Keeping track of your password 'keys' that grant access to your private places is a worsening problem... because passwords should all be frequently changed, but all be different, long, obscure - making them difficult (if not impossible) to remember.

Keeping track of computer passwords is also particularly important when dealing with multiple computers, or multiple OS's on virtual machines... resetting Windows passwords may be an annoyance, but it's not even an option for linux.

The optional red herring prefix and/or suffix can either be pre-chosen characters, or can be left blank to automatically generate random characters. The lower and upper ascii character 'bounds' can be selected to tailor the range of random characters if wished, eg: chr$(48) to chr$(57) would only give random numbers.
The password and red herring colours can both be chosen to differentiate the wheat from the chaff, and the displayed browser text size may be adjusted - catering either for increased copy 'n' paste convenience, or for less visibility to nosy onlookers.

The first script is a modification of the  OLED Menu,  which allows navigation of a list using buttons or an optional rotary encoder. Selecting a list item (eg: a computer name, or website URL) displays the login name and password for the chosen item.
Optionally, selecting the displayed info again sends just the password (not the login) to the browser Output page where it can be selected and copied for pasting into a target window. Any further use of nav buttons clears the browser and returns the OLED display back to the list.
 
The script reads a "list.txt" file containing lines of items all terminated with a chr(10) EOL (end of line) character.
Each line can have up to 3 fields separated by spaces, which are read into 3 arrays.
The first array holds the list of names which are displayed to navigate through.
The 2nd and 3rd arrays are for the corresponding data entries.
Typically the lines would contain "Computer_name  User_name  Password" or "Website_URL  Login_ID  Password"
Selecting an entry from the list displays its corresponding 2nd and 3rd data fields, which could typically show the appropriate login ID and password for typing into a target window. Pressing a navigation button (or turning the rotary encoder) returns to the list display.

Note:
When storing just 2 fields of interest such as "Website_name  URL", there would not be a 3rd field available to send to the browser for convenient copy 'n 'paste into the address bar, so the simple solution is just to insert a dummy 2nd field - which can be any non-space character, perhaps a brief descriptor) - eg: "Website_name  descriptor  URL".

You obviously need to create your own "list.txt" file containing your list of logons and passwords.

If the 'list.txt' is not found, the display will show "MISSING LIST.TXT" 

If you are not worried about your wifi browser activity being 'sniffed' you could create your "list.txt" file directly on the esp device from the Editor page in the browser. But electronics can eventually fail, so if you don't want to risk the possibility of losing your important info, you should back it up elsewhere anyway.
Therefore it may make more sense to create the list.txt file on the computer, then upload it to the device via the Toolkit File Manager, which should be quicker, and avoids opening the browser.

OLED version
This first script is based on the OLED Menu so it can easily be launched as an App from the menu by changing the following lines in the OLED Menu script...

font=2            '1=smallest, 3=largest
file=1             '1=treat list of menu items as partial filenames to re-combine with path$
list$="vault,xbmview,ftpcopy,lock,i2scan,wifiscan"    'needs files=1

And don't forget to set nav=0 or nav=1 depending on whether using buttons or optional rotary encoder.
See the original OLED Menu project for info on how to change options such as the frame and line numbers etc.
 
This  demo video  shows the OLED Key Vault in use, or alternatively this LBRY version if preferred.

The XBM startup Key logo can be downloaded from the bottom of this page... then upload to the device as "/img/vaultkey.xbm"

This version of the Key Vault takes advantage of the M5 Stack for convenient portability.

The M5 Stack (as it was originally called) uses an ESP32, so requires flashing with Annex32,

Here's a quick YouTube demo video of how it looks in use, or alternatively this LBRY version 

The JPG startup Key logo can be downloaded from the bottom of this page...

Upload the jpg image to the device as "/img/vaultkey.jpg" and it will be automatically displayed.

Note that all files are stored on micro-SD card, including the 'list.txt' of your logons and passwords.

This has some benefits when it comes to creating and maintaining the list, but it also has some security disadvantages - so you may wish to continue reading more about your privacy and security below.

 
You, and all internet users, are considered a valuable resource for global data harvesting by anyone who can get at you. This includes armies of individual hackers, organised crime, governments, huge global corporates beyond national controls ... the biggest invaders of privacy are actually the mega companies with household names like Microsoft and Google whose products are specifically designed to harvest personal user data and send it back via the users internet connection at the users expense.

By default Windows 10 logs all keystrokes and mouse activity, all browser activity, and much more - their data harvesting is called 'telemetry', but users can't complain because they've already agreed to the Microsoft terms and conditions in order to be users. And nobody complains on their behalf because everyone else involved benefits at the users expense. Government agencies not only have access to the harvested data, they are provided with secret backdoors into users systems, even though the very presence of such backdoors obviously makes users systems inherently more vulnerable to illegal attack and exploitation. An entire anti-malware industry exists because of criminal exploitation of software vulnerabilities - most of the vuilnerable software coming from Microsoft.

The contents of all Gmails are scanned, and kept by google even after users delete them from their mailbox.
Although such data harvesting is more invasive and prolific than any spyware, it is not legally considered an invasion of privacy because users have already agreed the terms and conditions, thereby also tacitly agreeing similar terms and conditions for other google products and services such as Facebook and YouTube. Google cