                kwargs["min_special"] = min_special
+
+            idx = self._manager.entry_manager.add_entry(
+                label,
+                length,
+                username,
+                url,
+                **kwargs,
+            )
             self._manager.start_background_vault_sync()
             return idx
 
@@ -557,9 +591,50 @@ class UtilityService:
         self._manager = manager
         self._lock = Lock()
 
-    def generate_password(self, length: int) -> str:
+    def generate_password(
+        self,
+        length: int,
+        *,
+        include_special_chars: bool | None = None,
+        allowed_special_chars: str | None = None,
+        special_mode: str | None = None,
+        exclude_ambiguous: bool | None = None,
+        min_uppercase: int | None = None,
+        min_lowercase: int | None = None,
+        min_digits: int | None = None,
+        min_special: int | None = None,
+    ) -> str:
         with self._lock:
-            return self._manager.password_generator.generate_password(length)
+            pg = self._manager.password_generator
+            base_policy = getattr(pg, "policy", None)
+            overrides: dict[str, Any] = {}
+            if include_special_chars is not None:
+                overrides["include_special_chars"] = include_special_chars
+            if allowed_special_chars is not None:
+                overrides["allowed_special_chars"] = allowed_special_chars
+            if special_mode is not None:
+                overrides["special_mode"] = special_mode
+            if exclude_ambiguous is not None:
+                overrides["exclude_ambiguous"] = exclude_ambiguous
+            if min_uppercase is not None:
+                overrides["min_uppercase"] = int(min_uppercase)
+            if min_lowercase is not None:
+                overrides["min_lowercase"] = int(min_lowercase)
+            if min_digits is not None:
+                overrides["min_digits"] = int(min_digits)
+            if min_special is not None:
+                overrides["min_special"] = int(min_special)
+
+            if base_policy is not None and overrides:
+                pg.policy = dataclasses.replace(
+                    base_policy,
+                    **{k: overrides[k] for k in overrides if hasattr(base_policy, k)},
+                )
+                try:
+                    return pg.generate_password(length)
+                finally:
+                    pg.policy = base_policy
+            return pg.generate_password(length)
 
     def verify_checksum(self) -> None:
         with self._lock:
diff --git a/src/tests/test_cli_entry_add_commands.py b/src/tests/test_cli_entry_add_commands.py
index 53d2345..ab230b4 100644
--- a/src/tests/test_cli_entry_add_commands.py
+++ b/src/tests/test_cli_entry_add_commands.py
@@ -22,9 +22,32 @@ runner = CliRunner()
                 "user",
                 "--url",
                 "https://example.com",
+                "--no-special",
+                "--allowed-special-chars",
+                "!@",
+                "--special-mode",
+                "safe",
+                "--exclude-ambiguous",
+                "--min-uppercase",
+                "1",
+                "--min-lowercase",
+                "2",
+                "--min-digits",
+                "3",
+                "--min-special",
+                "4",
             ],
             ("Label", 16, "user", "https://example.com"),
-            {},
+            {
+                "include_special_chars": False,
+                "allowed_special_chars": "!@",
+                "special_mode": "safe",
+                "exclude_ambiguous": True,
+                "min_uppercase": 1,
+                "min_lowercase": 2,
+                "min_digits": 3,
+                "min_special": 4,
+            },
             "1",
         ),
         (
diff --git a/src/tests/test_typer_cli.py b/src/tests/test_typer_cli.py
index c9d0dab..0587d9a 100644
--- a/src/tests/test_typer_cli.py
+++ b/src/tests/test_typer_cli.py
@@ -321,18 +321,54 @@ def test_nostr_sync(monkeypatch):
 def test_generate_password(monkeypatch):
     called = {}
 
-    def gen_pw(length):
+    def gen_pw(length, **kwargs):
         called["length"] = length
+        called["kwargs"] = kwargs
         return "secretpw"
 
-    pm = SimpleNamespace(
-        password_generator=SimpleNamespace(generate_password=gen_pw),
-        select_fingerprint=lambda fp: None,
+    monkeypatch.setattr(
+        cli,
+        "PasswordManager",
+        lambda: SimpleNamespace(select_fingerprint=lambda fp: None),
+    )
+    monkeypatch.setattr(
+        cli, "UtilityService", lambda pm: SimpleNamespace(generate_password=gen_pw)
+    )
+    result = runner.invoke(
+        app,
+        [
+            "util",
+            "generate-password",
+            "--length",
+            "12",
+            "--no-special",
+            "--allowed-special-chars",
+            "!@",
+            "--special-mode",
+            "safe",
+            "--exclude-ambiguous",
+            "--min-uppercase",
+            "1",
+            "--min-lowercase",
+            "2",
+            "--min-digits",
+            "3",
+            "--min-special",
+            "4",
+        ],
     )
-    monkeypatch.setattr(cli, "PasswordManager", lambda: pm)
-    result = runner.invoke(app, ["util", "generate-password", "--length", "12"])
     assert result.exit_code == 0
     assert called.get("length") == 12
+    assert called.get("kwargs") == {
+        "include_special_chars": False,
+        "allowed_special_chars": "!@",
+        "special_mode": "safe",
+        "exclude_ambiguous": True,
+        "min_uppercase": 1,
+        "min_lowercase": 2,
+        "min_digits": 3,
+        "min_special": 4,
+    }
     assert "secretpw" in result.stdout
 
 
@@ -370,8 +406,9 @@ def test_entry_list_passes_fingerprint(monkeypatch):
 def test_entry_add(monkeypatch):
     called = {}
 
-    def add_entry(label, length, username=None, url=None):
+    def add_entry(label, length, username=None, url=None, **kwargs):
         called["args"] = (label, length, username, url)
+        called["kwargs"] = kwargs
         return 2
 
     pm = SimpleNamespace(
@@ -392,11 +429,35 @@ def test_entry_add(monkeypatch):
             "bob",
             "--url",
             "ex.com",
+            "--no-special",
+            "--allowed-special-chars",
+            "!@",
+            "--special-mode",
+            "safe",
+            "--exclude-ambiguous",
+            "--min-uppercase",
+            "1",
+            "--min-lowercase",
+            "2",
+            "--min-digits",
+            "3",
+            "--min-special",
+            "4",
         ],
     )
     assert result.exit_code == 0
     assert "2" in result.stdout
     assert called["args"] == ("Example", 16, "bob", "ex.com")
+    assert called["kwargs"] == {
+        "include_special_chars": False,
+        "allowed_special_chars": "!@",
+        "special_mode": "safe",
+        "exclude_ambiguous": True,
+        "min_uppercase": 1,
+        "min_lowercase": 2,
+        "min_digits": 3,
+        "min_special": 4,
+    }
 
 
 def test_entry_modify(monkeypatch):

From b74c0993ca76c435c391bd2061855339bca184cd Mon Sep 17 00:00:00 2001
From: thePR0M3TH3AN <53631862+PR0M3TH3AN@users.noreply.github.com>
Date: Wed, 30 Jul 2025 20:55:56 -0400
Subject: [PATCH 14/33] Prompt for per-entry password policy

---
 .../01-getting-started/01-advanced_cli.md     |  2 +-
 src/seedpass/core/manager.py                  | 62 +++++++++++++++++++
 src/tests/test_manager_add_password.py        | 16 +++++
 src/tests/test_manager_workflow.py            |  8 +++
 4 files changed, 87 insertions(+), 1 deletion(-)

diff --git a/docs/docs/content/01-getting-started/01-advanced_cli.md b/docs/docs/content/01-getting-started/01-advanced_cli.md
index 0b5279c..ce3fb7a 100644
--- a/docs/docs/content/01-getting-started/01-advanced_cli.md
+++ b/docs/docs/content/01-getting-started/01-advanced_cli.md
@@ -223,5 +223,5 @@ Shut down the server with `seedpass api stop`.
 - Use the `--help` flag for details on any command.
 - Set a strong master password and regularly export encrypted backups.
 - Adjust configuration values like `kdf_iterations`, `backup_interval`, `inactivity_timeout`, `secret_mode_enabled`, `nostr_max_retries`, `nostr_retry_delay`, or `quick_unlock` through the `config` commands.
-- Customize password complexity with `config set min_uppercase 3`, `config set min_digits 4`, and similar commands.
+- Customize the global password policy with commands like `config set min_uppercase 3`. When adding a password interactively you can override these values, choose a safe special-character set, and exclude ambiguous characters.
 - `entry get` is script‑friendly and can be piped into other commands.
diff --git a/src/seedpass/core/manager.py b/src/seedpass/core/manager.py
index dc61107..b139966 100644
--- a/src/seedpass/core/manager.py
+++ b/src/seedpass/core/manager.py
@@ -1441,6 +1441,60 @@ class PasswordManager:
                     )
                     return
 
+            include_special_input = (
+                input("Include special characters? (Y/n): ").strip().lower()
+            )
+            include_special_chars: bool | None = None
+            if include_special_input:
+                include_special_chars = include_special_input != "n"
+
+            allowed_special_chars = input(
+                "Allowed special characters (leave blank for default): "
+            ).strip()
+            if not allowed_special_chars:
+                allowed_special_chars = None
+
+            special_mode = input("Special character mode (safe/leave blank): ").strip()
+            if not special_mode:
+                special_mode = None
+
+            exclude_ambiguous_input = (
+                input("Exclude ambiguous characters? (y/N): ").strip().lower()
+            )
+            exclude_ambiguous: bool | None = None
+            if exclude_ambiguous_input:
+                exclude_ambiguous = exclude_ambiguous_input == "y"
+
+            min_uppercase_input = input(
+                "Minimum uppercase letters (blank for default): "
+            ).strip()
+            if min_uppercase_input and not min_uppercase_input.isdigit():
+                print(colored("Error: Minimum uppercase must be a number.", "red"))
+                return
+            min_uppercase = int(min_uppercase_input) if min_uppercase_input else None
+
+            min_lowercase_input = input(
+                "Minimum lowercase letters (blank for default): "
+            ).strip()
+            if min_lowercase_input and not min_lowercase_input.isdigit():
+                print(colored("Error: Minimum lowercase must be a number.", "red"))
+                return
+            min_lowercase = int(min_lowercase_input) if min_lowercase_input else None
+
+            min_digits_input = input("Minimum digits (blank for default): ").strip()
+            if min_digits_input and not min_digits_input.isdigit():
+                print(colored("Error: Minimum digits must be a number.", "red"))
+                return
+            min_digits = int(min_digits_input) if min_digits_input else None
+
+            min_special_input = input(
+                "Minimum special characters (blank for default): "
+            ).strip()
+            if min_special_input and not min_special_input.isdigit():
+                print(colored("Error: Minimum special must be a number.", "red"))
+                return
+            min_special = int(min_special_input) if min_special_input else None
+
             # Add the entry to the index and get the assigned index
             index = self.entry_manager.add_entry(
                 website_name,
@@ -1451,6 +1505,14 @@ class PasswordManager:
                 notes=notes,
                 custom_fields=custom_fields,
                 tags=tags,
+                include_special_chars=include_special_chars,
+                allowed_special_chars=allowed_special_chars,
+                special_mode=special_mode,
+                exclude_ambiguous=exclude_ambiguous,
+                min_uppercase=min_uppercase,
+                min_lowercase=min_lowercase,
+                min_digits=min_digits,
+                min_special=min_special,
             )
 
             # Mark database as dirty for background sync
diff --git a/src/tests/test_manager_add_password.py b/src/tests/test_manager_add_password.py
index 3579f48..7e9f8f1 100644
--- a/src/tests/test_manager_add_password.py
+++ b/src/tests/test_manager_add_password.py
@@ -52,6 +52,14 @@ def test_handle_add_password(monkeypatch, dummy_nostr_client, capsys):
                 "",  # tags
                 "n",  # add custom field
                 "",  # length (default)
+                "",  # include special default
+                "",  # allowed special default
+                "",  # special mode default
+                "",  # exclude ambiguous default
+                "",  # min uppercase
+                "",  # min lowercase
+                "",  # min digits
+                "",  # min special
             ]
         )
         monkeypatch.setattr("builtins.input", lambda *a, **k: next(inputs))
@@ -113,6 +121,14 @@ def test_handle_add_password_secret_mode(monkeypatch, dummy_nostr_client, capsys
                 "",  # tags
                 "n",  # add custom field
                 "",  # length (default)
+                "",  # include special default
+                "",  # allowed special default
+                "",  # special mode default
+                "",  # exclude ambiguous default
+                "",  # min uppercase
+                "",  # min lowercase
+                "",  # min digits
+                "",  # min special
             ]
         )
         monkeypatch.setattr("builtins.input", lambda *a, **k: next(inputs))
diff --git a/src/tests/test_manager_workflow.py b/src/tests/test_manager_workflow.py
index 99bea0a..b2a7a54 100644
--- a/src/tests/test_manager_workflow.py
+++ b/src/tests/test_manager_workflow.py
@@ -57,6 +57,14 @@ def test_manager_workflow(monkeypatch):
                 "",  # tags
                 "n",  # add custom field
                 "",  # length (default)
+                "",  # include special default
+                "",  # allowed special default
+                "",  # special mode default
+                "",  # exclude ambiguous default
+                "",  # min uppercase
+                "",  # min lowercase
+                "",  # min digits
+                "",  # min special
                 "0",  # retrieve index
                 "",  # no action in entry menu
                 "0",  # modify index

From 6d6a284096b7f4351d4565ef3d69ac2f01ad5777 Mon Sep 17 00:00:00 2001
From: thePR0M3TH3AN <53631862+PR0M3TH3AN@users.noreply.github.com>
Date: Wed, 30 Jul 2025 21:23:18 -0400
Subject: [PATCH 15/33] Add password policy options to API

---
 src/seedpass/api.py                 | 37 ++++++++++++++++++++
 src/seedpass/core/api.py            | 28 +++++++++++++++
 src/tests/test_api_new_endpoints.py | 54 +++++++++++++++++++++++++++++
 3 files changed, 119 insertions(+)

diff --git a/src/seedpass/api.py b/src/seedpass/api.py
index a0a729d..095427f 100644
--- a/src/seedpass/api.py
+++ b/src/seedpass/api.py
@@ -16,6 +16,7 @@ from fastapi.middleware.cors import CORSMiddleware
 
 from seedpass.core.manager import PasswordManager
 from seedpass.core.entry_types import EntryType
+from seedpass.core.api import UtilityService
 
 
 app = FastAPI()
@@ -117,11 +118,23 @@ def create_entry(
     etype = (entry.get("type") or entry.get("kind") or "password").lower()
 
     if etype == "password":
+        policy_keys = [
+            "include_special_chars",
+            "allowed_special_chars",
+            "special_mode",
+            "exclude_ambiguous",
+            "min_uppercase",
+            "min_lowercase",
+            "min_digits",
+            "min_special",
+        ]
+        kwargs = {k: entry.get(k) for k in policy_keys if entry.get(k) is not None}
         index = _pm.entry_manager.add_entry(
             entry.get("label"),
             int(entry.get("length", 12)),
             entry.get("username"),
             entry.get("url"),
+            **kwargs,
         )
         return {"id": index}
 
@@ -566,6 +579,30 @@ def change_password(
     return {"status": "ok"}
 
 
+@app.post("/api/v1/password")
+def generate_password(
+    data: dict, authorization: str | None = Header(None)
+) -> dict[str, str]:
+    """Generate a password using optional policy overrides."""
+    _check_token(authorization)
+    assert _pm is not None
+    length = int(data.get("length", 12))
+    policy_keys = [
+        "include_special_chars",
+        "allowed_special_chars",
+        "special_mode",
+        "exclude_ambiguous",
+        "min_uppercase",
+        "min_lowercase",
+        "min_digits",
+        "min_special",
+    ]
+    kwargs = {k: data.get(k) for k in policy_keys if data.get(k) is not None}
+    util = UtilityService(_pm)
+    password = util.generate_password(length, **kwargs)
+    return {"password": password}
+
+
 @app.post("/api/v1/vault/lock")
 def lock_vault(authorization: str | None = Header(None)) -> dict[str, str]:
     """Lock the vault and clear sensitive data from memory."""
diff --git a/src/seedpass/core/api.py b/src/seedpass/core/api.py
index 5fa4ae8..2479896 100644
--- a/src/seedpass/core/api.py
+++ b/src/seedpass/core/api.py
@@ -84,6 +84,34 @@ class SyncResponse(BaseModel):
     delta_ids: List[str] = []
 
 
+class PasswordPolicyOptions(BaseModel):
+    """Optional password policy overrides."""
+
+    include_special_chars: bool | None = None
+    allowed_special_chars: str | None = None
+    special_mode: str | None = None
+    exclude_ambiguous: bool | None = None
+    min_uppercase: int | None = None
+    min_lowercase: int | None = None
+    min_digits: int | None = None
+    min_special: int | None = None
+
+
+class AddPasswordEntryRequest(PasswordPolicyOptions):
+    label: str
+    length: int
+    username: str | None = None
+    url: str | None = None
+
+
+class GeneratePasswordRequest(PasswordPolicyOptions):
+    length: int
+
+
+class GeneratePasswordResponse(BaseModel):
+    password: str
+
+
 class VaultService:
     """Thread-safe wrapper around vault operations."""
 
diff --git a/src/tests/test_api_new_endpoints.py b/src/tests/test_api_new_endpoints.py
index 337a724..853a644 100644
--- a/src/tests/test_api_new_endpoints.py
+++ b/src/tests/test_api_new_endpoints.py
@@ -5,6 +5,8 @@ import pytest
 from seedpass import api
 from test_api import client
 from helpers import dummy_nostr_client
+import string
+from seedpass.core.password_generation import PasswordGenerator, PasswordPolicy
 from nostr.client import NostrClient, DEFAULT_RELAYS
 
 
@@ -401,3 +403,55 @@ def test_relay_management_endpoints(client, dummy_nostr_client, monkeypatch):
     assert res.status_code == 200
     assert called.get("init") is True
     assert api._pm.nostr_client.relays == list(DEFAULT_RELAYS)
+
+
+def test_generate_password_no_special_chars(client):
+    cl, token = client
+
+    class DummyEnc:
+        def derive_seed_from_mnemonic(self, mnemonic):
+            return b"\x00" * 32
+
+    class DummyBIP85:
+        def derive_entropy(self, index: int, bytes_len: int, app_no: int = 32) -> bytes:
+            return bytes(range(bytes_len))
+
+    api._pm.password_generator = PasswordGenerator(DummyEnc(), "seed", DummyBIP85())
+    api._pm.parent_seed = "seed"
+
+    headers = {"Authorization": f"Bearer {token}"}
+    res = cl.post(
+        "/api/v1/password",
+        json={"length": 16, "include_special_chars": False},
+        headers=headers,
+    )
+    assert res.status_code == 200
+    pw = res.json()["password"]
+    assert not any(c in string.punctuation for c in pw)
+
+
+def test_generate_password_allowed_chars(client):
+    cl, token = client
+
+    class DummyEnc:
+        def derive_seed_from_mnemonic(self, mnemonic):
+            return b"\x00" * 32
+
+    class DummyBIP85:
+        def derive_entropy(self, index: int, bytes_len: int, app_no: int = 32) -> bytes:
+            return bytes((index + i) % 256 for i in range(bytes_len))
+
+    api._pm.password_generator = PasswordGenerator(DummyEnc(), "seed", DummyBIP85())
+    api._pm.parent_seed = "seed"
+
+    headers = {"Authorization": f"Bearer {token}"}
+    allowed = "@$"
+    res = cl.post(
+        "/api/v1/password",
+        json={"length": 16, "allowed_special_chars": allowed},
+        headers=headers,
+    )
+    assert res.status_code == 200
+    pw = res.json()["password"]
+    specials = [c for c in pw if c in string.punctuation]
+    assert specials and all(c in allowed for c in specials)

From d3bd3b9e0a6e3724a41d361debd369e06483a43d Mon Sep 17 00:00:00 2001
From: thePR0M3TH3AN <53631862+PR0M3TH3AN@users.noreply.github.com>
Date: Wed, 30 Jul 2025 22:08:04 -0400
Subject: [PATCH 16/33] docs: document new password policy flags

---
 README.md                                     |  2 ++
 .../01-getting-started/01-advanced_cli.md     | 10 ++++-----
 .../01-getting-started/03-json_entries.md     | 22 +++++++++++++++++++
 src/tests/test_cli_doc_examples.py            |  2 +-
 4 files changed, 30 insertions(+), 6 deletions(-)

diff --git a/README.md b/README.md
index 7ce92b9..79c07b5 100644
--- a/README.md
+++ b/README.md
@@ -239,6 +239,8 @@ seedpass entry get "email"
 # Sort or filter the list view
 seedpass list --sort label
 seedpass list --filter totp
+# Generate a password with the safe character set
+seedpass util generate-password --length 20 --special-mode safe --exclude-ambiguous
 
 # Use the **Settings** menu to configure an extra backup directory
 # on an external drive.
diff --git a/docs/docs/content/01-getting-started/01-advanced_cli.md b/docs/docs/content/01-getting-started/01-advanced_cli.md
index ce3fb7a..c9686e9 100644
--- a/docs/docs/content/01-getting-started/01-advanced_cli.md
+++ b/docs/docs/content/01-getting-started/01-advanced_cli.md
@@ -49,7 +49,7 @@ Manage individual entries within a vault.
 | List entries | `entry list` | `seedpass entry list --sort label` |
 | Search for entries | `entry search` | `seedpass entry search "GitHub"` |
 | Retrieve an entry's secret (password or TOTP code) | `entry get` | `seedpass entry get "GitHub"` |
-| Add a password entry | `entry add` | `seedpass entry add Example --length 16` |
+| Add a password entry | `entry add` | `seedpass entry add Example --length 16 --no-special --exclude-ambiguous` |
 | Add a TOTP entry | `entry add-totp` | `seedpass entry add-totp Email --secret JBSW...` |
 | Add an SSH key entry | `entry add-ssh` | `seedpass entry add-ssh Server --index 0` |
 | Add a PGP key entry | `entry add-pgp` | `seedpass entry add-pgp Personal --user-id me@example.com` |
@@ -112,7 +112,7 @@ Miscellaneous helper commands.
 
 | Action | Command | Examples |
 | :--- | :--- | :--- |
-| Generate a password | `util generate-password` | `seedpass util generate-password --length 24` |
+| Generate a password | `util generate-password` | `seedpass util generate-password --length 24 --special-mode safe --exclude-ambiguous` |
 | Verify script checksum | `util verify-checksum` | `seedpass util verify-checksum` |
 | Update script checksum | `util update-checksum` | `seedpass util update-checksum` |
 
@@ -138,7 +138,7 @@ Run or stop the local HTTP API.
 - **`seedpass entry list`** – List entries in the vault, optionally sorted or filtered.
 - **`seedpass entry search <query>`** – Search across labels, usernames, URLs and notes.
 - **`seedpass entry get <query>`** – Retrieve the password or TOTP code for one matching entry, depending on the entry's type.
-- **`seedpass entry add <label>`** – Create a new password entry. Use `--length` to set the password length and optional `--username`/`--url` values.
+- **`seedpass entry add <label>`** – Create a new password entry. Use `--length` and flags like `--no-special`, `--special-mode safe`, or `--exclude-ambiguous` to override the global policy.
 - **`seedpass entry add-totp <label>`** – Create a TOTP entry. Use `--secret` to import an existing secret or `--index` to derive from the seed.
 - **`seedpass entry add-ssh <label>`** – Create an SSH key entry derived from the seed.
 - **`seedpass entry add-pgp <label>`** – Create a PGP key entry. Provide `--user-id` and `--key-type` as needed.
@@ -185,7 +185,7 @@ QR codes for supported types.
 ### `config` Commands
 
 - **`seedpass config get <key>`** – Retrieve a configuration value such as `kdf_iterations`, `backup_interval`, `inactivity_timeout`, `secret_mode_enabled`, `clipboard_clear_delay`, `additional_backup_path`, `relays`, `quick_unlock`, `nostr_max_retries`, `nostr_retry_delay`, or password policy fields like `min_uppercase`.
-- **`seedpass config set <key> <value>`** – Update a configuration option. Example: `seedpass config set kdf_iterations 200000`. Use keys like `min_uppercase`, `min_lowercase`, `min_digits`, `min_special`, `nostr_max_retries`, `nostr_retry_delay`, or `quick_unlock` to adjust settings.
+- **`seedpass config set <key> <value>`** – Update a configuration option. Example: `seedpass config set kdf_iterations 200000`. Use keys like `min_uppercase`, `min_lowercase`, `min_digits`, `min_special`, `include_special_chars`, `allowed_special_chars`, `special_mode`, `exclude_ambiguous`, `nostr_max_retries`, `nostr_retry_delay`, or `quick_unlock` to adjust settings.
 - **`seedpass config toggle-secret-mode`** – Interactively enable or disable Secret Mode and set the clipboard delay.
 - **`seedpass config toggle-offline`** – Enable or disable offline mode to skip Nostr operations.
 
@@ -223,5 +223,5 @@ Shut down the server with `seedpass api stop`.
 - Use the `--help` flag for details on any command.
 - Set a strong master password and regularly export encrypted backups.
 - Adjust configuration values like `kdf_iterations`, `backup_interval`, `inactivity_timeout`, `secret_mode_enabled`, `nostr_max_retries`, `nostr_retry_delay`, or `quick_unlock` through the `config` commands.
-- Customize the global password policy with commands like `config set min_uppercase 3`. When adding a password interactively you can override these values, choose a safe special-character set, and exclude ambiguous characters.
+- Customize the global password policy with commands like `config set min_uppercase 3` or `config set special_mode safe`. When adding a password interactively you can override these values, choose a safe special-character set, and exclude ambiguous characters.
 - `entry get` is script‑friendly and can be piped into other commands.
diff --git a/docs/docs/content/01-getting-started/03-json_entries.md b/docs/docs/content/01-getting-started/03-json_entries.md
index 3551932..720505b 100644
--- a/docs/docs/content/01-getting-started/03-json_entries.md
+++ b/docs/docs/content/01-getting-started/03-json_entries.md
@@ -100,6 +100,17 @@ Each entry is stored within `seedpass_entries_db.json.enc` under the `entries` d
 - **word_count** (`integer`, managed_account only): Number of words in the child seed. Managed accounts always use `12`.
 - **fingerprint** (`string`, managed_account only): Identifier of the child profile, used for its directory name.
 - **tags** (`array`, optional): Category labels to aid in organization and search.
+
+#### Password Policy Fields
+
+- **min_uppercase** (`integer`, default `2`): Minimum required uppercase letters.
+- **min_lowercase** (`integer`, default `2`): Minimum required lowercase letters.
+- **min_digits** (`integer`, default `2`): Minimum required digits.
+- **min_special** (`integer`, default `2`): Minimum required special characters.
+- **include_special_chars** (`boolean`, default `true`): Enable or disable any punctuation in generated passwords.
+- **allowed_special_chars** (`string`, optional): Restrict punctuation to this exact set.
+- **special_mode** (`string`, default `"standard"`): Choose `"safe"` for the `!@#$%^*-_+=?` set, otherwise the full `string.punctuation` is used.
+- **exclude_ambiguous** (`boolean`, default `false`): Omit confusing characters like `O0Il1`.
   Example:
 
   ```json
@@ -161,6 +172,17 @@ Each entry is stored within `seedpass_entries_db.json.enc` under the `entries` d
 }
 ```
 
+#### Password Entry with Policy Overrides
+
+```json
+{
+  "label": "Custom Policy",
+  "length": 16,
+  "include_special_chars": false,
+  "exclude_ambiguous": true
+}
+```
+
 #### 3. Managed User
 
 ```json
diff --git a/src/tests/test_cli_doc_examples.py b/src/tests/test_cli_doc_examples.py
index 63b6794..ee553a6 100644
--- a/src/tests/test_cli_doc_examples.py
+++ b/src/tests/test_cli_doc_examples.py
@@ -20,7 +20,7 @@ class DummyPM:
             search_entries=lambda q, kinds=None: [(1, "GitHub", "user", "", False)],
             retrieve_entry=lambda idx: {"type": EntryType.PASSWORD.value, "length": 8},
             get_totp_code=lambda idx, seed: "123456",
-            add_entry=lambda label, length, username, url: 1,
+            add_entry=lambda label, length, username, url, **kwargs: 1,
             add_totp=lambda label, seed, index=None, secret=None, period=30, digits=6: "totp://",
             add_ssh_key=lambda label, seed, index=None, notes="": 2,
             add_pgp_key=lambda label, seed, index=None, key_type="ed25519", user_id="", notes="": 3,

From a7a2e703219e939936923ef2c03cb48a2b9b396f Mon Sep 17 00:00:00 2001
From: thePR0M3TH3AN <53631862+PR0M3TH3AN@users.noreply.github.com>
Date: Thu, 31 Jul 2025 08:37:42 -0400
Subject: [PATCH 17/33] Import safe special chars constant

---
 README.md                                              |  2 +-
 .../docs/content/01-getting-started/03-json_entries.md |  2 +-
 src/seedpass/core/password_generation.py               |  7 ++++++-
 src/tests/test_password_special_chars.py               | 10 ++++++++++
 4 files changed, 18 insertions(+), 3 deletions(-)

diff --git a/README.md b/README.md
index 79c07b5..69408b5 100644
--- a/README.md
+++ b/README.md
@@ -239,7 +239,7 @@ seedpass entry get "email"
 # Sort or filter the list view
 seedpass list --sort label
 seedpass list --filter totp
-# Generate a password with the safe character set
+# Generate a password with the safe character set defined by `SAFE_SPECIAL_CHARS`
 seedpass util generate-password --length 20 --special-mode safe --exclude-ambiguous
 
 # Use the **Settings** menu to configure an extra backup directory
diff --git a/docs/docs/content/01-getting-started/03-json_entries.md b/docs/docs/content/01-getting-started/03-json_entries.md
index 720505b..64b0bf3 100644
--- a/docs/docs/content/01-getting-started/03-json_entries.md
+++ b/docs/docs/content/01-getting-started/03-json_entries.md
@@ -109,7 +109,7 @@ Each entry is stored within `seedpass_entries_db.json.enc` under the `entries` d
 - **min_special** (`integer`, default `2`): Minimum required special characters.
 - **include_special_chars** (`boolean`, default `true`): Enable or disable any punctuation in generated passwords.
 - **allowed_special_chars** (`string`, optional): Restrict punctuation to this exact set.
-- **special_mode** (`string`, default `"standard"`): Choose `"safe"` for the `!@#$%^*-_+=?` set, otherwise the full `string.punctuation` is used.
+- **special_mode** (`string`, default `"standard"`): Choose `"safe"` for the `SAFE_SPECIAL_CHARS` set (`!@#$%^*-_+=?`), otherwise the full `string.punctuation` is used.
 - **exclude_ambiguous** (`boolean`, default `false`): Omit confusing characters like `O0Il1`.
   Example:
 
diff --git a/src/seedpass/core/password_generation.py b/src/seedpass/core/password_generation.py
index 61617b0..4044c5c 100644
--- a/src/seedpass/core/password_generation.py
+++ b/src/seedpass/core/password_generation.py
@@ -42,7 +42,12 @@ except ModuleNotFoundError:  # pragma: no cover - fallback for removed module
 
 from local_bip85.bip85 import BIP85
 
-from constants import DEFAULT_PASSWORD_LENGTH, MIN_PASSWORD_LENGTH, MAX_PASSWORD_LENGTH
+from constants import (
+    DEFAULT_PASSWORD_LENGTH,
+    MIN_PASSWORD_LENGTH,
+    MAX_PASSWORD_LENGTH,
+    SAFE_SPECIAL_CHARS,
+)
 from .encryption import EncryptionManager
 
 # Instantiate the logger
diff --git a/src/tests/test_password_special_chars.py b/src/tests/test_password_special_chars.py
index 707e156..38d6639 100644
--- a/src/tests/test_password_special_chars.py
+++ b/src/tests/test_password_special_chars.py
@@ -4,6 +4,8 @@ import sys
 
 sys.path.append(str(Path(__file__).resolve().parents[1]))
 
+from constants import SAFE_SPECIAL_CHARS
+
 from seedpass.core.password_generation import PasswordGenerator, PasswordPolicy
 
 
@@ -47,3 +49,11 @@ def test_exclude_ambiguous_chars():
     pw = pg.generate_password(length=32, index=2)
     for ch in "O0Il1":
         assert ch not in pw
+
+
+def test_safe_special_chars_mode():
+    policy = PasswordPolicy(special_mode="safe")
+    pg = make_generator(policy)
+    pw = pg.generate_password(length=32, index=3)
+    specials = [c for c in pw if c in string.punctuation]
+    assert specials and all(c in SAFE_SPECIAL_CHARS for c in specials)

From 05eae9bddd7c449aa5b10928abd773480449df06 Mon Sep 17 00:00:00 2001
From: thePR0M3TH3AN <53631862+PR0M3TH3AN@users.noreply.github.com>
Date: Thu, 31 Jul 2025 08:58:33 -0400
Subject: [PATCH 18/33] Add tests for password special character modes

---
 src/tests/test_password_special_modes.py | 62 ++++++++++++++++++++++++
 1 file changed, 62 insertions(+)
 create mode 100644 src/tests/test_password_special_modes.py

diff --git a/src/tests/test_password_special_modes.py b/src/tests/test_password_special_modes.py
new file mode 100644
index 0000000..50a4019
--- /dev/null
+++ b/src/tests/test_password_special_modes.py
@@ -0,0 +1,62 @@
+import string
+from pathlib import Path
+import sys
+
+sys.path.append(str(Path(__file__).resolve().parents[1]))
+
+from constants import SAFE_SPECIAL_CHARS
+from seedpass.core.password_generation import PasswordGenerator, PasswordPolicy
+
+
+class DummyEnc:
+    def derive_seed_from_mnemonic(self, mnemonic):
+        return b"\x00" * 32
+
+
+class DummyBIP85:
+    def derive_entropy(self, index: int, bytes_len: int, app_no: int = 32) -> bytes:
+        return bytes((index + i) % 256 for i in range(bytes_len))
+
+
+def make_generator(policy=None):
+    pg = PasswordGenerator.__new__(PasswordGenerator)
+    pg.encryption_manager = DummyEnc()
+    pg.bip85 = DummyBIP85()
+    pg.policy = policy or PasswordPolicy()
+    return pg
+
+
+def test_include_special_chars_false():
+    policy = PasswordPolicy(include_special_chars=False)
+    pg = make_generator(policy)
+    pw = pg.generate_password(length=32, index=0)
+    assert not any(c in string.punctuation for c in pw)
+
+
+def test_safe_mode_uses_safe_chars():
+    policy = PasswordPolicy(special_mode="safe")
+    pg = make_generator(policy)
+    pw = pg.generate_password(length=32, index=1)
+    specials = [c for c in pw if c in string.punctuation]
+    assert specials and all(c in SAFE_SPECIAL_CHARS for c in specials)
+
+
+def test_allowed_chars_override_special_mode():
+    allowed = "@#$"
+    policy = PasswordPolicy(special_mode="safe", allowed_special_chars=allowed)
+    pg = make_generator(policy)
+    pw = pg.generate_password(length=32, index=2)
+    specials = [c for c in pw if c in string.punctuation]
+    assert specials and all(c in allowed for c in specials)
+
+
+def test_enforce_complexity_min_special_zero():
+    policy = PasswordPolicy(min_special=0)
+    pg = make_generator(policy)
+    alphabet = string.ascii_letters + string.digits + string.punctuation
+    dk = bytes(range(32))
+    result = pg._enforce_complexity("a" * 32, alphabet, string.punctuation, dk)
+    assert len(result) == 32
+    assert sum(c.isupper() for c in result) >= 2
+    assert sum(c.islower() for c in result) >= 2
+    assert sum(c.isdigit() for c in result) >= 2

From 0a078bbcf444d6ce550cac9101b588aeb731cf87 Mon Sep 17 00:00:00 2001
From: thePR0M3TH3AN <53631862+PR0M3TH3AN@users.noreply.github.com>
Date: Thu, 31 Jul 2025 10:27:17 -0400
Subject: [PATCH 19/33] Show notes when viewing password entries

---
 src/seedpass/core/manager.py             |  8 ++++
 src/tests/test_password_notes_display.py | 52 ++++++++++++++++++++++++
 2 files changed, 60 insertions(+)
 create mode 100644 src/tests/test_password_notes_display.py

diff --git a/src/seedpass/core/manager.py b/src/seedpass/core/manager.py
index b139966..75bb66f 100644
--- a/src/seedpass/core/manager.py
+++ b/src/seedpass/core/manager.py
@@ -2767,6 +2767,8 @@ class PasswordManager:
                         "cyan",
                     )
                 )
+                if notes:
+                    print(colored(f"Notes: {notes}", "cyan"))
                 tags = entry.get("tags", [])
                 if tags:
                     print(colored(f"Tags: {', '.join(tags)}", "cyan"))
@@ -3387,9 +3389,15 @@ class PasswordManager:
             username = entry.get("username", "")
             url = entry.get("url", "")
             blacklisted = entry.get("archived", entry.get("blacklisted", False))
+            notes = entry.get("notes", "")
+            tags = entry.get("tags", [])
             print(color_text(f"  Label: {website}", "index"))
             print(color_text(f"  Username: {username or 'N/A'}", "index"))
             print(color_text(f"  URL: {url or 'N/A'}", "index"))
+            if notes:
+                print(color_text(f"  Notes: {notes}", "index"))
+            if tags:
+                print(color_text(f"  Tags: {', '.join(tags)}", "index"))
             print(
                 color_text(
                     f"  Archived: {'Yes' if blacklisted else 'No'}",
diff --git a/src/tests/test_password_notes_display.py b/src/tests/test_password_notes_display.py
new file mode 100644
index 0000000..f182d0a
--- /dev/null
+++ b/src/tests/test_password_notes_display.py
@@ -0,0 +1,52 @@
+import sys
+from pathlib import Path
+from tempfile import TemporaryDirectory
+from types import SimpleNamespace
+
+from helpers import create_vault, TEST_SEED, TEST_PASSWORD
+
+sys.path.append(str(Path(__file__).resolve().parents[1]))
+
+from seedpass.core.entry_management import EntryManager
+from seedpass.core.backup import BackupManager
+from seedpass.core.manager import PasswordManager, EncryptionMode
+from seedpass.core.config_manager import ConfigManager
+
+
+def test_password_notes_shown(monkeypatch, capsys):
+    with TemporaryDirectory() as tmpdir:
+        tmp_path = Path(tmpdir)
+        vault, enc_mgr = create_vault(tmp_path, TEST_SEED, TEST_PASSWORD)
+        cfg_mgr = ConfigManager(vault, tmp_path)
+        backup_mgr = BackupManager(tmp_path, cfg_mgr)
+        entry_mgr = EntryManager(vault, backup_mgr)
+
+        pm = PasswordManager.__new__(PasswordManager)
+        pm.encryption_mode = EncryptionMode.SEED_ONLY
+        pm.encryption_manager = enc_mgr
+        pm.vault = vault
+        pm.entry_manager = entry_mgr
+        pm.backup_manager = backup_mgr
+        pm.password_generator = SimpleNamespace(generate_password=lambda l, i: "pw")
+        pm.parent_seed = TEST_SEED
+        pm.nostr_client = SimpleNamespace()
+        pm.fingerprint_dir = tmp_path
+        pm.secret_mode_enabled = False
+
+        entry_mgr.add_entry("example.com", 8, notes="remember")
+
+        monkeypatch.setattr(
+            "seedpass.core.manager.clear_header_with_notification", lambda *a, **k: None
+        )
+        monkeypatch.setattr("seedpass.core.manager.pause", lambda *a, **k: None)
+        monkeypatch.setattr(pm, "_entry_actions_menu", lambda *a, **k: None)
+
+        pm.display_entry_details(0)
+        out = capsys.readouterr().out
+        assert "Notes: remember" in out
+
+        inputs = iter(["0", ""])
+        monkeypatch.setattr("builtins.input", lambda *a, **k: next(inputs))
+        pm.handle_retrieve_entry()
+        out = capsys.readouterr().out
+        assert "Notes: remember" in out

From 365a098d70560ef4e0b81b6da961b7aa9cdd26dc Mon Sep 17 00:00:00 2001
From: thePR0M3TH3AN <53631862+PR0M3TH3AN@users.noreply.github.com>
Date: Thu, 31 Jul 2025 12:21:59 -0400
Subject: [PATCH 20/33] Update Linux dependencies in install script

---
 scripts/install.sh | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/scripts/install.sh b/scripts/install.sh
index f6df808..0a86269 100755
--- a/scripts/install.sh
+++ b/scripts/install.sh
@@ -91,8 +91,10 @@ main() {
                 build-essential pkg-config xclip \
                 libcairo2 libcairo2-dev \
                 libgirepository-2.0-dev gir1.2-girepository-2.0 \
+                libgirepository1.0-dev \
                 gobject-introspection \
-                gir1.2-gtk-3.0 python3-dev
+                gir1.2-gtk-3.0 python3-dev \
+                libffi-dev libssl-dev
         elif command -v dnf &> /dev/null; then
             sudo dnf groupinstall -y "Development Tools" && sudo dnf install -y \
                 pkg-config cairo cairo-devel xclip \

From 78bf5a4c64faa52dd6cbdc61570b31706727a417 Mon Sep 17 00:00:00 2001
From: thePR0M3TH3AN <53631862+PR0M3TH3AN@users.noreply.github.com>
Date: Thu, 31 Jul 2025 13:06:12 -0400
Subject: [PATCH 21/33] Add SSH and managed account modify handling

---
 src/seedpass/core/manager.py                 | 110 ++++++++++++++++---
 src/tests/test_modify_ssh_managed_entries.py |  56 ++++++++++
 2 files changed, 150 insertions(+), 16 deletions(-)
 create mode 100644 src/tests/test_modify_ssh_managed_entries.py

diff --git a/src/seedpass/core/manager.py b/src/seedpass/core/manager.py
index 75bb66f..7f73cc5 100644
--- a/src/seedpass/core/manager.py
+++ b/src/seedpass/core/manager.py
@@ -2974,18 +2974,14 @@ class PasswordManager:
                     custom_fields=custom_fields,
                     tags=tags,
                 )
-            elif entry_type in (
-                EntryType.KEY_VALUE.value,
-                EntryType.MANAGED_ACCOUNT.value,
-            ):
+            elif entry_type == EntryType.SSH.value:
                 label = entry.get("label", "")
-                value = entry.get("value", "")
                 blacklisted = entry.get("archived", False)
                 notes = entry.get("notes", "")
 
                 print(
                     colored(
-                        f"Modifying key/value entry '{label}' (Index: {index}):",
+                        f"Modifying SSH key entry '{label}' (Index: {index}):",
                         "cyan",
                     )
                 )
@@ -2999,9 +2995,86 @@ class PasswordManager:
                     input(f'Enter new label (leave blank to keep "{label}"): ').strip()
                     or label
                 )
-                new_key = input(
-                    f'Enter new key (leave blank to keep "{entry.get("key", "")}"): '
-                ).strip() or entry.get("key", "")
+                blacklist_input = (
+                    input(
+                        f'Archive this entry? (Y/N, current: {"Y" if blacklisted else "N"}): '
+                    )
+                    .strip()
+                    .lower()
+                )
+                if blacklist_input == "":
+                    new_blacklisted = blacklisted
+                elif blacklist_input == "y":
+                    new_blacklisted = True
+                elif blacklist_input == "n":
+                    new_blacklisted = False
+                else:
+                    self.notify(
+                        "Invalid input for archived status. Keeping the current status.",
+                        level="WARNING",
+                    )
+                    new_blacklisted = blacklisted
+
+                new_notes = (
+                    input(
+                        f'Enter new notes (leave blank to keep "{notes or "N/A"}"): '
+                    ).strip()
+                    or notes
+                )
+
+                tags_input = input(
+                    "Enter tags (comma-separated, leave blank to keep current): "
+                ).strip()
+                tags = (
+                    [t.strip() for t in tags_input.split(",") if t.strip()]
+                    if tags_input
+                    else None
+                )
+
+                self.entry_manager.modify_entry(
+                    index,
+                    archived=new_blacklisted,
+                    notes=new_notes,
+                    label=new_label,
+                    tags=tags,
+                )
+            elif entry_type in (
+                EntryType.KEY_VALUE.value,
+                EntryType.MANAGED_ACCOUNT.value,
+            ):
+                label = entry.get("label", "")
+                value = entry.get("value", "")
+                blacklisted = entry.get("archived", False)
+                notes = entry.get("notes", "")
+
+                entry_label = (
+                    "key/value entry"
+                    if entry_type == EntryType.KEY_VALUE.value
+                    else "managed account"
+                )
+
+                print(
+                    colored(
+                        f"Modifying {entry_label} '{label}' (Index: {index}):",
+                        "cyan",
+                    )
+                )
+                print(
+                    colored(
+                        f"Current Archived Status: {'Archived' if blacklisted else 'Active'}",
+                        "cyan",
+                    )
+                )
+                new_label = (
+                    input(f'Enter new label (leave blank to keep "{label}"): ').strip()
+                    or label
+                )
+                if entry_type == EntryType.KEY_VALUE.value:
+                    new_key = input(
+                        f'Enter new key (leave blank to keep "{entry.get("key", "")}"): '
+                    ).strip() or entry.get("key", "")
+                else:
+                    new_key = None
                 new_value = (
                     input("Enter new value (leave blank to keep current): ").strip()
                     or value
@@ -3058,15 +3131,20 @@ class PasswordManager:
                     else None
                 )
 
+                modify_kwargs = {
+                    "archived": new_blacklisted,
+                    "notes": new_notes,
+                    "label": new_label,
+                    "value": new_value,
+                    "custom_fields": custom_fields,
+                    "tags": tags,
+                }
+                if entry_type == EntryType.KEY_VALUE.value:
+                    modify_kwargs["key"] = new_key
+
                 self.entry_manager.modify_entry(
                     index,
-                    archived=new_blacklisted,
-                    notes=new_notes,
-                    label=new_label,
-                    key=new_key,
-                    value=new_value,
-                    custom_fields=custom_fields,
-                    tags=tags,
+                    **modify_kwargs,
                 )
             else:
                 website_name = entry.get("label", entry.get("website"))
diff --git a/src/tests/test_modify_ssh_managed_entries.py b/src/tests/test_modify_ssh_managed_entries.py
new file mode 100644
index 0000000..009ae88
--- /dev/null
+++ b/src/tests/test_modify_ssh_managed_entries.py
@@ -0,0 +1,56 @@
+import sys
+from pathlib import Path
+from tempfile import TemporaryDirectory
+
+from helpers import create_vault, TEST_SEED, TEST_PASSWORD
+
+sys.path.append(str(Path(__file__).resolve().parents[1]))
+
+from seedpass.core.entry_management import EntryManager
+from seedpass.core.backup import BackupManager
+from seedpass.core.config_manager import ConfigManager
+
+
+def setup_mgr(tmp_path: Path) -> EntryManager:
+    vault, _ = create_vault(tmp_path, TEST_SEED, TEST_PASSWORD)
+    cfg = ConfigManager(vault, tmp_path)
+    backup = BackupManager(tmp_path, cfg)
+    return EntryManager(vault, backup)
+
+
+def test_modify_ssh_entry():
+    with TemporaryDirectory() as tmpdir:
+        tmp_path = Path(tmpdir)
+        em = setup_mgr(tmp_path)
+
+        idx = em.add_ssh_key("ssh", TEST_SEED)
+        em.modify_entry(idx, label="newssh", notes="n", archived=True, tags=["x"])
+        entry = em.retrieve_entry(idx)
+
+        assert entry["label"] == "newssh"
+        assert entry["notes"] == "n"
+        assert entry["archived"] is True
+        assert entry["tags"] == ["x"]
+
+
+def test_modify_managed_account_entry():
+    with TemporaryDirectory() as tmpdir:
+        tmp_path = Path(tmpdir)
+        em = setup_mgr(tmp_path)
+
+        idx = em.add_managed_account("acct", TEST_SEED)
+        em.modify_entry(
+            idx,
+            label="acct2",
+            value="val",
+            notes="note",
+            archived=True,
+            tags=["tag"],
+        )
+        entry = em.retrieve_entry(idx)
+
+        assert entry["label"] == "acct2"
+        assert entry["value"] == "val"
+        assert entry["notes"] == "note"
+        assert entry["archived"] is True
+        assert entry["tags"] == ["tag"]

From 37fc2779ad20d53f02db31ae88c9f70f16a6c68f Mon Sep 17 00:00:00 2001
From: thePR0M3TH3AN <53631862+PR0M3TH3AN@users.noreply.github.com>
Date: Thu, 31 Jul 2025 13:26:25 -0400
Subject: [PATCH 22/33] Add Nostr restore option and test

---
 README.md                                  | 13 ++++
 src/seedpass/core/manager.py               | 13 +++-
 src/tests/test_restore_from_nostr_setup.py | 74 ++++++++++++++++++++++
 3 files changed, 98 insertions(+), 2 deletions(-)
 create mode 100644 src/tests/test_restore_from_nostr_setup.py

diff --git a/README.md b/README.md
index 69408b5..c4d7d95 100644
--- a/README.md
+++ b/README.md
@@ -32,6 +32,7 @@ SeedPass now uses the `portalocker` library for cross-platform file locking. No
   - [Running the Application](#running-the-application)
   - [Managing Multiple Seeds](#managing-multiple-seeds)
     - [Additional Entry Types](#additional-entry-types)
+  - [Recovery](#recovery)
 - [Building a standalone executable](#building-a-standalone-executable)
 - [Packaging with Briefcase](#packaging-with-briefcase)
 - [Security Considerations](#security-considerations)
@@ -541,6 +542,18 @@ seedpass config set nostr_retry_delay 1
 
 The default configuration uses **50,000** PBKDF2 iterations. Increase this value for stronger password hashing or lower it for faster startup (not recommended). Offline Mode skips all Nostr communication, keeping your data local until you re-enable syncing. Quick Unlock stores a hashed copy of your password in the encrypted config so that after the initial unlock, subsequent operations won't prompt for the password until you exit the program. Avoid enabling Quick Unlock on shared machines.
 
+### Recovery
+
+If you previously backed up your vault to Nostr you can restore it during the
+initial setup:
+
+1. Start SeedPass and choose option **4** when prompted to set up a seed.
+2. Paste your BIP-85 seed phrase when asked.
+3. SeedPass initializes the profile and attempts to download the encrypted vault
+   from the configured relays.
+4. A success message confirms the vault was restored. If no data is found a
+   failure message is shown and a new empty vault is created.
+
 ## Running Tests
 
 SeedPass includes a small suite of unit tests located under `src/tests`. **Before running `pytest`, be sure to install the test requirements.** Activate your virtual environment and run `pip install -r src/requirements.txt` to ensure all testing dependencies are available. Then run the tests with **pytest**. Use `-vv` to see INFO-level log messages from each passing test:
diff --git a/src/seedpass/core/manager.py b/src/seedpass/core/manager.py
index 7f73cc5..7205e03 100644
--- a/src/seedpass/core/manager.py
+++ b/src/seedpass/core/manager.py
@@ -808,8 +808,8 @@ class PasswordManager:
 
         choice = input(
             "Do you want to (1) Paste in an existing seed in full "
-            "(2) Enter an existing seed one word at a time or "
-            "(3) Generate a new seed? (1/2/3): "
+            "(2) Enter an existing seed one word at a time, "
+            "(3) Generate a new seed, or (4) Restore from Nostr? (1/2/3/4): "
         ).strip()
 
         if choice == "1":
@@ -818,6 +818,15 @@ class PasswordManager:
             self.setup_existing_seed(method="words")
         elif choice == "3":
             self.generate_new_seed()
+        elif choice == "4":
+            fp = self.setup_existing_seed()
+            if fp:
+                success = self.attempt_initial_sync()
+                if success:
+                    print(colored("Vault restored from Nostr.", "green"))
+                else:
+                    print(colored("Failed to download vault from Nostr.", "red"))
+            return
         else:
             print(colored("Invalid choice. Exiting.", "red"))
             sys.exit(1)
diff --git a/src/tests/test_restore_from_nostr_setup.py b/src/tests/test_restore_from_nostr_setup.py
new file mode 100644
index 0000000..c3359a6
--- /dev/null
+++ b/src/tests/test_restore_from_nostr_setup.py
@@ -0,0 +1,74 @@
+from pathlib import Path
+
+from helpers import create_vault, dummy_nostr_client, TEST_SEED, TEST_PASSWORD
+
+from seedpass.core.entry_management import EntryManager
+from seedpass.core.backup import BackupManager
+from seedpass.core.config_manager import ConfigManager
+from seedpass.core.manager import PasswordManager, EncryptionMode
+
+
+def _init_pm(dir_path: Path, client) -> PasswordManager:
+    vault, enc_mgr = create_vault(dir_path, TEST_SEED, TEST_PASSWORD)
+    cfg_mgr = ConfigManager(vault, dir_path)
+    backup_mgr = BackupManager(dir_path, cfg_mgr)
+    entry_mgr = EntryManager(vault, backup_mgr)
+
+    pm = PasswordManager.__new__(PasswordManager)
+    pm.encryption_mode = EncryptionMode.SEED_ONLY
+    pm.encryption_manager = enc_mgr
+    pm.vault = vault
+    pm.entry_manager = entry_mgr
+    pm.backup_manager = backup_mgr
+    pm.config_manager = cfg_mgr
+    pm.nostr_client = client
+    pm.fingerprint_dir = dir_path
+    pm.current_fingerprint = "fp"
+    pm.is_dirty = False
+    return pm
+
+
+def test_handle_new_seed_setup_restore_from_nostr(monkeypatch, tmp_path, capsys):
+    client, _relay = dummy_nostr_client.__wrapped__(tmp_path / "srv", monkeypatch)
+
+    dir_a = tmp_path / "A"
+    dir_b = tmp_path / "B"
+    dir_a.mkdir()
+    dir_b.mkdir()
+
+    pm_src = _init_pm(dir_a, client)
+    pm_src.notify = lambda *a, **k: None
+    pm_src.entry_manager.add_entry("site1", 12)
+    pm_src.sync_vault()
+
+    pm_new = PasswordManager.__new__(PasswordManager)
+    pm_new.encryption_mode = EncryptionMode.SEED_ONLY
+    pm_new.nostr_client = client
+    pm_new.notify = lambda *a, **k: None
+
+    def finalize(seed, *, password=None):
+        vault, enc_mgr = create_vault(dir_b, seed, TEST_PASSWORD)
+        cfg_mgr = ConfigManager(vault, dir_b)
+        backup_mgr = BackupManager(dir_b, cfg_mgr)
+        entry_mgr = EntryManager(vault, backup_mgr)
+        pm_new.encryption_manager = enc_mgr
+        pm_new.vault = vault
+        pm_new.entry_manager = entry_mgr
+        pm_new.backup_manager = backup_mgr
+        pm_new.config_manager = cfg_mgr
+        pm_new.fingerprint_dir = dir_b
+        pm_new.current_fingerprint = "fp"
+        pm_new.nostr_client = client
+        return "fp"
+
+    monkeypatch.setattr(pm_new, "_finalize_existing_seed", finalize)
+    monkeypatch.setattr("seedpass.core.manager.masked_input", lambda *_: TEST_SEED)
+
+    inputs = iter(["4"])
+    monkeypatch.setattr("builtins.input", lambda *a, **k: next(inputs))
+
+    pm_new.handle_new_seed_setup()
+    out = capsys.readouterr().out
+    assert "Vault restored from Nostr" in out
+    labels = [e[1] for e in pm_new.entry_manager.list_entries()]
+    assert labels == ["site1"]

From ceb2eb28ad658976257db4e8c477c13e28e35515 Mon Sep 17 00:00:00 2001
From: thePR0M3TH3AN <53631862+PR0M3TH3AN@users.noreply.github.com>
Date: Thu, 31 Jul 2025 14:42:53 -0400
Subject: [PATCH 23/33] Fix Nostr manifest handling

---
 src/main.py                          |  9 +++--
 src/seedpass/core/manager.py         | 24 +++++++++++---
 src/tests/test_nostr_restore_flow.py | 49 ++++++++++++++++++++++++++++
 3 files changed, 76 insertions(+), 6 deletions(-)
 create mode 100644 src/tests/test_nostr_restore_flow.py

diff --git a/src/main.py b/src/main.py
index 1fa2482..37981ef 100644
--- a/src/main.py
+++ b/src/main.py
@@ -406,6 +406,7 @@ def handle_retrieve_from_nostr(password_manager: PasswordManager):
     Handles the action of retrieving the encrypted password index from Nostr.
     """
     try:
+        password_manager.nostr_client.fingerprint = password_manager.current_fingerprint
         result = asyncio.run(password_manager.nostr_client.fetch_latest_snapshot())
         if result:
             manifest, chunks = result
@@ -423,8 +424,12 @@ def handle_retrieve_from_nostr(password_manager: PasswordManager):
             print(colored("Encrypted index retrieved and saved successfully.", "green"))
             logging.info("Encrypted index retrieved and saved successfully from Nostr.")
         else:
-            print(colored("Failed to retrieve data from Nostr.", "red"))
-            logging.error("Failed to retrieve data from Nostr.")
+            msg = (
+                f"No Nostr events found for fingerprint"
+                f" {password_manager.current_fingerprint}."
+            )
+            print(colored(msg, "red"))
+            logging.error(msg)
     except Exception as e:
         logging.error(f"Failed to retrieve from Nostr: {e}", exc_info=True)
         print(colored(f"Error: Failed to retrieve from Nostr: {e}", "red"))
diff --git a/src/seedpass/core/manager.py b/src/seedpass/core/manager.py
index 7205e03..ebe832c 100644
--- a/src/seedpass/core/manager.py
+++ b/src/seedpass/core/manager.py
@@ -95,7 +95,7 @@ from datetime import datetime
 from utils.fingerprint_manager import FingerprintManager
 
 # Import NostrClient
-from nostr.client import NostrClient, DEFAULT_RELAYS
+from nostr.client import NostrClient, DEFAULT_RELAYS, MANIFEST_ID_PREFIX
 from .config_manager import ConfigManager
 from .state_manager import StateManager
 
@@ -272,6 +272,8 @@ class PasswordManager:
     def notify(self, message: str, level: str = "INFO") -> None:
         """Enqueue a notification and set it as the active message."""
         note = Notification(message, level)
+        if not hasattr(self, "notifications"):
+            self.notifications = queue.Queue()
         self.notifications.put(note)
         self._current_notification = note
         self._notification_expiry = time.time() + NOTIFICATION_DURATION
@@ -605,6 +607,8 @@ class PasswordManager:
             selected_fingerprint = fingerprints[int(choice) - 1]
             self.fingerprint_manager.current_fingerprint = selected_fingerprint
             self.current_fingerprint = selected_fingerprint
+            if not getattr(self, "manifest_id", None):
+                self.manifest_id = f"{MANIFEST_ID_PREFIX}{selected_fingerprint}"
 
             # Update fingerprint directory
             self.fingerprint_dir = (
@@ -645,7 +649,9 @@ class PasswordManager:
                     config_manager=getattr(self, "config_manager", None),
                     parent_seed=getattr(self, "parent_seed", None),
                 )
-                if getattr(self, "manifest_id", None):
+                if getattr(self, "manifest_id", None) and hasattr(
+                    self.nostr_client, "_state_lock"
+                ):
                     from nostr.backup_models import Manifest
 
                     with self.nostr_client._state_lock:
@@ -903,6 +909,8 @@ class PasswordManager:
             self.current_fingerprint = fingerprint
             self.fingerprint_manager.current_fingerprint = fingerprint
             self.fingerprint_dir = fingerprint_dir
+            if not getattr(self, "manifest_id", None):
+                self.manifest_id = f"{MANIFEST_ID_PREFIX}{fingerprint}"
             logging.info(f"Current seed profile set to {fingerprint}")
 
             try:
@@ -1174,7 +1182,9 @@ class PasswordManager:
                 parent_seed=getattr(self, "parent_seed", None),
             )
 
-            if getattr(self, "manifest_id", None):
+            if getattr(self, "manifest_id", None) and hasattr(
+                self.nostr_client, "_state_lock"
+            ):
                 from nostr.backup_models import Manifest
 
                 with self.nostr_client._state_lock:
@@ -1197,6 +1207,8 @@ class PasswordManager:
         """Always fetch the latest vault data from Nostr and update the local index."""
         start = time.perf_counter()
         try:
+            if getattr(self, "current_fingerprint", None):
+                self.nostr_client.fingerprint = self.current_fingerprint
             result = await self.nostr_client.fetch_latest_snapshot()
             if not result:
                 if self.nostr_client.last_error:
@@ -1346,6 +1358,8 @@ class PasswordManager:
         have_data = False
         start = time.perf_counter()
         try:
+            if getattr(self, "current_fingerprint", None):
+                self.nostr_client.fingerprint = self.current_fingerprint
             result = await self.nostr_client.fetch_latest_snapshot()
             if result:
                 manifest, chunks = result
@@ -4308,7 +4322,9 @@ class PasswordManager:
                 parent_seed=getattr(self, "parent_seed", None),
             )
 
-            if getattr(self, "manifest_id", None):
+            if getattr(self, "manifest_id", None) and hasattr(
+                self.nostr_client, "_state_lock"
+            ):
                 from nostr.backup_models import Manifest
 
                 with self.nostr_client._state_lock:
diff --git a/src/tests/test_nostr_restore_flow.py b/src/tests/test_nostr_restore_flow.py
new file mode 100644
index 0000000..759f6f8
--- /dev/null
+++ b/src/tests/test_nostr_restore_flow.py
@@ -0,0 +1,49 @@
+from pathlib import Path
+
+import main
+from helpers import create_vault, dummy_nostr_client, TEST_SEED, TEST_PASSWORD
+from seedpass.core.entry_management import EntryManager
+from seedpass.core.backup import BackupManager
+from seedpass.core.config_manager import ConfigManager
+from seedpass.core.manager import PasswordManager, EncryptionMode
+
+
+def _init_pm(dir_path: Path, client) -> PasswordManager:
+    vault, enc_mgr = create_vault(dir_path, TEST_SEED, TEST_PASSWORD)
+    cfg_mgr = ConfigManager(vault, dir_path)
+    backup_mgr = BackupManager(dir_path, cfg_mgr)
+    entry_mgr = EntryManager(vault, backup_mgr)
+
+    pm = PasswordManager.__new__(PasswordManager)
+    pm.encryption_mode = EncryptionMode.SEED_ONLY
+    pm.encryption_manager = enc_mgr
+    pm.vault = vault
+    pm.entry_manager = entry_mgr
+    pm.backup_manager = backup_mgr
+    pm.config_manager = cfg_mgr
+    pm.nostr_client = client
+    pm.fingerprint_dir = dir_path
+    pm.current_fingerprint = "fp"
+    pm.is_dirty = False
+    return pm
+
+
+def test_restore_flow_from_snapshot(monkeypatch, tmp_path):
+    client, relay = dummy_nostr_client.__wrapped__(tmp_path / "srv", monkeypatch)
+
+    dir_a = tmp_path / "A"
+    dir_b = tmp_path / "B"
+    dir_a.mkdir()
+    dir_b.mkdir()
+
+    pm_a = _init_pm(dir_a, client)
+    pm_a.entry_manager.add_entry("site1", 12)
+    pm_a.sync_vault()
+    assert relay.manifests
+
+    pm_b = _init_pm(dir_b, client)
+    monkeypatch.setattr(main, "pause", lambda *a, **k: None)
+    main.handle_retrieve_from_nostr(pm_b)
+
+    labels = [e[1] for e in pm_b.entry_manager.list_entries()]
+    assert labels == ["site1"]

From 47da67b37c544565f17388141e710a4e6530bfb6 Mon Sep 17 00:00:00 2001
From: thePR0M3TH3AN <53631862+PR0M3TH3AN@users.noreply.github.com>
Date: Thu, 31 Jul 2025 15:47:24 -0400
Subject: [PATCH 24/33] Improve import handling

---
 src/seedpass/core/manager.py              | 54 +++++++++++++++++-----
 src/tests/test_manager_import_database.py | 55 +++++++++++++++++++++++
 2 files changed, 98 insertions(+), 11 deletions(-)
 create mode 100644 src/tests/test_manager_import_database.py

diff --git a/src/seedpass/core/manager.py b/src/seedpass/core/manager.py
index ebe832c..19e8767 100644
--- a/src/seedpass/core/manager.py
+++ b/src/seedpass/core/manager.py
@@ -32,6 +32,7 @@ from .password_generation import PasswordGenerator
 from .backup import BackupManager
 from .vault import Vault
 from .portable_backup import export_backup, import_backup
+from cryptography.fernet import InvalidToken
 from .totp import TotpManager
 from .entry_types import EntryType
 from .pubsub import bus
@@ -4013,26 +4014,57 @@ class PasswordManager:
 
     def handle_import_database(self, src: Path) -> None:
         """Import a portable database file, replacing the current index."""
-        try:
-            fp, parent_fp, child_fp = self.header_fingerprint_args
-            clear_header_with_notification(
-                self,
-                fp,
-                "Main Menu > Settings > Import database",
-                parent_fingerprint=parent_fp,
-                child_fingerprint=child_fp,
+
+        if not src.name.endswith(".json.enc"):
+            print(
+                colored(
+                    "Error: Selected file must be a SeedPass database backup (.json.enc).",
+                    "red",
+                )
             )
+            return
+
+        fp, parent_fp, child_fp = self.header_fingerprint_args
+        clear_header_with_notification(
+            self,
+            fp,
+            "Main Menu > Settings > Import database",
+            parent_fingerprint=parent_fp,
+            child_fingerprint=child_fp,
+        )
+
+        try:
             import_backup(
                 self.vault,
                 self.backup_manager,
                 src,
                 parent_seed=self.parent_seed,
             )
-            print(colored("Database imported successfully.", "green"))
-            self.sync_vault()
+        except InvalidToken:
+            logging.error("Invalid backup token during import", exc_info=True)
+            print(
+                colored(
+                    "Error: Invalid backup. Please import a file created by SeedPass.",
+                    "red",
+                )
+            )
+            return
+        except FileNotFoundError:
+            logging.error(f"Backup file not found: {src}", exc_info=True)
+            print(colored(f"Error: File '{src}' not found.", "red"))
+            return
         except Exception as e:
             logging.error(f"Failed to import database: {e}", exc_info=True)
-            print(colored(f"Error: Failed to import database: {e}", "red"))
+            print(
+                colored(
+                    f"Error: Failed to import database: {e}. Please verify the backup file.",
+                    "red",
+                )
+            )
+            return
+
+        print(colored("Database imported successfully.", "green"))
+        self.sync_vault()
 
     def handle_export_totp_codes(self) -> Path | None:
         """Export all 2FA codes to a JSON file for other authenticator apps."""
diff --git a/src/tests/test_manager_import_database.py b/src/tests/test_manager_import_database.py
new file mode 100644
index 0000000..9cfb18c
--- /dev/null
+++ b/src/tests/test_manager_import_database.py
@@ -0,0 +1,55 @@
+import queue
+from pathlib import Path
+from types import SimpleNamespace
+import sys
+
+sys.path.append(str(Path(__file__).resolve().parents[1]))
+
+from seedpass.core.manager import PasswordManager, EncryptionMode
+
+
+def _make_pm() -> PasswordManager:
+    pm = PasswordManager.__new__(PasswordManager)
+    pm.encryption_mode = EncryptionMode.SEED_ONLY
+    pm.vault = SimpleNamespace()
+    pm.backup_manager = SimpleNamespace()
+    pm.parent_seed = "seed"
+    pm.profile_stack = []
+    pm.current_fingerprint = None
+    pm.sync_vault = lambda: None
+    pm.notifications = queue.Queue()
+    return pm
+
+
+def test_import_non_backup_file(monkeypatch, capsys):
+    pm = _make_pm()
+    called = {"called": False}
+
+    def fake_import(*_a, **_k):
+        called["called"] = True
+
+    monkeypatch.setattr("seedpass.core.manager.import_backup", fake_import)
+    monkeypatch.setattr(
+        "seedpass.core.manager.clear_header_with_notification", lambda *a, **k: None
+    )
+
+    pm.handle_import_database(Path("data.txt"))
+    out = capsys.readouterr().out
+    assert "json.enc" in out.lower()
+    assert called["called"] is False
+
+
+def test_import_missing_file(monkeypatch, capsys):
+    pm = _make_pm()
+
+    def raise_missing(*_a, **_k):
+        raise FileNotFoundError
+
+    monkeypatch.setattr("seedpass.core.manager.import_backup", raise_missing)
+    monkeypatch.setattr(
+        "seedpass.core.manager.clear_header_with_notification", lambda *a, **k: None
+    )
+
+    pm.handle_import_database(Path("missing.json.enc"))
+    out = capsys.readouterr().out
+    assert "not found" in out.lower()

From 6d82ef181533a5c10c54140143c3e23e4c6b099a Mon Sep 17 00:00:00 2001
From: thePR0M3TH3AN <53631862+PR0M3TH3AN@users.noreply.github.com>
Date: Thu, 31 Jul 2025 16:01:40 -0400
Subject: [PATCH 25/33] Add StatsManager for single display

---
 src/main.py                        | 15 +++++++++++++--
 src/seedpass/core/__init__.py      | 11 ++++++++++-
 src/seedpass/core/manager.py       |  2 ++
 src/seedpass/core/stats_manager.py | 20 +++++++++++++++++++
 src/tests/test_stats_screen.py     | 31 ++++++++++++++++++++++++++++++
 5 files changed, 76 insertions(+), 3 deletions(-)
 create mode 100644 src/seedpass/core/stats_manager.py

diff --git a/src/main.py b/src/main.py
index 37981ef..7a95e32 100644
--- a/src/main.py
+++ b/src/main.py
@@ -281,6 +281,7 @@ def _display_live_stats(
     displayed if newer data exists on Nostr.
     """
 
+    stats_mgr = getattr(password_manager, "stats_manager", None)
     display_fn = getattr(password_manager, "display_stats", None)
     sync_fn = getattr(password_manager, "start_background_sync", None)
     if not callable(display_fn):
@@ -294,12 +295,17 @@ def _display_live_stats(
 
     if not sys.stdin or not sys.stdin.isatty():
         clear_screen()
-        display_fn()
+        if stats_mgr is not None:
+            stats_mgr.display_stats_once(password_manager)
+        else:
+            display_fn()
         note = get_notification_text(password_manager)
         if note:
             print(note)
         print(colored("Press Enter to continue.", "cyan"))
         pause()
+        if stats_mgr is not None:
+            stats_mgr.reset()
         return
 
     while True:
@@ -309,7 +315,10 @@ def _display_live_stats(
             except Exception:  # pragma: no cover - sync best effort
                 logging.debug("Background sync failed during stats display")
         clear_screen()
-        display_fn()
+        if stats_mgr is not None:
+            stats_mgr.display_stats_once(password_manager)
+        else:
+            display_fn()
         note = get_notification_text(password_manager)
         if note:
             print(note)
@@ -324,6 +333,8 @@ def _display_live_stats(
         except KeyboardInterrupt:
             print()
             break
+    if stats_mgr is not None:
+        stats_mgr.reset()
 
 
 def handle_display_stats(password_manager: PasswordManager) -> None:
diff --git a/src/seedpass/core/__init__.py b/src/seedpass/core/__init__.py
index 4610c5e..1d23614 100644
--- a/src/seedpass/core/__init__.py
+++ b/src/seedpass/core/__init__.py
@@ -4,7 +4,14 @@
 
 from importlib import import_module
 
-__all__ = ["PasswordManager", "ConfigManager", "Vault", "EntryType", "StateManager"]
+__all__ = [
+    "PasswordManager",
+    "ConfigManager",
+    "Vault",
+    "EntryType",
+    "StateManager",
+    "StatsManager",
+]
 
 
 def __getattr__(name: str):
@@ -18,4 +25,6 @@ def __getattr__(name: str):
         return import_module(".entry_types", __name__).EntryType
     if name == "StateManager":
         return import_module(".state_manager", __name__).StateManager
+    if name == "StatsManager":
+        return import_module(".stats_manager", __name__).StatsManager
     raise AttributeError(f"module '{__name__}' has no attribute '{name}'")
diff --git a/src/seedpass/core/manager.py b/src/seedpass/core/manager.py
index 19e8767..bf381a5 100644
--- a/src/seedpass/core/manager.py
+++ b/src/seedpass/core/manager.py
@@ -99,6 +99,7 @@ from utils.fingerprint_manager import FingerprintManager
 from nostr.client import NostrClient, DEFAULT_RELAYS, MANIFEST_ID_PREFIX
 from .config_manager import ConfigManager
 from .state_manager import StateManager
+from .stats_manager import StatsManager
 
 # Instantiate the logger
 logger = logging.getLogger(__name__)
@@ -163,6 +164,7 @@ class PasswordManager:
         self.nostr_client: Optional[NostrClient] = None
         self.config_manager: Optional[ConfigManager] = None
         self.state_manager: Optional[StateManager] = None
+        self.stats_manager: StatsManager = StatsManager()
         self.notifications: queue.Queue[Notification] = queue.Queue()
         self._current_notification: Optional[Notification] = None
         self._notification_expiry: float = 0.0
diff --git a/src/seedpass/core/stats_manager.py b/src/seedpass/core/stats_manager.py
new file mode 100644
index 0000000..f1008f8
--- /dev/null
+++ b/src/seedpass/core/stats_manager.py
@@ -0,0 +1,20 @@
+"""Manage display of stats screens."""
+
+from __future__ import annotations
+
+
+class StatsManager:
+    """Track whether stats have been displayed."""
+
+    def __init__(self) -> None:
+        self._displayed = False
+
+    def display_stats_once(self, manager) -> None:
+        """Display stats using ``manager`` once per reset."""
+        if not self._displayed:
+            manager.display_stats()
+            self._displayed = True
+
+    def reset(self) -> None:
+        """Reset the displayed flag."""
+        self._displayed = False
diff --git a/src/tests/test_stats_screen.py b/src/tests/test_stats_screen.py
index 182c7b9..6a76872 100644
--- a/src/tests/test_stats_screen.py
+++ b/src/tests/test_stats_screen.py
@@ -2,6 +2,7 @@ import sys
 from types import SimpleNamespace
 from pathlib import Path
 import pytest
+from seedpass.core.stats_manager import StatsManager
 
 sys.path.append(str(Path(__file__).resolve().parents[1]))
 
@@ -12,6 +13,7 @@ def _make_pm():
     return SimpleNamespace(
         display_stats=lambda: print("stats"),
         start_background_sync=lambda: None,
+        stats_manager=StatsManager(),
     )
 
 
@@ -57,3 +59,32 @@ def test_live_stats_triggers_background_sync(monkeypatch):
     main._display_live_stats(pm)
 
     assert called["sync"] >= 1
+
+
+def test_stats_display_only_once(monkeypatch, capsys):
+    pm = _make_pm()
+    monkeypatch.setattr(main, "get_notification_text", lambda *_: "")
+
+    events = [TimeoutError(), KeyboardInterrupt()]
+
+    def fake_input(*_args, **_kwargs):
+        raise events.pop(0)
+
+    monkeypatch.setattr(main, "timed_input", fake_input)
+    main._display_live_stats(pm, interval=0.01)
+    out = capsys.readouterr().out
+    assert out.count("stats") == 1
+
+
+def test_stats_display_resets_after_exit(monkeypatch, capsys):
+    pm = _make_pm()
+    monkeypatch.setattr(main, "get_notification_text", lambda *_: "")
+    monkeypatch.setattr(
+        main,
+        "timed_input",
+        lambda *_args, **_kwargs: (_ for _ in ()).throw(KeyboardInterrupt()),
+    )
+    main._display_live_stats(pm)
+    main._display_live_stats(pm)
+    out = capsys.readouterr().out
+    assert out.count("stats") == 2

From e3bd6696689d30415f8344dfd0be9922862fc834 Mon Sep 17 00:00:00 2001
From: thePR0M3TH3AN <53631862+PR0M3TH3AN@users.noreply.github.com>
Date: Thu, 31 Jul 2025 18:28:48 -0400
Subject: [PATCH 26/33] Add Nostr restore guidance and tests

---
 src/seedpass/core/manager.py               | 46 ++++++++++++++++++----
 src/tests/test_restore_from_nostr_setup.py | 45 +++++++++++++++++++++
 2 files changed, 84 insertions(+), 7 deletions(-)

diff --git a/src/seedpass/core/manager.py b/src/seedpass/core/manager.py
index bf381a5..13c1b68 100644
--- a/src/seedpass/core/manager.py
+++ b/src/seedpass/core/manager.py
@@ -105,6 +105,12 @@ from .stats_manager import StatsManager
 logger = logging.getLogger(__name__)
 
 
+def calculate_profile_id(seed: str) -> str:
+    """Return the fingerprint identifier for ``seed``."""
+    fp = generate_fingerprint(seed)
+    return fp or ""
+
+
 @dataclass
 class Notification:
     """Simple message container for UI notifications."""
@@ -828,13 +834,8 @@ class PasswordManager:
         elif choice == "3":
             self.generate_new_seed()
         elif choice == "4":
-            fp = self.setup_existing_seed()
-            if fp:
-                success = self.attempt_initial_sync()
-                if success:
-                    print(colored("Vault restored from Nostr.", "green"))
-                else:
-                    print(colored("Failed to download vault from Nostr.", "red"))
+            seed_phrase = masked_input("Enter your 12-word BIP-85 seed: ").strip()
+            self.restore_from_nostr_with_guidance(seed_phrase)
             return
         else:
             print(colored("Invalid choice. Exiting.", "red"))
@@ -1412,6 +1413,37 @@ class PasswordManager:
             except Exception as exc:  # pragma: no cover - best effort
                 logger.warning(f"Unable to publish fresh database: {exc}")
 
+    def check_nostr_backup_exists(self, profile_id: str) -> bool:
+        """Return ``True`` if a snapshot exists on Nostr for ``profile_id``."""
+        if not self.nostr_client or getattr(self, "offline_mode", False):
+            return False
+        previous = self.nostr_client.fingerprint
+        self.nostr_client.fingerprint = profile_id
+        try:
+            result = asyncio.run(self.nostr_client.fetch_latest_snapshot())
+            return result is not None
+        finally:
+            self.nostr_client.fingerprint = previous
+
+    def restore_from_nostr_with_guidance(self, seed_phrase: str) -> None:
+        """Restore a profile from Nostr, warning if no backup exists."""
+        profile_id = calculate_profile_id(seed_phrase)
+        have_backup = self.check_nostr_backup_exists(profile_id)
+        if not have_backup:
+            print(colored("No Nostr backup found for this seed profile.", "yellow"))
+            if not confirm_action("Continue with an empty database? (Y/N): "):
+                return
+
+        fp = self._finalize_existing_seed(seed_phrase)
+        if not fp:
+            return
+
+        success = self.attempt_initial_sync()
+        if success:
+            print(colored("Vault restored from Nostr.", "green"))
+        elif have_backup:
+            print(colored("Failed to download vault from Nostr.", "red"))
+
     def handle_add_password(self) -> None:
         try:
             fp, parent_fp, child_fp = self.header_fingerprint_args
diff --git a/src/tests/test_restore_from_nostr_setup.py b/src/tests/test_restore_from_nostr_setup.py
index c3359a6..96bc70e 100644
--- a/src/tests/test_restore_from_nostr_setup.py
+++ b/src/tests/test_restore_from_nostr_setup.py
@@ -72,3 +72,48 @@ def test_handle_new_seed_setup_restore_from_nostr(monkeypatch, tmp_path, capsys)
     assert "Vault restored from Nostr" in out
     labels = [e[1] for e in pm_new.entry_manager.list_entries()]
     assert labels == ["site1"]
+
+
+async def _no_snapshot():
+    return None
+
+
+def test_restore_from_nostr_warns(monkeypatch, tmp_path, capsys):
+    client, _relay = dummy_nostr_client.__wrapped__(tmp_path / "srv", monkeypatch)
+    monkeypatch.setattr(client, "fetch_latest_snapshot", _no_snapshot)
+
+    pm = PasswordManager.__new__(PasswordManager)
+    pm.encryption_mode = EncryptionMode.SEED_ONLY
+    pm.nostr_client = client
+
+    monkeypatch.setattr("seedpass.core.manager.confirm_action", lambda *_: True)
+    monkeypatch.setattr(pm, "_finalize_existing_seed", lambda *_a, **_k: "fp")
+    monkeypatch.setattr(pm, "attempt_initial_sync", lambda: False)
+
+    pm.restore_from_nostr_with_guidance(TEST_SEED)
+    out = capsys.readouterr().out
+    assert "No Nostr backup" in out
+
+
+def test_restore_from_nostr_abort(monkeypatch, tmp_path, capsys):
+    client, _relay = dummy_nostr_client.__wrapped__(tmp_path / "srv", monkeypatch)
+    monkeypatch.setattr(client, "fetch_latest_snapshot", _no_snapshot)
+
+    pm = PasswordManager.__new__(PasswordManager)
+    pm.encryption_mode = EncryptionMode.SEED_ONLY
+    pm.nostr_client = client
+    pm.vault = None
+
+    called = {"finalize": 0}
+
+    def finalize(*_a, **_k):
+        called["finalize"] += 1
+
+    monkeypatch.setattr("seedpass.core.manager.confirm_action", lambda *_: False)
+    monkeypatch.setattr(pm, "_finalize_existing_seed", finalize)
+
+    pm.restore_from_nostr_with_guidance(TEST_SEED)
+    out = capsys.readouterr().out
+    assert "No Nostr backup" in out
+    assert called["finalize"] == 0
+    assert pm.vault is None

From 77757152d7a8b6f6d446678522f0d98d57944126 Mon Sep 17 00:00:00 2001
From: thePR0M3TH3AN <53631862+PR0M3TH3AN@users.noreply.github.com>
Date: Thu, 31 Jul 2025 19:38:09 -0400
Subject: [PATCH 27/33] Add async background sync task management

---
 src/main.py                   |  5 +++++
 src/seedpass/core/manager.py  | 20 +++++++++++++++-----
 src/seedpass_gui/app.py       |  3 +++
 src/tests/test_unlock_sync.py | 33 +++++++++++++++++++++++++++++++--
 4 files changed, 54 insertions(+), 7 deletions(-)

diff --git a/src/main.py b/src/main.py
index 7a95e32..9b24a45 100644
--- a/src/main.py
+++ b/src/main.py
@@ -1056,6 +1056,7 @@ def display_menu(
                 continue
             logging.info("Exiting the program.")
             print(colored("Exiting the program.", "green"))
+            getattr(password_manager, "cleanup", lambda: None)()
             password_manager.nostr_client.close_client_pool()
             sys.exit(0)
         if choice == "1":
@@ -1259,6 +1260,7 @@ def main(argv: list[str] | None = None, *, fingerprint: str | None = None) -> in
         print(colored("\nReceived shutdown signal. Exiting gracefully...", "yellow"))
         logging.info(f"Received shutdown signal: {sig}. Initiating graceful shutdown.")
         try:
+            getattr(password_manager, "cleanup", lambda: None)()
             password_manager.nostr_client.close_client_pool()
             logging.info("NostrClient closed successfully.")
         except Exception as exc:
@@ -1277,6 +1279,7 @@ def main(argv: list[str] | None = None, *, fingerprint: str | None = None) -> in
         logger.info("Program terminated by user via KeyboardInterrupt.")
         print(colored("\nProgram terminated by user.", "yellow"))
         try:
+            getattr(password_manager, "cleanup", lambda: None)()
             password_manager.nostr_client.close_client_pool()
             logging.info("NostrClient closed successfully.")
         except Exception as exc:
@@ -1287,6 +1290,7 @@ def main(argv: list[str] | None = None, *, fingerprint: str | None = None) -> in
         logger.error(f"A user-related error occurred: {e}", exc_info=True)
         print(colored(f"Error: {e}", "red"))
         try:
+            getattr(password_manager, "cleanup", lambda: None)()
             password_manager.nostr_client.close_client_pool()
             logging.info("NostrClient closed successfully.")
         except Exception as exc:
@@ -1297,6 +1301,7 @@ def main(argv: list[str] | None = None, *, fingerprint: str | None = None) -> in
         logger.error(f"An unexpected error occurred: {e}", exc_info=True)
         print(colored(f"Error: An unexpected error occurred: {e}", "red"))
         try:
+            getattr(password_manager, "cleanup", lambda: None)()
             password_manager.nostr_client.close_client_pool()
             logging.info("NostrClient closed successfully.")
         except Exception as exc:
diff --git a/src/seedpass/core/manager.py b/src/seedpass/core/manager.py
index 13c1b68..3d6d7bb 100644
--- a/src/seedpass/core/manager.py
+++ b/src/seedpass/core/manager.py
@@ -1281,20 +1281,30 @@ class PasswordManager:
 
         async def _worker() -> None:
             try:
-                if hasattr(self, "nostr_client") and hasattr(self, "vault"):
-                    self.attempt_initial_sync()
-                if hasattr(self, "sync_index_from_nostr"):
-                    self.sync_index_from_nostr()
+                await self.attempt_initial_sync_async()
+                await self.sync_index_from_nostr_async()
             except Exception as exc:
                 logger.warning(f"Background sync failed: {exc}")
 
         try:
             loop = asyncio.get_running_loop()
         except RuntimeError:
-            threading.Thread(target=lambda: asyncio.run(_worker()), daemon=True).start()
+            thread = threading.Thread(
+                target=lambda: asyncio.run(_worker()), daemon=True
+            )
+            thread.start()
+            self._sync_task = thread
         else:
             self._sync_task = asyncio.create_task(_worker())
 
+    def cleanup(self) -> None:
+        """Cancel any pending background sync task."""
+        task = getattr(self, "_sync_task", None)
+        if isinstance(task, asyncio.Task) and not task.done():
+            task.cancel()
+        elif isinstance(task, threading.Thread) and task.is_alive():
+            task.join(timeout=0.1)
+
     def start_background_relay_check(self) -> None:
         """Check relay health in a background thread."""
         if (
diff --git a/src/seedpass_gui/app.py b/src/seedpass_gui/app.py
index d0894ab..34f674d 100644
--- a/src/seedpass_gui/app.py
+++ b/src/seedpass_gui/app.py
@@ -195,6 +195,9 @@ class MainWindow(toga.Window):
         bus.unsubscribe("sync_started", self.sync_started)
         bus.unsubscribe("sync_finished", self.sync_finished)
         bus.unsubscribe("vault_locked", self.vault_locked)
+        manager = getattr(self.nostr, "_manager", None)
+        if manager is not None:
+            manager.cleanup()
 
 
 class EntryDialog(toga.Window):
diff --git a/src/tests/test_unlock_sync.py b/src/tests/test_unlock_sync.py
index a2852c4..58a62cb 100644
--- a/src/tests/test_unlock_sync.py
+++ b/src/tests/test_unlock_sync.py
@@ -1,4 +1,6 @@
 import time
+import asyncio
+import warnings
 from types import SimpleNamespace
 from pathlib import Path
 import sys
@@ -17,14 +19,15 @@ def test_unlock_triggers_sync(monkeypatch, tmp_path):
     pm.initialize_managers = lambda: None
     called = {"sync": False}
 
-    def fake_sync(self):
+    async def fake_sync(self):
         called["sync"] = True
 
-    monkeypatch.setattr(PasswordManager, "sync_index_from_nostr", fake_sync)
+    monkeypatch.setattr(PasswordManager, "sync_index_from_nostr_async", fake_sync)
 
     pm.unlock_vault("pw")
     pm.start_background_sync()
     time.sleep(0.05)
+    pm.cleanup()
 
     assert called["sync"]
 
@@ -54,3 +57,29 @@ def test_quick_unlock_background_sync(monkeypatch, tmp_path):
     pm.exit_managed_account()
 
     assert called["bg"]
+
+
+def test_start_background_sync_running_loop(monkeypatch):
+    pm = PasswordManager.__new__(PasswordManager)
+    pm.offline_mode = False
+    called = {"init": False, "sync": False}
+
+    async def fake_attempt(self):
+        called["init"] = True
+
+    async def fake_sync(self):
+        called["sync"] = True
+
+    monkeypatch.setattr(PasswordManager, "attempt_initial_sync_async", fake_attempt)
+    monkeypatch.setattr(PasswordManager, "sync_index_from_nostr_async", fake_sync)
+
+    async def runner():
+        with warnings.catch_warnings(record=True) as w:
+            warnings.simplefilter("always")
+            pm.start_background_sync()
+            await asyncio.sleep(0.01)
+        assert not any(issubclass(wi.category, RuntimeWarning) for wi in w)
+
+    asyncio.run(runner())
+    pm.cleanup()
+    assert called["init"] and called["sync"]

From 4ccdd2b3df9277432e40211fb0f4d168faa4e191 Mon Sep 17 00:00:00 2001
From: thePR0M3TH3AN <53631862+PR0M3TH3AN@users.noreply.github.com>
Date: Thu, 31 Jul 2025 21:42:28 -0400
Subject: [PATCH 28/33] feat(install): auto install gtk deps

---
 README.md                  |  2 ++
 docs/docs/content/index.md |  2 ++
 scripts/install.sh         | 56 ++++++++++++++++++++++----------------
 3 files changed, 36 insertions(+), 24 deletions(-)

diff --git a/README.md b/README.md
index c4d7d95..e72ed9b 100644
--- a/README.md
+++ b/README.md
@@ -114,6 +114,8 @@ See `docs/ARCHITECTURE.md` for details.
 
 Use the automated installer to download SeedPass and its dependencies in one step.
 The scripts also install the correct BeeWare backend for your platform automatically.
+If the GTK `gi` bindings are missing, the installer attempts to install the
+necessary system packages using `apt`, `yum`, `pacman`, or Homebrew.
 
 **Linux and macOS:**
 ```bash
diff --git a/docs/docs/content/index.md b/docs/docs/content/index.md
index 00b2aba..768b285 100644
--- a/docs/docs/content/index.md
+++ b/docs/docs/content/index.md
@@ -90,6 +90,8 @@ maintainable while enabling a consistent experience on multiple platforms.
 ### Quick Installer
 
 Use the automated installer to download SeedPass and its dependencies in one step.
+If GTK packages are missing, the installer will try to install them using your
+system's package manager (`apt`, `yum`, `pacman`, or Homebrew).
 
 **Linux and macOS:**
 ```bash
diff --git a/scripts/install.sh b/scripts/install.sh
index 0a86269..bd73343 100755
--- a/scripts/install.sh
+++ b/scripts/install.sh
@@ -21,6 +21,32 @@ print_info() { echo -e "\033[1;34m[INFO]\033[0m $1"; }
 print_success() { echo -e "\033[1;32m[SUCCESS]\033[0m $1"; }
 print_warning() { echo -e "\033[1;33m[WARNING]\033[0m $1"; }
 print_error() { echo -e "\033[1;31m[ERROR]\033[0m $1" >&2; exit 1; }
+
+# Install build dependencies for Gtk/GObject if available via the system package manager
+install_dependencies() {
+    print_info "Installing system packages required for Gtk bindings..."
+    if command -v apt-get &>/dev/null; then
+        sudo apt-get update && sudo apt-get install -y \
+            build-essential pkg-config libcairo2 libcairo2-dev \
+            libgirepository1.0-dev gobject-introspection \
+            gir1.2-gtk-3.0 python3-dev libffi-dev libssl-dev xclip
+    elif command -v yum &>/dev/null; then
+        sudo yum install -y @'Development Tools' cairo cairo-devel \
+            gobject-introspection-devel gtk3-devel python3-devel \
+            libffi-devel openssl-devel xclip
+    elif command -v dnf &>/dev/null; then
+        sudo dnf groupinstall -y "Development Tools" && sudo dnf install -y \
+            cairo cairo-devel gobject-introspection-devel gtk3-devel \
+            python3-devel libffi-devel openssl-devel xclip
+    elif command -v pacman &>/dev/null; then
+        sudo pacman -Syu --noconfirm base-devel pkgconf cairo \
+            gobject-introspection gtk3 python xclip
+    elif command -v brew &>/dev/null; then
+        brew install pkg-config cairo gobject-introspection gtk+3
+    else
+        print_warning "Unsupported package manager. Please install Gtk/GObject dependencies manually."
+    fi
+}
 usage() {
     echo "Usage: $0 [-b | --branch <branch_name>] [-h | --help]"
     echo "  -b, --branch   Specify the git branch to install (default: main)"
@@ -84,30 +110,12 @@ main() {
     fi
 
     # 3. Install OS-specific dependencies
-    print_info "Checking for build dependencies..."
-    if [ "$OS_NAME" = "Linux" ]; then
-        if command -v apt-get &> /dev/null; then
-            sudo apt-get update && sudo apt-get install -y \
-                build-essential pkg-config xclip \
-                libcairo2 libcairo2-dev \
-                libgirepository-2.0-dev gir1.2-girepository-2.0 \
-                libgirepository1.0-dev \
-                gobject-introspection \
-                gir1.2-gtk-3.0 python3-dev \
-                libffi-dev libssl-dev
-        elif command -v dnf &> /dev/null; then
-            sudo dnf groupinstall -y "Development Tools" && sudo dnf install -y \
-                pkg-config cairo cairo-devel xclip \
-                gobject-introspection-devel cairo-devel gtk3-devel python3-devel
-        elif command -v pacman &> /dev/null; then
-            sudo pacman -Syu --noconfirm base-devel pkg-config cairo xclip \
-                gobject-introspection cairo gtk3 python
-        else
-            print_warning "Could not detect package manager. Ensure build tools, cairo, and pkg-config are installed."
-        fi
-    elif [ "$OS_NAME" = "Darwin" ]; then
-        if ! command -v brew &> /dev/null; then print_error "Homebrew not installed. See https://brew.sh/"; fi
-        brew install pkg-config cairo
+    print_info "Checking for Gtk development libraries..."
+    if ! python3 -c "import gi" &>/dev/null; then
+        print_warning "Gtk introspection bindings not found. Installing dependencies..."
+        install_dependencies
+    else
+        print_info "Gtk bindings already available."
     fi
 
     # 4. Clone or update the repository

From 9adb539b84a8b716ef8b70bdc7b2e1d791c96b29 Mon Sep 17 00:00:00 2001
From: thePR0M3TH3AN <53631862+PR0M3TH3AN@users.noreply.github.com>
Date: Fri, 1 Aug 2025 08:32:44 -0400
Subject: [PATCH 29/33] Keep stats screen visible

---
 src/main.py                    | 10 ++--------
 src/tests/test_stats_screen.py |  2 +-
 2 files changed, 3 insertions(+), 9 deletions(-)

diff --git a/src/main.py b/src/main.py
index 9b24a45..3a18c6c 100644
--- a/src/main.py
+++ b/src/main.py
@@ -295,10 +295,7 @@ def _display_live_stats(
 
     if not sys.stdin or not sys.stdin.isatty():
         clear_screen()
-        if stats_mgr is not None:
-            stats_mgr.display_stats_once(password_manager)
-        else:
-            display_fn()
+        display_fn()
         note = get_notification_text(password_manager)
         if note:
             print(note)
@@ -315,10 +312,7 @@ def _display_live_stats(
             except Exception:  # pragma: no cover - sync best effort
                 logging.debug("Background sync failed during stats display")
         clear_screen()
-        if stats_mgr is not None:
-            stats_mgr.display_stats_once(password_manager)
-        else:
-            display_fn()
+        display_fn()
         note = get_notification_text(password_manager)
         if note:
             print(note)
diff --git a/src/tests/test_stats_screen.py b/src/tests/test_stats_screen.py
index 6a76872..f7f6d4e 100644
--- a/src/tests/test_stats_screen.py
+++ b/src/tests/test_stats_screen.py
@@ -73,7 +73,7 @@ def test_stats_display_only_once(monkeypatch, capsys):
     monkeypatch.setattr(main, "timed_input", fake_input)
     main._display_live_stats(pm, interval=0.01)
     out = capsys.readouterr().out
-    assert out.count("stats") == 1
+    assert out.count("stats") >= 1
 
 
 def test_stats_display_resets_after_exit(monkeypatch, capsys):

From 144751ef0266132a79f53c9bf4f7a7e6c019fb06 Mon Sep 17 00:00:00 2001
From: thePR0M3TH3AN <53631862+PR0M3TH3AN@users.noreply.github.com>
Date: Fri, 1 Aug 2025 09:28:49 -0400
Subject: [PATCH 30/33] fix exit crash when nostr client missing

---
 src/main.py | 23 +++++++++++++++++------
 1 file changed, 17 insertions(+), 6 deletions(-)

diff --git a/src/main.py b/src/main.py
index 3a18c6c..cf8cabd 100644
--- a/src/main.py
+++ b/src/main.py
@@ -459,10 +459,21 @@ def handle_view_relays(cfg_mgr: "ConfigManager") -> None:
         print(colored(f"Error: {e}", "red"))
 
 
+def _safe_close_client_pool(pm: PasswordManager) -> None:
+    """Close the Nostr client pool if the client exists."""
+    client = getattr(pm, "nostr_client", None)
+    if client is None:
+        return
+    try:
+        client.close_client_pool()
+    except Exception as exc:
+        logging.error(f"Error during NostrClient shutdown: {exc}")
+
+
 def _reload_relays(password_manager: PasswordManager, relays: list) -> None:
     """Reload NostrClient with the updated relay list."""
     try:
-        password_manager.nostr_client.close_client_pool()
+        _safe_close_client_pool(password_manager)
     except Exception as exc:
         logging.warning(f"Failed to close client pool: {exc}")
     try:
@@ -1051,7 +1062,7 @@ def display_menu(
             logging.info("Exiting the program.")
             print(colored("Exiting the program.", "green"))
             getattr(password_manager, "cleanup", lambda: None)()
-            password_manager.nostr_client.close_client_pool()
+            _safe_close_client_pool(password_manager)
             sys.exit(0)
         if choice == "1":
             while True:
@@ -1255,7 +1266,7 @@ def main(argv: list[str] | None = None, *, fingerprint: str | None = None) -> in
         logging.info(f"Received shutdown signal: {sig}. Initiating graceful shutdown.")
         try:
             getattr(password_manager, "cleanup", lambda: None)()
-            password_manager.nostr_client.close_client_pool()
+            _safe_close_client_pool(password_manager)
             logging.info("NostrClient closed successfully.")
         except Exception as exc:
             logging.error(f"Error during shutdown: {exc}")
@@ -1274,7 +1285,7 @@ def main(argv: list[str] | None = None, *, fingerprint: str | None = None) -> in
         print(colored("\nProgram terminated by user.", "yellow"))
         try:
             getattr(password_manager, "cleanup", lambda: None)()
-            password_manager.nostr_client.close_client_pool()
+            _safe_close_client_pool(password_manager)
             logging.info("NostrClient closed successfully.")
         except Exception as exc:
             logging.error(f"Error during shutdown: {exc}")
@@ -1285,7 +1296,7 @@ def main(argv: list[str] | None = None, *, fingerprint: str | None = None) -> in
         print(colored(f"Error: {e}", "red"))
         try:
             getattr(password_manager, "cleanup", lambda: None)()
-            password_manager.nostr_client.close_client_pool()
+            _safe_close_client_pool(password_manager)
             logging.info("NostrClient closed successfully.")
         except Exception as exc:
             logging.error(f"Error during shutdown: {exc}")
@@ -1296,7 +1307,7 @@ def main(argv: list[str] | None = None, *, fingerprint: str | None = None) -> in
         print(colored(f"Error: An unexpected error occurred: {e}", "red"))
         try:
             getattr(password_manager, "cleanup", lambda: None)()
-            password_manager.nostr_client.close_client_pool()
+            _safe_close_client_pool(password_manager)
             logging.info("NostrClient closed successfully.")
         except Exception as exc:
             logging.error(f"Error during shutdown: {exc}")

From cc8fba9f124496ab510874b1c07cbdafadbe61b0 Mon Sep 17 00:00:00 2001
From: thePR0M3TH3AN <53631862+PR0M3TH3AN@users.noreply.github.com>
Date: Fri, 1 Aug 2025 10:38:40 -0400
Subject: [PATCH 31/33] Add key validation utilities and integrate

---
 src/seedpass/api.py                           |  1 +
 src/seedpass/core/api.py                      |  1 +
 src/seedpass/core/entry_management.py         | 54 +++++++++++++++
 src/seedpass/core/manager.py                  |  4 +-
 src/tests/test_cli_doc_examples.py            |  2 +-
 src/tests/test_cli_entry_add_commands.py      |  3 +-
 src/tests/test_entry_add.py                   |  2 +-
 src/tests/test_gui_headless.py                |  2 +-
 src/tests/test_key_validation_failures.py     | 66 ++++++++++++++++++
 src/tests/test_manager_list_entries.py        |  4 +-
 src/tests/test_nostr_entry.py                 |  2 +-
 src/tests/test_nostr_qr.py                    |  6 +-
 .../test_retrieve_pause_sensitive_entries.py  |  2 +-
 src/utils/key_validation.py                   | 69 +++++++++++++++++++
 14 files changed, 206 insertions(+), 12 deletions(-)
 create mode 100644 src/tests/test_key_validation_failures.py
 create mode 100644 src/utils/key_validation.py

diff --git a/src/seedpass/api.py b/src/seedpass/api.py
index 095427f..c7083be 100644
--- a/src/seedpass/api.py
+++ b/src/seedpass/api.py
@@ -177,6 +177,7 @@ def create_entry(
     if etype == "nostr":
         index = _pm.entry_manager.add_nostr_key(
             entry.get("label"),
+            _pm.parent_seed,
             index=entry.get("index"),
             notes=entry.get("notes", ""),
             archived=entry.get("archived", False),
diff --git a/src/seedpass/core/api.py b/src/seedpass/core/api.py
index 2479896..8b8916c 100644
--- a/src/seedpass/core/api.py
+++ b/src/seedpass/core/api.py
@@ -420,6 +420,7 @@ class EntryService:
         with self._lock:
             idx = self._manager.entry_manager.add_nostr_key(
                 label,
+                self._manager.parent_seed,
                 index=index,
                 notes=notes,
             )
diff --git a/src/seedpass/core/entry_management.py b/src/seedpass/core/entry_management.py
index c4e6d53..b1437ed 100644
--- a/src/seedpass/core/entry_management.py
+++ b/src/seedpass/core/entry_management.py
@@ -37,6 +37,13 @@ from .entry_types import EntryType
 from .totp import TotpManager
 from utils.fingerprint import generate_fingerprint
 from utils.checksum import canonical_json_dumps
+from utils.key_validation import (
+    validate_totp_secret,
+    validate_ssh_key_pair,
+    validate_pgp_private_key,
+    validate_nostr_keys,
+    validate_seed_phrase,
+)
 
 from .vault import Vault
 from .backup import BackupManager
@@ -266,6 +273,8 @@ class EntryManager:
             if index is None:
                 index = self.get_next_totp_index()
             secret = TotpManager.derive_secret(parent_seed, index)
+            if not validate_totp_secret(secret):
+                raise ValueError("Invalid derived TOTP secret")
             entry = {
                 "type": EntryType.TOTP.value,
                 "kind": EntryType.TOTP.value,
@@ -279,6 +288,8 @@ class EntryManager:
                 "tags": tags or [],
             }
         else:
+            if not validate_totp_secret(secret):
+                raise ValueError("Invalid TOTP secret")
             entry = {
                 "type": EntryType.TOTP.value,
                 "kind": EntryType.TOTP.value,
@@ -323,6 +334,12 @@ class EntryManager:
         if index is None:
             index = self.get_next_index()
 
+        from .password_generation import derive_ssh_key_pair
+
+        priv_pem, pub_pem = derive_ssh_key_pair(parent_seed, index)
+        if not validate_ssh_key_pair(priv_pem, pub_pem):
+            raise ValueError("Derived SSH key pair failed validation")
+
         data = self._load_index()
         data.setdefault("entries", {})
         data["entries"][str(index)] = {
@@ -370,6 +387,17 @@ class EntryManager:
         if index is None:
             index = self.get_next_index()
 
+        from .password_generation import derive_pgp_key
+        from local_bip85.bip85 import BIP85
+        from bip_utils import Bip39SeedGenerator
+
+        seed_bytes = Bip39SeedGenerator(parent_seed).Generate()
+        bip85 = BIP85(seed_bytes)
+
+        priv_key, fp = derive_pgp_key(bip85, index, key_type, user_id)
+        if not validate_pgp_private_key(priv_key, fp):
+            raise ValueError("Derived PGP key failed validation")
+
         data = self._load_index()
         data.setdefault("entries", {})
         data["entries"][str(index)] = {
@@ -413,6 +441,7 @@ class EntryManager:
     def add_nostr_key(
         self,
         label: str,
+        parent_seed: str,
         index: int | None = None,
         notes: str = "",
         archived: bool = False,
@@ -423,6 +452,19 @@ class EntryManager:
         if index is None:
             index = self.get_next_index()
 
+        from local_bip85.bip85 import BIP85
+        from bip_utils import Bip39SeedGenerator
+        from nostr.coincurve_keys import Keys
+
+        seed_bytes = Bip39SeedGenerator(parent_seed).Generate()
+        bip85 = BIP85(seed_bytes)
+        entropy = bip85.derive_entropy(index=index, bytes_len=32)
+        keys = Keys(priv_k=entropy.hex())
+        npub = Keys.hex_to_bech32(keys.public_key_hex(), "npub")
+        nsec = Keys.hex_to_bech32(keys.private_key_hex(), "nsec")
+        if not validate_nostr_keys(npub, nsec):
+            raise ValueError("Derived Nostr keys failed validation")
+
         data = self._load_index()
         data.setdefault("entries", {})
         data["entries"][str(index)] = {
@@ -515,6 +557,16 @@ class EntryManager:
         if index is None:
             index = self.get_next_index()
 
+        from .password_generation import derive_seed_phrase
+        from local_bip85.bip85 import BIP85
+        from bip_utils import Bip39SeedGenerator
+
+        seed_bytes = Bip39SeedGenerator(parent_seed).Generate()
+        bip85 = BIP85(seed_bytes)
+        phrase = derive_seed_phrase(bip85, index, words_num)
+        if not validate_seed_phrase(phrase):
+            raise ValueError("Derived seed phrase failed validation")
+
         data = self._load_index()
         data.setdefault("entries", {})
         data["entries"][str(index)] = {
@@ -583,6 +635,8 @@ class EntryManager:
         word_count = 12
 
         seed_phrase = derive_seed_phrase(bip85, index, word_count)
+        if not validate_seed_phrase(seed_phrase):
+            raise ValueError("Derived managed account seed failed validation")
         fingerprint = generate_fingerprint(seed_phrase)
 
         account_dir = self.fingerprint_dir / "accounts" / fingerprint
diff --git a/src/seedpass/core/manager.py b/src/seedpass/core/manager.py
index 3d6d7bb..a65dce8 100644
--- a/src/seedpass/core/manager.py
+++ b/src/seedpass/core/manager.py
@@ -1970,7 +1970,9 @@ class PasswordManager:
                 if tags_input
                 else []
             )
-            index = self.entry_manager.add_nostr_key(label, notes=notes, tags=tags)
+            index = self.entry_manager.add_nostr_key(
+                label, self.parent_seed, notes=notes, tags=tags
+            )
             npub, nsec = self.entry_manager.get_nostr_key_pair(index, self.parent_seed)
             self.is_dirty = True
             self.last_update = time.time()
diff --git a/src/tests/test_cli_doc_examples.py b/src/tests/test_cli_doc_examples.py
index ee553a6..3c77d08 100644
--- a/src/tests/test_cli_doc_examples.py
+++ b/src/tests/test_cli_doc_examples.py
@@ -24,7 +24,7 @@ class DummyPM:
             add_totp=lambda label, seed, index=None, secret=None, period=30, digits=6: "totp://",
             add_ssh_key=lambda label, seed, index=None, notes="": 2,
             add_pgp_key=lambda label, seed, index=None, key_type="ed25519", user_id="", notes="": 3,
-            add_nostr_key=lambda label, index=None, notes="": 4,
+            add_nostr_key=lambda label, seed, index=None, notes="": 4,
             add_seed=lambda label, seed, index=None, words_num=24, notes="": 5,
             add_key_value=lambda label, key, value, notes="": 6,
             add_managed_account=lambda label, seed, index=None, notes="": 7,
diff --git a/src/tests/test_cli_entry_add_commands.py b/src/tests/test_cli_entry_add_commands.py
index ab230b4..e27a03d 100644
--- a/src/tests/test_cli_entry_add_commands.py
+++ b/src/tests/test_cli_entry_add_commands.py
@@ -4,6 +4,7 @@ from typer.testing import CliRunner
 
 from seedpass.cli import app
 from seedpass import cli
+from helpers import TEST_SEED
 
 runner = CliRunner()
 
@@ -98,7 +99,7 @@ runner = CliRunner()
             "add-nostr",
             "add_nostr_key",
             ["Label", "--index", "4", "--notes", "n"],
-            ("Label",),
+            ("Label", "seed"),
             {"index": 4, "notes": "n"},
             "5",
         ),
diff --git a/src/tests/test_entry_add.py b/src/tests/test_entry_add.py
index 6ea223c..7e1f20f 100644
--- a/src/tests/test_entry_add.py
+++ b/src/tests/test_entry_add.py
@@ -116,7 +116,7 @@ def test_legacy_entry_defaults_to_password():
         ("add_totp", ("totp", TEST_SEED)),
         ("add_ssh_key", ("ssh", TEST_SEED)),
         ("add_pgp_key", ("pgp", TEST_SEED)),
-        ("add_nostr_key", ("nostr",)),
+        ("add_nostr_key", ("nostr", TEST_SEED)),
         ("add_seed", ("seed", TEST_SEED)),
         ("add_key_value", ("label", "k1", "val")),
         ("add_managed_account", ("acct", TEST_SEED)),
diff --git a/src/tests/test_gui_headless.py b/src/tests/test_gui_headless.py
index 635148a..d7b0129 100644
--- a/src/tests/test_gui_headless.py
+++ b/src/tests/test_gui_headless.py
@@ -49,7 +49,7 @@ class FakeEntries:
         self.added.append(("pgp", label))
         return 1
 
-    def add_nostr_key(self, label):
+    def add_nostr_key(self, label, seed=None):
         self.added.append(("nostr", label))
         return 1
 
diff --git a/src/tests/test_key_validation_failures.py b/src/tests/test_key_validation_failures.py
new file mode 100644
index 0000000..3a8ae0d
--- /dev/null
+++ b/src/tests/test_key_validation_failures.py
@@ -0,0 +1,66 @@
+import pytest
+from pathlib import Path
+
+from helpers import create_vault, TEST_SEED, TEST_PASSWORD
+
+from seedpass.core.entry_management import EntryManager
+from seedpass.core.backup import BackupManager
+from seedpass.core.config_manager import ConfigManager
+
+
+def setup_mgr(tmp_path: Path) -> EntryManager:
+    vault, _ = create_vault(tmp_path, TEST_SEED, TEST_PASSWORD)
+    cfg = ConfigManager(vault, tmp_path)
+    backup = BackupManager(tmp_path, cfg)
+    return EntryManager(vault, backup)
+
+
+def test_add_totp_invalid_secret(tmp_path: Path):
+    mgr = setup_mgr(tmp_path)
+    with pytest.raises(ValueError):
+        mgr.add_totp("bad", TEST_SEED, secret="notbase32!")
+
+
+def test_add_ssh_key_validation_failure(monkeypatch, tmp_path: Path):
+    mgr = setup_mgr(tmp_path)
+    monkeypatch.setattr(
+        "seedpass.core.entry_management.validate_ssh_key_pair", lambda p, q: False
+    )
+    with pytest.raises(ValueError):
+        mgr.add_ssh_key("ssh", TEST_SEED)
+
+
+def test_add_pgp_key_validation_failure(monkeypatch, tmp_path: Path):
+    mgr = setup_mgr(tmp_path)
+    monkeypatch.setattr(
+        "seedpass.core.entry_management.validate_pgp_private_key", lambda p, q: False
+    )
+    with pytest.raises(ValueError):
+        mgr.add_pgp_key("pgp", TEST_SEED, user_id="test")
+
+
+def test_add_nostr_key_validation_failure(monkeypatch, tmp_path: Path):
+    mgr = setup_mgr(tmp_path)
+    monkeypatch.setattr(
+        "seedpass.core.entry_management.validate_nostr_keys", lambda p, q: False
+    )
+    with pytest.raises(ValueError):
+        mgr.add_nostr_key("nostr", TEST_SEED)
+
+
+def test_add_seed_validation_failure(monkeypatch, tmp_path: Path):
+    mgr = setup_mgr(tmp_path)
+    monkeypatch.setattr(
+        "seedpass.core.entry_management.validate_seed_phrase", lambda p: False
+    )
+    with pytest.raises(ValueError):
+        mgr.add_seed("seed", TEST_SEED)
+
+
+def test_add_managed_account_validation_failure(monkeypatch, tmp_path: Path):
+    mgr = setup_mgr(tmp_path)
+    monkeypatch.setattr(
+        "seedpass.core.entry_management.validate_seed_phrase", lambda p: False
+    )
+    with pytest.raises(ValueError):
+        mgr.add_managed_account("acct", TEST_SEED)
diff --git a/src/tests/test_manager_list_entries.py b/src/tests/test_manager_list_entries.py
index 58dca43..b687c24 100644
--- a/src/tests/test_manager_list_entries.py
+++ b/src/tests/test_manager_list_entries.py
@@ -246,7 +246,7 @@ def test_show_nostr_entry_details(monkeypatch, capsys):
     with TemporaryDirectory() as tmpdir:
         tmp_path = Path(tmpdir)
         pm, entry_mgr = _setup_manager(tmp_path)
-        idx = entry_mgr.add_nostr_key("nostr")
+        idx = entry_mgr.add_nostr_key("nostr", TEST_SEED)
 
         called = _detail_common(monkeypatch, pm)
 
@@ -339,7 +339,7 @@ def test_show_entry_details_sensitive(monkeypatch, capsys, entry_type):
             expected = priv
             extra = fp
         elif entry_type == "nostr":
-            idx = entry_mgr.add_nostr_key("nostr")
+            idx = entry_mgr.add_nostr_key("nostr", TEST_SEED)
             _npub, nsec = entry_mgr.get_nostr_key_pair(idx, TEST_SEED)
             expected = nsec
         elif entry_type == "totp":
diff --git a/src/tests/test_nostr_entry.py b/src/tests/test_nostr_entry.py
index b8e1edb..80c36bc 100644
--- a/src/tests/test_nostr_entry.py
+++ b/src/tests/test_nostr_entry.py
@@ -22,7 +22,7 @@ def test_nostr_key_determinism():
         backup_mgr = BackupManager(tmp_path, cfg_mgr)
         entry_mgr = EntryManager(vault, backup_mgr)
 
-        idx = entry_mgr.add_nostr_key("main")
+        idx = entry_mgr.add_nostr_key("main", TEST_SEED)
         entry = entry_mgr.retrieve_entry(idx)
         assert entry == {
             "type": "nostr",
diff --git a/src/tests/test_nostr_qr.py b/src/tests/test_nostr_qr.py
index 1d032aa..c4bcca3 100644
--- a/src/tests/test_nostr_qr.py
+++ b/src/tests/test_nostr_qr.py
@@ -42,7 +42,7 @@ def test_show_qr_for_nostr_keys(monkeypatch):
         pm.is_dirty = False
         pm.secret_mode_enabled = False
 
-        idx = entry_mgr.add_nostr_key("main")
+        idx = entry_mgr.add_nostr_key("main", TEST_SEED)
         npub, _ = entry_mgr.get_nostr_key_pair(idx, TEST_SEED)
 
         inputs = iter([str(idx), "q", "p", ""])
@@ -78,7 +78,7 @@ def test_show_private_key_qr(monkeypatch, capsys):
         pm.is_dirty = False
         pm.secret_mode_enabled = False
 
-        idx = entry_mgr.add_nostr_key("main")
+        idx = entry_mgr.add_nostr_key("main", TEST_SEED)
         _, nsec = entry_mgr.get_nostr_key_pair(idx, TEST_SEED)
 
         inputs = iter([str(idx), "q", "k", ""])
@@ -116,7 +116,7 @@ def test_qr_menu_case_insensitive(monkeypatch):
         pm.is_dirty = False
         pm.secret_mode_enabled = False
 
-        idx = entry_mgr.add_nostr_key("main")
+        idx = entry_mgr.add_nostr_key("main", TEST_SEED)
         npub, _ = entry_mgr.get_nostr_key_pair(idx, TEST_SEED)
 
         # Modify index to use uppercase type/kind
diff --git a/src/tests/test_retrieve_pause_sensitive_entries.py b/src/tests/test_retrieve_pause_sensitive_entries.py
index 09d3852..7cdaa5b 100644
--- a/src/tests/test_retrieve_pause_sensitive_entries.py
+++ b/src/tests/test_retrieve_pause_sensitive_entries.py
@@ -20,7 +20,7 @@ import pytest
         (lambda mgr: mgr.add_seed("seed", TEST_SEED), True),
         (lambda mgr: mgr.add_pgp_key("pgp", TEST_SEED, user_id="test"), True),
         (lambda mgr: mgr.add_ssh_key("ssh", TEST_SEED), True),
-        (lambda mgr: mgr.add_nostr_key("nostr"), False),
+        (lambda mgr: mgr.add_nostr_key("nostr", TEST_SEED), False),
     ],
 )
 def test_pause_before_entry_actions(monkeypatch, adder, needs_confirm):
diff --git a/src/utils/key_validation.py b/src/utils/key_validation.py
new file mode 100644
index 0000000..67dc654
--- /dev/null
+++ b/src/utils/key_validation.py
@@ -0,0 +1,69 @@
+"""Key validation helper functions."""
+
+import logging
+from cryptography.hazmat.primitives import serialization
+from pgpy import PGPKey
+import pyotp
+from nostr.coincurve_keys import Keys
+from mnemonic import Mnemonic
+
+logger = logging.getLogger(__name__)
+
+
+def validate_totp_secret(secret: str) -> bool:
+    """Return True if ``secret`` is a valid Base32 TOTP secret."""
+    try:
+        pyotp.TOTP(secret).at(0)
+        return True
+    except Exception as e:  # pragma: no cover - pyotp errors vary
+        logger.debug(f"Invalid TOTP secret: {e}")
+        return False
+
+
+def validate_ssh_key_pair(priv_pem: str, pub_pem: str) -> bool:
+    """Ensure ``priv_pem`` corresponds to ``pub_pem``."""
+    try:
+        priv = serialization.load_pem_private_key(priv_pem.encode(), password=None)
+        derived = (
+            priv.public_key()
+            .public_bytes(
+                serialization.Encoding.PEM,
+                serialization.PublicFormat.SubjectPublicKeyInfo,
+            )
+            .decode()
+        )
+        return derived == pub_pem
+    except Exception as e:  # pragma: no cover - serialization errors vary
+        logger.debug(f"SSH key validation failed: {e}")
+        return False
+
+
+def validate_pgp_private_key(priv_key: str, fingerprint: str) -> bool:
+    """Return True if ``priv_key`` matches ``fingerprint``."""
+    try:
+        key, _ = PGPKey.from_blob(priv_key)
+        return key.fingerprint == fingerprint
+    except Exception as e:  # pragma: no cover - pgpy errors vary
+        logger.debug(f"PGP key validation failed: {e}")
+        return False
+
+
+def validate_nostr_keys(npub: str, nsec: str) -> bool:
+    """Return True if ``nsec`` decodes to ``npub``."""
+    try:
+        priv_hex = Keys.bech32_to_hex(nsec)
+        derived = Keys(priv_k=priv_hex)
+        encoded = Keys.hex_to_bech32(derived.public_key_hex(), "npub")
+        return encoded == npub
+    except Exception as e:  # pragma: no cover - nostr errors vary
+        logger.debug(f"Nostr key validation failed: {e}")
+        return False
+
+
+def validate_seed_phrase(mnemonic: str) -> bool:
+    """Return True if ``mnemonic`` is a valid BIP-39 seed phrase."""
+    try:
+        return Mnemonic("english").check(mnemonic)
+    except Exception as e:  # pragma: no cover - mnemonic errors vary
+        logger.debug(f"Seed phrase validation failed: {e}")
+        return False

From dcd095d1af7c694055191e487f45f7b5785cbacb Mon Sep 17 00:00:00 2001
From: thePR0M3TH3AN <53631862+PR0M3TH3AN@users.noreply.github.com>
Date: Sat, 2 Aug 2025 16:26:52 -0400
Subject: [PATCH 32/33] Include entry type in search results

---
 README.md                                     |  2 ++
 .../01-getting-started/01-advanced_cli.md     |  2 +-
 docs/docs/content/index.md                    |  2 ++
 src/main.py                                   | 27 +++++++++----------
 src/seedpass/api.py                           |  3 ++-
 src/seedpass/cli.py                           |  8 +++---
 src/seedpass/core/api.py                      |  3 ++-
 src/seedpass/core/entry_management.py         | 23 +++++++++++-----
 src/seedpass/core/manager.py                  |  5 ++--
 src/seedpass_gui/app.py                       |  2 +-
 src/tests/test_api.py                         |  5 +++-
 src/tests/test_archive_nonpassword.py         | 13 ++++++---
 src/tests/test_archive_restore.py             |  9 ++++---
 src/tests/test_cli_core_services.py           |  3 ++-
 src/tests/test_cli_doc_examples.py            |  4 ++-
 src/tests/test_cli_subcommands.py             | 20 +++++++++-----
 src/tests/test_core_services.py               |  5 ++--
 src/tests/test_manager_search_display.py      |  2 +-
 src/tests/test_search_entries.py              | 14 +++++-----
 src/tests/test_tag_persistence.py             |  9 ++++---
 src/tests/test_typer_cli.py                   |  8 +++---
 21 files changed, 106 insertions(+), 63 deletions(-)

diff --git a/README.md b/README.md
index e72ed9b..4497051 100644
--- a/README.md
+++ b/README.md
@@ -59,6 +59,7 @@ SeedPass now uses the `portalocker` library for cross-platform file locking. No
 - **Quick Unlock:** Optionally skip the password prompt after verifying once.
 - **Secret Mode:** When enabled, newly generated and retrieved passwords are copied to your clipboard and automatically cleared after a delay.
 - **Tagging Support:** Organize entries with optional tags and find them quickly via search.
+- **Typed Search Results:** Results now display each entry's type for quicker identification.
 - **Manual Vault Export/Import:** Create encrypted backups or restore them using the CLI or API.
 - **Parent Seed Backup:** Securely save an encrypted copy of the master seed.
 - **Manual Vault Locking:** Instantly clear keys from memory when needed.
@@ -235,6 +236,7 @@ seedpass import --file "~/seedpass_backup.json"
 seedpass search "github"
 seedpass search --tags "work,personal"
 seedpass get "github"
+# Search results show the entry type, e.g. "1: Password - GitHub"
 # Retrieve a TOTP entry
 seedpass entry get "email"
 # The code is printed and copied to your clipboard
diff --git a/docs/docs/content/01-getting-started/01-advanced_cli.md b/docs/docs/content/01-getting-started/01-advanced_cli.md
index c9686e9..13336a3 100644
--- a/docs/docs/content/01-getting-started/01-advanced_cli.md
+++ b/docs/docs/content/01-getting-started/01-advanced_cli.md
@@ -136,7 +136,7 @@ Run or stop the local HTTP API.
 ### `entry` Commands
 
 - **`seedpass entry list`** – List entries in the vault, optionally sorted or filtered.
-- **`seedpass entry search <query>`** – Search across labels, usernames, URLs and notes.
+- **`seedpass entry search <query>`** – Search across labels, usernames, URLs and notes. Results show the entry type before each label.
 - **`seedpass entry get <query>`** – Retrieve the password or TOTP code for one matching entry, depending on the entry's type.
 - **`seedpass entry add <label>`** – Create a new password entry. Use `--length` and flags like `--no-special`, `--special-mode safe`, or `--exclude-ambiguous` to override the global policy.
 - **`seedpass entry add-totp <label>`** – Create a TOTP entry. Use `--secret` to import an existing secret or `--index` to derive from the seed.
diff --git a/docs/docs/content/index.md b/docs/docs/content/index.md
index 768b285..4ed74b0 100644
--- a/docs/docs/content/index.md
+++ b/docs/docs/content/index.md
@@ -70,6 +70,7 @@ maintainable while enabling a consistent experience on multiple platforms.
 - **Quick Unlock:** Optionally skip the password prompt after verifying once. Startup delay is unaffected.
 - **Secret Mode:** Copy retrieved passwords directly to your clipboard and automatically clear it after a delay.
 - **Tagging Support:** Organize entries with optional tags and find them quickly via search.
+- **Typed Search Results:** Searches display each entry's type for easier scanning.
 - **Manual Vault Export/Import:** Create encrypted backups or restore them using the CLI or API.
 - **Parent Seed Backup:** Securely save an encrypted copy of the master seed.
 - **Manual Vault Locking:** Instantly clear keys from memory when needed.
@@ -219,6 +220,7 @@ seedpass vault import --file "~/seedpass_backup.json"
 seedpass search "github"
 seedpass search --tags "work,personal"
 seedpass get "github"
+# Search results show the entry type, e.g. "1: Password - GitHub"
 # Retrieve a TOTP entry
 seedpass entry get "email"
 # The code is printed and copied to your clipboard
diff --git a/src/main.py b/src/main.py
index cf8cabd..c387eed 100644
--- a/src/main.py
+++ b/src/main.py
@@ -342,31 +342,28 @@ def handle_display_stats(password_manager: PasswordManager) -> None:
 
 def print_matches(
     password_manager: PasswordManager,
-    matches: list[tuple[int, str, str | None, str | None, bool]],
+    matches: list[tuple[int, str, str | None, str | None, bool, EntryType]],
 ) -> None:
     """Print a list of search matches."""
     print(colored("\n[+] Matches:\n", "green"))
     for entry in matches:
-        idx, website, username, url, blacklisted = entry
+        idx, website, username, url, blacklisted, etype = entry
         data = password_manager.entry_manager.retrieve_entry(idx)
-        etype = (
-            data.get("type", data.get("kind", EntryType.PASSWORD.value))
-            if data
-            else EntryType.PASSWORD.value
-        )
         print(color_text(f"Index: {idx}", "index"))
-        if etype == EntryType.TOTP.value:
-            print(color_text(f"  Label: {data.get('label', website)}", "index"))
-            print(color_text(f"  Derivation Index: {data.get('index', idx)}", "index"))
-        elif etype == EntryType.SEED.value:
+        if etype == EntryType.TOTP:
+            label = data.get("label", website) if data else website
+            deriv = data.get("index", idx) if data else idx
+            print(color_text(f"  Label: {label}", "index"))
+            print(color_text(f"  Derivation Index: {deriv}", "index"))
+        elif etype == EntryType.SEED:
             print(color_text("  Type: Seed Phrase", "index"))
-        elif etype == EntryType.SSH.value:
+        elif etype == EntryType.SSH:
             print(color_text("  Type: SSH Key", "index"))
-        elif etype == EntryType.PGP.value:
+        elif etype == EntryType.PGP:
             print(color_text("  Type: PGP Key", "index"))
-        elif etype == EntryType.NOSTR.value:
+        elif etype == EntryType.NOSTR:
             print(color_text("  Type: Nostr Key", "index"))
-        elif etype == EntryType.KEY_VALUE.value:
+        elif etype == EntryType.KEY_VALUE:
             print(color_text("  Type: Key/Value", "index"))
         else:
             if website:
diff --git a/src/seedpass/api.py b/src/seedpass/api.py
index c7083be..8b22903 100644
--- a/src/seedpass/api.py
+++ b/src/seedpass/api.py
@@ -86,8 +86,9 @@ def search_entry(query: str, authorization: str | None = Header(None)) -> List[A
             "username": username,
             "url": url,
             "archived": archived,
+            "type": etype.value,
         }
-        for idx, label, username, url, archived in results
+        for idx, label, username, url, archived, etype in results
     ]
 
 
diff --git a/src/seedpass/cli.py b/src/seedpass/cli.py
index b989905..9de63a4 100644
--- a/src/seedpass/cli.py
+++ b/src/seedpass/cli.py
@@ -161,8 +161,8 @@ def entry_search(
     if not results:
         typer.echo("No matching entries found")
         return
-    for idx, label, username, url, _arch in results:
-        line = f"{idx}: {label}"
+    for idx, label, username, url, _arch, etype in results:
+        line = f"{idx}: {etype.value.replace('_', ' ').title()} - {label}"
         if username:
             line += f" ({username})"
         if url:
@@ -180,8 +180,8 @@ def entry_get(ctx: typer.Context, query: str) -> None:
         raise typer.Exit(code=1)
     if len(matches) > 1:
         typer.echo("Matches:")
-        for idx, label, username, _url, _arch in matches:
-            name = f"{idx}: {label}"
+        for idx, label, username, _url, _arch, etype in matches:
+            name = f"{idx}: {etype.value.replace('_', ' ').title()} - {label}"
             if username:
                 name += f" ({username})"
             typer.echo(name)
diff --git a/src/seedpass/core/api.py b/src/seedpass/core/api.py
index 8b8916c..28046cd 100644
--- a/src/seedpass/core/api.py
+++ b/src/seedpass/core/api.py
@@ -17,6 +17,7 @@ from pydantic import BaseModel
 
 from .manager import PasswordManager
 from .pubsub import bus
+from .entry_types import EntryType
 
 
 class VaultExportRequest(BaseModel):
@@ -274,7 +275,7 @@ class EntryService:
 
     def search_entries(
         self, query: str, kinds: list[str] | None = None
-    ) -> list[tuple[int, str, str | None, str | None, bool]]:
+    ) -> list[tuple[int, str, str | None, str | None, bool, EntryType]]:
         """Search entries optionally filtering by ``kinds``.
 
         Parameters
diff --git a/src/seedpass/core/entry_management.py b/src/seedpass/core/entry_management.py
index b1437ed..113e581 100644
--- a/src/seedpass/core/entry_management.py
+++ b/src/seedpass/core/entry_management.py
@@ -1210,8 +1210,12 @@ class EntryManager:
 
     def search_entries(
         self, query: str, kinds: List[str] | None = None
-    ) -> List[Tuple[int, str, Optional[str], Optional[str], bool]]:
-        """Return entries matching ``query`` across whitelisted metadata fields."""
+    ) -> List[Tuple[int, str, Optional[str], Optional[str], bool, EntryType]]:
+        """Return entries matching ``query`` across whitelisted metadata fields.
+
+        Each match is represented as ``(index, label, username, url, archived, etype)``
+        where ``etype`` is the :class:`EntryType` of the entry.
+        """
 
         data = self._load_index()
         entries_data = data.get("entries", {})
@@ -1220,19 +1224,23 @@ class EntryManager:
             return []
 
         query_lower = query.lower()
-        results: List[Tuple[int, str, Optional[str], Optional[str], bool]] = []
+        results: List[
+            Tuple[int, str, Optional[str], Optional[str], bool, EntryType]
+        ] = []
 
         for idx, entry in sorted(entries_data.items(), key=lambda x: int(x[0])):
-            etype = entry.get("type", entry.get("kind", EntryType.PASSWORD.value))
+            etype = EntryType(
+                entry.get("type", entry.get("kind", EntryType.PASSWORD.value))
+            )
 
-            if kinds is not None and etype not in kinds:
+            if kinds is not None and etype.value not in kinds:
                 continue
 
             label = entry.get("label", entry.get("website", ""))
             username = (
-                entry.get("username", "") if etype == EntryType.PASSWORD.value else None
+                entry.get("username", "") if etype == EntryType.PASSWORD else None
             )
-            url = entry.get("url", "") if etype == EntryType.PASSWORD.value else None
+            url = entry.get("url", "") if etype == EntryType.PASSWORD else None
             tags = entry.get("tags", [])
             archived = entry.get("archived", entry.get("blacklisted", False))
 
@@ -1249,6 +1257,7 @@ class EntryManager:
                         username if username is not None else None,
                         url if url is not None else None,
                         archived,
+                        etype,
                     )
                 )
 
diff --git a/src/seedpass/core/manager.py b/src/seedpass/core/manager.py
index a65dce8..963b284 100644
--- a/src/seedpass/core/manager.py
+++ b/src/seedpass/core/manager.py
@@ -3379,11 +3379,12 @@ class PasswordManager:
                     child_fingerprint=child_fp,
                 )
                 print(colored("\n[+] Search Results:\n", "green"))
-                for idx, label, username, _url, _b in results:
+                for idx, label, username, _url, _b, etype in results:
                     display_label = label
                     if username:
                         display_label += f" ({username})"
-                    print(colored(f"{idx}. {display_label}", "cyan"))
+                    type_name = etype.value.replace("_", " ").title()
+                    print(colored(f"{idx}. {type_name} - {display_label}", "cyan"))
 
                 idx_input = input(
                     "Enter index to view details or press Enter to go back: "
diff --git a/src/seedpass_gui/app.py b/src/seedpass_gui/app.py
index 34f674d..e11c23c 100644
--- a/src/seedpass_gui/app.py
+++ b/src/seedpass_gui/app.py
@@ -351,7 +351,7 @@ class SearchDialog(toga.Window):
         query = self.query_input.value or ""
         results = self.main.entries.search_entries(query)
         self.main.entry_source.clear()
-        for idx, label, username, url, _arch in results:
+        for idx, label, username, url, _arch, _etype in results:
             self.main.entry_source.append(
                 {
                     "id": idx,
diff --git a/src/tests/test_api.py b/src/tests/test_api.py
index 1aa4c08..6d0db7f 100644
--- a/src/tests/test_api.py
+++ b/src/tests/test_api.py
@@ -8,13 +8,16 @@ from fastapi.testclient import TestClient
 sys.path.append(str(Path(__file__).resolve().parents[1]))
 
 from seedpass import api
+from seedpass.core.entry_types import EntryType
 
 
 @pytest.fixture
 def client(monkeypatch):
     dummy = SimpleNamespace(
         entry_manager=SimpleNamespace(
-            search_entries=lambda q: [(1, "Site", "user", "url", False)],
+            search_entries=lambda q: [
+                (1, "Site", "user", "url", False, EntryType.PASSWORD)
+            ],
             retrieve_entry=lambda i: {"label": "Site"},
             add_entry=lambda *a, **k: 1,
             modify_entry=lambda *a, **k: None,
diff --git a/src/tests/test_archive_nonpassword.py b/src/tests/test_archive_nonpassword.py
index 3a1e6b8..dfca92e 100644
--- a/src/tests/test_archive_nonpassword.py
+++ b/src/tests/test_archive_nonpassword.py
@@ -9,6 +9,7 @@ sys.path.append(str(Path(__file__).resolve().parents[1]))
 from seedpass.core.entry_management import EntryManager
 from seedpass.core.backup import BackupManager
 from seedpass.core.config_manager import ConfigManager
+from seedpass.core.entry_types import EntryType
 
 
 def setup_entry_mgr(tmp_path: Path) -> EntryManager:
@@ -26,7 +27,9 @@ def test_archive_nonpassword_list_search():
         idx = em.search_entries("Example")[0][0]
 
         assert em.list_entries() == [(idx, "Example", None, None, False)]
-        assert em.search_entries("Example") == [(idx, "Example", None, None, False)]
+        assert em.search_entries("Example") == [
+            (idx, "Example", None, None, False, EntryType.TOTP)
+        ]
 
         em.archive_entry(idx)
         assert em.retrieve_entry(idx)["archived"] is True
@@ -34,9 +37,13 @@ def test_archive_nonpassword_list_search():
         assert em.list_entries(include_archived=True) == [
             (idx, "Example", None, None, True)
         ]
-        assert em.search_entries("Example") == [(idx, "Example", None, None, True)]
+        assert em.search_entries("Example") == [
+            (idx, "Example", None, None, True, EntryType.TOTP)
+        ]
 
         em.restore_entry(idx)
         assert em.retrieve_entry(idx)["archived"] is False
         assert em.list_entries() == [(idx, "Example", None, None, False)]
-        assert em.search_entries("Example") == [(idx, "Example", None, None, False)]
+        assert em.search_entries("Example") == [
+            (idx, "Example", None, None, False, EntryType.TOTP)
+        ]
diff --git a/src/tests/test_archive_restore.py b/src/tests/test_archive_restore.py
index a906274..7e2bba6 100644
--- a/src/tests/test_archive_restore.py
+++ b/src/tests/test_archive_restore.py
@@ -14,6 +14,7 @@ from seedpass.core.entry_management import EntryManager
 from seedpass.core.backup import BackupManager
 from seedpass.core.config_manager import ConfigManager
 from seedpass.core.manager import PasswordManager, EncryptionMode
+from seedpass.core.entry_types import EntryType
 
 
 def setup_entry_mgr(tmp_path: Path) -> EntryManager:
@@ -31,7 +32,7 @@ def test_archive_restore_affects_listing_and_search():
 
         assert em.list_entries() == [(idx, "example.com", "alice", "", False)]
         assert em.search_entries("example") == [
-            (idx, "example.com", "alice", "", False)
+            (idx, "example.com", "alice", "", False, EntryType.PASSWORD)
         ]
 
         em.archive_entry(idx)
@@ -40,13 +41,15 @@ def test_archive_restore_affects_listing_and_search():
         assert em.list_entries(include_archived=True) == [
             (idx, "example.com", "alice", "", True)
         ]
-        assert em.search_entries("example") == [(idx, "example.com", "alice", "", True)]
+        assert em.search_entries("example") == [
+            (idx, "example.com", "alice", "", True, EntryType.PASSWORD)
+        ]
 
         em.restore_entry(idx)
         assert em.retrieve_entry(idx)["archived"] is False
         assert em.list_entries() == [(idx, "example.com", "alice", "", False)]
         assert em.search_entries("example") == [
-            (idx, "example.com", "alice", "", False)
+            (idx, "example.com", "alice", "", False, EntryType.PASSWORD)
         ]
 
 
diff --git a/src/tests/test_cli_core_services.py b/src/tests/test_cli_core_services.py
index 1c79a42..df2a6f3 100644
--- a/src/tests/test_cli_core_services.py
+++ b/src/tests/test_cli_core_services.py
@@ -5,6 +5,7 @@ from typer.testing import CliRunner
 
 from seedpass import cli
 from seedpass.cli import app
+from seedpass.core.entry_types import EntryType
 
 runner = CliRunner()
 
@@ -34,7 +35,7 @@ def test_cli_entry_add_search_sync(monkeypatch):
 
     def search_entries(q, kinds=None):
         calls["search"] = (q, kinds)
-        return [(1, "Label", None, None, False)]
+        return [(1, "Label", None, None, False, EntryType.PASSWORD)]
 
     def start_background_vault_sync():
         calls["sync"] = True
diff --git a/src/tests/test_cli_doc_examples.py b/src/tests/test_cli_doc_examples.py
index 3c77d08..c8bb8fe 100644
--- a/src/tests/test_cli_doc_examples.py
+++ b/src/tests/test_cli_doc_examples.py
@@ -17,7 +17,9 @@ class DummyPM:
             list_entries=lambda sort_by="index", filter_kind=None, include_archived=False: [
                 (1, "Label", "user", "url", False)
             ],
-            search_entries=lambda q, kinds=None: [(1, "GitHub", "user", "", False)],
+            search_entries=lambda q, kinds=None: [
+                (1, "GitHub", "user", "", False, EntryType.PASSWORD)
+            ],
             retrieve_entry=lambda idx: {"type": EntryType.PASSWORD.value, "length": 8},
             get_totp_code=lambda idx, seed: "123456",
             add_entry=lambda label, length, username, url, **kwargs: 1,
diff --git a/src/tests/test_cli_subcommands.py b/src/tests/test_cli_subcommands.py
index 751ac74..6c3d944 100644
--- a/src/tests/test_cli_subcommands.py
+++ b/src/tests/test_cli_subcommands.py
@@ -27,7 +27,7 @@ def make_pm(search_results, entry=None, totp_code="123456"):
 
 
 def test_search_command(monkeypatch, capsys):
-    pm = make_pm([(0, "Example", "user", "", False)])
+    pm = make_pm([(0, "Example", "user", "", False, EntryType.PASSWORD)])
     monkeypatch.setattr(main, "PasswordManager", lambda *a, **k: pm)
     monkeypatch.setattr(main, "configure_logging", lambda: None)
     monkeypatch.setattr(main, "initialize_app", lambda: None)
@@ -40,7 +40,7 @@ def test_search_command(monkeypatch, capsys):
 
 def test_get_command(monkeypatch, capsys):
     entry = {"type": EntryType.PASSWORD.value, "length": 8}
-    pm = make_pm([(0, "Example", "user", "", False)], entry=entry)
+    pm = make_pm([(0, "Example", "user", "", False, EntryType.PASSWORD)], entry=entry)
     monkeypatch.setattr(main, "PasswordManager", lambda *a, **k: pm)
     monkeypatch.setattr(main, "configure_logging", lambda: None)
     monkeypatch.setattr(main, "initialize_app", lambda: None)
@@ -53,7 +53,7 @@ def test_get_command(monkeypatch, capsys):
 
 def test_totp_command(monkeypatch, capsys):
     entry = {"type": EntryType.TOTP.value, "period": 30, "index": 0}
-    pm = make_pm([(0, "Example", None, None, False)], entry=entry)
+    pm = make_pm([(0, "Example", None, None, False, EntryType.TOTP)], entry=entry)
     called = {}
     monkeypatch.setattr(main, "PasswordManager", lambda *a, **k: pm)
     monkeypatch.setattr(main, "configure_logging", lambda: None)
@@ -83,7 +83,10 @@ def test_search_command_no_results(monkeypatch, capsys):
 
 
 def test_get_command_multiple_matches(monkeypatch, capsys):
-    matches = [(0, "Example", "user", "", False), (1, "Ex2", "bob", "", False)]
+    matches = [
+        (0, "Example", "user", "", False, EntryType.PASSWORD),
+        (1, "Ex2", "bob", "", False, EntryType.PASSWORD),
+    ]
     pm = make_pm(matches)
     monkeypatch.setattr(main, "PasswordManager", lambda *a, **k: pm)
     monkeypatch.setattr(main, "configure_logging", lambda: None)
@@ -97,7 +100,7 @@ def test_get_command_multiple_matches(monkeypatch, capsys):
 
 def test_get_command_wrong_type(monkeypatch, capsys):
     entry = {"type": EntryType.TOTP.value}
-    pm = make_pm([(0, "Example", "user", "", False)], entry=entry)
+    pm = make_pm([(0, "Example", None, None, False, EntryType.TOTP)], entry=entry)
     monkeypatch.setattr(main, "PasswordManager", lambda *a, **k: pm)
     monkeypatch.setattr(main, "configure_logging", lambda: None)
     monkeypatch.setattr(main, "initialize_app", lambda: None)
@@ -109,7 +112,10 @@ def test_get_command_wrong_type(monkeypatch, capsys):
 
 
 def test_totp_command_multiple_matches(monkeypatch, capsys):
-    matches = [(0, "GH", None, None, False), (1, "Git", None, None, False)]
+    matches = [
+        (0, "GH", None, None, False, EntryType.TOTP),
+        (1, "Git", None, None, False, EntryType.TOTP),
+    ]
     pm = make_pm(matches)
     monkeypatch.setattr(main, "PasswordManager", lambda *a, **k: pm)
     monkeypatch.setattr(main, "configure_logging", lambda: None)
@@ -123,7 +129,7 @@ def test_totp_command_multiple_matches(monkeypatch, capsys):
 
 def test_totp_command_wrong_type(monkeypatch, capsys):
     entry = {"type": EntryType.PASSWORD.value, "length": 8}
-    pm = make_pm([(0, "Example", "user", "", False)], entry=entry)
+    pm = make_pm([(0, "Example", "user", "", False, EntryType.PASSWORD)], entry=entry)
     monkeypatch.setattr(main, "PasswordManager", lambda *a, **k: pm)
     monkeypatch.setattr(main, "configure_logging", lambda: None)
     monkeypatch.setattr(main, "initialize_app", lambda: None)
diff --git a/src/tests/test_core_services.py b/src/tests/test_core_services.py
index ea48a8a..306992e 100644
--- a/src/tests/test_core_services.py
+++ b/src/tests/test_core_services.py
@@ -2,6 +2,7 @@ import types
 from types import SimpleNamespace
 
 from seedpass.core.api import VaultService, EntryService, SyncService, UnlockRequest
+from seedpass.core.entry_types import EntryType
 
 
 def test_vault_service_unlock():
@@ -27,7 +28,7 @@ def test_entry_service_add_entry_and_search():
 
     def search_entries(q, kinds=None):
         called["search"] = (q, kinds)
-        return [(5, "Example", username, url, False)]
+        return [(5, "Example", username, url, False, EntryType.PASSWORD)]
 
     def start_background_vault_sync():
         called["sync"] = True
@@ -47,7 +48,7 @@ def test_entry_service_add_entry_and_search():
     assert called.get("sync") is True
 
     results = service.search_entries("ex", kinds=["password"])
-    assert results == [(5, "Example", username, url, False)]
+    assert results == [(5, "Example", username, url, False, EntryType.PASSWORD)]
     assert called["search"] == ("ex", ["password"])
 
 
diff --git a/src/tests/test_manager_search_display.py b/src/tests/test_manager_search_display.py
index 6781f0b..f8b46f6 100644
--- a/src/tests/test_manager_search_display.py
+++ b/src/tests/test_manager_search_display.py
@@ -46,6 +46,6 @@ def test_search_entries_prompt_for_details(monkeypatch, capsys):
 
         pm.handle_search_entries()
         out = capsys.readouterr().out
-        assert "0. Example" in out
+        assert "0. Totp - Example" in out
         assert "Label: Example" in out
         assert "Period: 30s" in out
diff --git a/src/tests/test_search_entries.py b/src/tests/test_search_entries.py
index 08541f7..e7e4cc0 100644
--- a/src/tests/test_search_entries.py
+++ b/src/tests/test_search_entries.py
@@ -28,7 +28,7 @@ def test_search_by_website():
         entry_mgr.add_entry("Other.com", 8, "bob")
 
         result = entry_mgr.search_entries("example")
-        assert result == [(idx0, "Example.com", "alice", "", False)]
+        assert result == [(idx0, "Example.com", "alice", "", False, EntryType.PASSWORD)]
 
 
 def test_search_by_username():
@@ -40,7 +40,7 @@ def test_search_by_username():
         idx1 = entry_mgr.add_entry("Test.com", 8, "Bob")
 
         result = entry_mgr.search_entries("bob")
-        assert result == [(idx1, "Test.com", "Bob", "", False)]
+        assert result == [(idx1, "Test.com", "Bob", "", False, EntryType.PASSWORD)]
 
 
 def test_search_by_url():
@@ -52,7 +52,9 @@ def test_search_by_url():
         entry_mgr.add_entry("Other", 8)
 
         result = entry_mgr.search_entries("login")
-        assert result == [(idx, "Example", "", "https://ex.com/login", False)]
+        assert result == [
+            (idx, "Example", "", "https://ex.com/login", False, EntryType.PASSWORD)
+        ]
 
 
 def test_search_by_notes_and_totp():
@@ -117,7 +119,7 @@ def test_search_by_tag_password():
         idx = entry_mgr.add_entry("TaggedSite", 8, tags=["work"])
 
         result = entry_mgr.search_entries("work")
-        assert result == [(idx, "TaggedSite", "", "", False)]
+        assert result == [(idx, "TaggedSite", "", "", False, EntryType.PASSWORD)]
 
 
 def test_search_by_tag_totp():
@@ -129,7 +131,7 @@ def test_search_by_tag_totp():
         idx = entry_mgr.search_entries("OTPAccount")[0][0]
 
         result = entry_mgr.search_entries("mfa")
-        assert result == [(idx, "OTPAccount", None, None, False)]
+        assert result == [(idx, "OTPAccount", None, None, False, EntryType.TOTP)]
 
 
 def test_search_with_kind_filter():
@@ -147,4 +149,4 @@ def test_search_with_kind_filter():
         assert {r[0] for r in all_results} == {idx_pw, idx_totp}
 
         only_pw = entry_mgr.search_entries("", kinds=[EntryType.PASSWORD.value])
-        assert only_pw == [(idx_pw, "Site", "", "", False)]
+        assert only_pw == [(idx_pw, "Site", "", "", False, EntryType.PASSWORD)]
diff --git a/src/tests/test_tag_persistence.py b/src/tests/test_tag_persistence.py
index 3de796f..b9b01c2 100644
--- a/src/tests/test_tag_persistence.py
+++ b/src/tests/test_tag_persistence.py
@@ -9,6 +9,7 @@ sys.path.append(str(Path(__file__).resolve().parents[1]))
 from seedpass.core.entry_management import EntryManager
 from seedpass.core.backup import BackupManager
 from seedpass.core.config_manager import ConfigManager
+from seedpass.core.entry_types import EntryType
 
 
 def setup_entry_manager(tmp_path: Path) -> EntryManager:
@@ -29,7 +30,7 @@ def test_tags_persist_on_new_entry():
         entry_mgr = setup_entry_manager(tmp_path)
 
         result = entry_mgr.search_entries("work")
-        assert result == [(idx, "Site", "", "", False)]
+        assert result == [(idx, "Site", "", "", False, EntryType.PASSWORD)]
 
 
 def test_tags_persist_after_modify():
@@ -41,9 +42,11 @@ def test_tags_persist_after_modify():
         entry_mgr.modify_entry(idx, tags=["personal"])
 
         # Ensure tag searchable before reload
-        assert entry_mgr.search_entries("personal") == [(idx, "Site", "", "", False)]
+        assert entry_mgr.search_entries("personal") == [
+            (idx, "Site", "", "", False, EntryType.PASSWORD)
+        ]
 
         # Reinitialize to simulate application restart
         entry_mgr = setup_entry_manager(tmp_path)
         result = entry_mgr.search_entries("personal")
-        assert result == [(idx, "Site", "", "", False)]
+        assert result == [(idx, "Site", "", "", False, EntryType.PASSWORD)]
diff --git a/src/tests/test_typer_cli.py b/src/tests/test_typer_cli.py
index 0587d9a..39a5d99 100644
--- a/src/tests/test_typer_cli.py
+++ b/src/tests/test_typer_cli.py
@@ -34,19 +34,21 @@ def test_entry_list(monkeypatch):
 def test_entry_search(monkeypatch):
     pm = SimpleNamespace(
         entry_manager=SimpleNamespace(
-            search_entries=lambda q, kinds=None: [(1, "L", None, None, False)]
+            search_entries=lambda q, kinds=None: [
+                (1, "L", None, None, False, EntryType.PASSWORD)
+            ]
         ),
         select_fingerprint=lambda fp: None,
     )
     monkeypatch.setattr(cli, "PasswordManager", lambda: pm)
     result = runner.invoke(app, ["entry", "search", "l"])
     assert result.exit_code == 0
-    assert "1: L" in result.stdout
+    assert "Password - L" in result.stdout
 
 
 def test_entry_get_password(monkeypatch):
     def search(q, kinds=None):
-        return [(2, "Example", "", "", False)]
+        return [(2, "Example", "", "", False, EntryType.PASSWORD)]
 
     entry = {"type": EntryType.PASSWORD.value, "length": 8}
     pm = SimpleNamespace(

From 7f503f0787aa942016afc49901e7779677558ea9 Mon Sep 17 00:00:00 2001
From: thePR0M3TH3AN <53631862+PR0M3TH3AN@users.noreply.github.com>
Date: Sat, 2 Aug 2025 16:43:43 -0400
Subject: [PATCH 33/33] feat: add quick password entry mode

---
 README.md                              |   9 ++
 docs/docs/content/index.md             |   9 ++
 src/seedpass/core/manager.py           | 148 ++++++++++++++++---------
 src/tests/test_manager_add_password.py |  61 ++++++++++
 src/tests/test_manager_workflow.py     |   1 +
 5 files changed, 173 insertions(+), 55 deletions(-)

diff --git a/README.md b/README.md
index 4497051..f99e4b3 100644
--- a/README.md
+++ b/README.md
@@ -409,6 +409,15 @@ When choosing **Add Entry**, you can now select from:
 - **Key/Value**
 - **Managed Account**
 
+### Adding a Password Entry
+
+After selecting **Password**, SeedPass asks you to pick a mode:
+
+1. **Quick** – prompts only for a label, username, URL, desired length, and whether to include special characters. Default values are used for notes, tags, and policy settings.
+2. **Advanced** – walks through the full set of prompts for notes, tags, custom fields, and detailed password policy options.
+
+Both modes generate the password, display it (or copy it to the clipboard in Secret Mode), and save the entry to your encrypted vault.
+
 ### Adding a 2FA Entry
 
 1. From the main menu choose **Add Entry** and select **2FA (TOTP)**.
diff --git a/docs/docs/content/index.md b/docs/docs/content/index.md
index 4ed74b0..1015c89 100644
--- a/docs/docs/content/index.md
+++ b/docs/docs/content/index.md
@@ -316,6 +316,15 @@ When choosing **Add Entry**, you can now select from:
 - **Key/Value**
 - **Managed Account**
 
+### Adding a Password Entry
+
+After selecting **Password**, SeedPass asks you to choose a mode:
+
+1. **Quick** – enter only a label, username, URL, desired length, and whether to include special characters. All other fields use defaults.
+2. **Advanced** – continue through prompts for notes, tags, custom fields, and detailed password policy settings.
+
+Both modes generate the password, display it (or copy it to the clipboard in Secret Mode), and save the entry to your encrypted vault.
+
 ### Adding a 2FA Entry
 
 1. From the main menu choose **Add Entry** and select **2FA (TOTP)**.
diff --git a/src/seedpass/core/manager.py b/src/seedpass/core/manager.py
index 963b284..b3a3244 100644
--- a/src/seedpass/core/manager.py
+++ b/src/seedpass/core/manager.py
@@ -1464,6 +1464,72 @@ class PasswordManager:
                 parent_fingerprint=parent_fp,
                 child_fingerprint=child_fp,
             )
+
+            def prompt_length() -> int | None:
+                length_input = input(
+                    f"Enter desired password length (default {DEFAULT_PASSWORD_LENGTH}): "
+                ).strip()
+                length = DEFAULT_PASSWORD_LENGTH
+                if length_input:
+                    if not length_input.isdigit():
+                        print(
+                            colored("Error: Password length must be a number.", "red")
+                        )
+                        return None
+                    length = int(length_input)
+                    if not (MIN_PASSWORD_LENGTH <= length <= MAX_PASSWORD_LENGTH):
+                        print(
+                            colored(
+                                f"Error: Password length must be between {MIN_PASSWORD_LENGTH} and {MAX_PASSWORD_LENGTH}.",
+                                "red",
+                            )
+                        )
+                        return None
+                return length
+
+            def finalize_entry(index: int, label: str, length: int) -> None:
+                # Mark database as dirty for background sync
+                self.is_dirty = True
+                self.last_update = time.time()
+
+                # Generate the password using the assigned index
+                entry = self.entry_manager.retrieve_entry(index)
+                password = self._generate_password_for_entry(entry, index, length)
+
+                # Provide user feedback
+                print(
+                    colored(
+                        f"\n[+] Password generated and indexed with ID {index}.\n",
+                        "green",
+                    )
+                )
+                if self.secret_mode_enabled:
+                    copy_to_clipboard(password, self.clipboard_clear_delay)
+                    print(
+                        colored(
+                            f"[+] Password copied to clipboard. Will clear in {self.clipboard_clear_delay} seconds.",
+                            "green",
+                        )
+                    )
+                else:
+                    print(colored(f"Password for {label}: {password}\n", "yellow"))
+
+                # Automatically push the updated encrypted index to Nostr so the
+                # latest changes are backed up remotely.
+                try:
+                    self.start_background_vault_sync()
+                    logging.info(
+                        "Encrypted index posted to Nostr after entry addition."
+                    )
+                except Exception as nostr_error:
+                    logging.error(
+                        f"Failed to post updated index to Nostr: {nostr_error}",
+                        exc_info=True,
+                    )
+                pause()
+
+            mode = input("Choose mode: [Q]uick or [A]dvanced? ").strip().lower()
+
             website_name = input("Enter the label or website name: ").strip()
             if not website_name:
                 print(colored("Error: Label cannot be empty.", "red"))
@@ -1471,6 +1537,29 @@ class PasswordManager:
 
             username = input("Enter the username (optional): ").strip()
             url = input("Enter the URL (optional): ").strip()
+
+            if mode.startswith("q"):
+                length = prompt_length()
+                if length is None:
+                    return
+                include_special_input = (
+                    input("Include special characters? (Y/n): ").strip().lower()
+                )
+                include_special_chars: bool | None = None
+                if include_special_input:
+                    include_special_chars = include_special_input != "n"
+
+                index = self.entry_manager.add_entry(
+                    website_name,
+                    length,
+                    username,
+                    url,
+                    include_special_chars=include_special_chars,
+                )
+
+                finalize_entry(index, website_name, length)
+                return
+
             notes = input("Enter notes (optional): ").strip()
             tags_input = input("Enter tags (comma-separated, optional): ").strip()
             tags = (
@@ -1491,23 +1580,9 @@ class PasswordManager:
                     {"label": label, "value": value, "is_hidden": hidden}
                 )
 
-            length_input = input(
-                f"Enter desired password length (default {DEFAULT_PASSWORD_LENGTH}): "
-            ).strip()
-            length = DEFAULT_PASSWORD_LENGTH
-            if length_input:
-                if not length_input.isdigit():
-                    print(colored("Error: Password length must be a number.", "red"))
-                    return
-                length = int(length_input)
-                if not (MIN_PASSWORD_LENGTH <= length <= MAX_PASSWORD_LENGTH):
-                    print(
-                        colored(
-                            f"Error: Password length must be between {MIN_PASSWORD_LENGTH} and {MAX_PASSWORD_LENGTH}.",
-                            "red",
-                        )
-                    )
-                    return
+            length = prompt_length()
+            if length is None:
+                return
 
             include_special_input = (
                 input("Include special characters? (Y/n): ").strip().lower()
@@ -1563,7 +1638,6 @@ class PasswordManager:
                 return
             min_special = int(min_special_input) if min_special_input else None
 
-            # Add the entry to the index and get the assigned index
             index = self.entry_manager.add_entry(
                 website_name,
                 length,
@@ -1583,43 +1657,7 @@ class PasswordManager:
                 min_special=min_special,
             )
 
-            # Mark database as dirty for background sync
-            self.is_dirty = True
-            self.last_update = time.time()
-
-            # Generate the password using the assigned index
-            entry = self.entry_manager.retrieve_entry(index)
-            password = self._generate_password_for_entry(entry, index, length)
-
-            # Provide user feedback
-            print(
-                colored(
-                    f"\n[+] Password generated and indexed with ID {index}.\n",
-                    "green",
-                )
-            )
-            if self.secret_mode_enabled:
-                copy_to_clipboard(password, self.clipboard_clear_delay)
-                print(
-                    colored(
-                        f"[+] Password copied to clipboard. Will clear in {self.clipboard_clear_delay} seconds.",
-                        "green",
-                    )
-                )
-            else:
-                print(colored(f"Password for {website_name}: {password}\n", "yellow"))
-
-            # Automatically push the updated encrypted index to Nostr so the
-            # latest changes are backed up remotely.
-            try:
-                self.start_background_vault_sync()
-                logging.info("Encrypted index posted to Nostr after entry addition.")
-            except Exception as nostr_error:
-                logging.error(
-                    f"Failed to post updated index to Nostr: {nostr_error}",
-                    exc_info=True,
-                )
-            pause()
+            finalize_entry(index, website_name, length)
 
         except Exception as e:
             logging.error(f"Error during password generation: {e}", exc_info=True)
diff --git a/src/tests/test_manager_add_password.py b/src/tests/test_manager_add_password.py
index 7e9f8f1..0b09a8a 100644
--- a/src/tests/test_manager_add_password.py
+++ b/src/tests/test_manager_add_password.py
@@ -45,6 +45,7 @@ def test_handle_add_password(monkeypatch, dummy_nostr_client, capsys):
 
         inputs = iter(
             [
+                "a",  # advanced mode
                 "Example",  # label
                 "",  # username
                 "",  # url
@@ -114,6 +115,7 @@ def test_handle_add_password_secret_mode(monkeypatch, dummy_nostr_client, capsys
 
         inputs = iter(
             [
+                "a",  # advanced mode
                 "Example",  # label
                 "",  # username
                 "",  # url
@@ -147,3 +149,62 @@ def test_handle_add_password_secret_mode(monkeypatch, dummy_nostr_client, capsys
         assert f"pw-0-{DEFAULT_PASSWORD_LENGTH}" not in out
         assert "copied to clipboard" in out
         assert called == [(f"pw-0-{DEFAULT_PASSWORD_LENGTH}", 5)]
+
+
+def test_handle_add_password_quick_mode(monkeypatch, dummy_nostr_client, capsys):
+    client, _relay = dummy_nostr_client
+    with TemporaryDirectory() as tmpdir:
+        tmp_path = Path(tmpdir)
+        vault, enc_mgr = create_vault(tmp_path, TEST_SEED, TEST_PASSWORD)
+        cfg_mgr = ConfigManager(vault, tmp_path)
+        backup_mgr = BackupManager(tmp_path, cfg_mgr)
+        entry_mgr = EntryManager(vault, backup_mgr)
+
+        pm = PasswordManager.__new__(PasswordManager)
+        pm.encryption_mode = EncryptionMode.SEED_ONLY
+        pm.encryption_manager = enc_mgr
+        pm.vault = vault
+        pm.entry_manager = entry_mgr
+        pm.backup_manager = backup_mgr
+        pm.password_generator = FakePasswordGenerator()
+        pm.parent_seed = TEST_SEED
+        pm.nostr_client = client
+        pm.fingerprint_dir = tmp_path
+        pm.secret_mode_enabled = False
+        pm.is_dirty = False
+
+        inputs = iter(
+            [
+                "q",  # quick mode
+                "Example",  # label
+                "",  # username
+                "",  # url
+                "",  # length (default)
+                "",  # include special default
+            ]
+        )
+        monkeypatch.setattr("builtins.input", lambda *a, **k: next(inputs))
+        monkeypatch.setattr("seedpass.core.manager.pause", lambda *a, **k: None)
+        monkeypatch.setattr(pm, "start_background_vault_sync", lambda *a, **k: None)
+
+        pm.handle_add_password()
+        out = capsys.readouterr().out
+
+        entries = entry_mgr.list_entries(verbose=False)
+        assert entries == [(0, "Example", "", "", False)]
+
+        entry = entry_mgr.retrieve_entry(0)
+        assert entry == {
+            "label": "Example",
+            "length": DEFAULT_PASSWORD_LENGTH,
+            "username": "",
+            "url": "",
+            "archived": False,
+            "type": "password",
+            "kind": "password",
+            "notes": "",
+            "custom_fields": [],
+            "tags": [],
+        }
+
+        assert f"pw-0-{DEFAULT_PASSWORD_LENGTH}" in out
diff --git a/src/tests/test_manager_workflow.py b/src/tests/test_manager_workflow.py
index b2a7a54..bac9743 100644
--- a/src/tests/test_manager_workflow.py
+++ b/src/tests/test_manager_workflow.py
@@ -50,6 +50,7 @@ def test_manager_workflow(monkeypatch):
 
         inputs = iter(
             [
+                "a",  # advanced mode
                 "example.com",
                 "",  # username
                 "",  # url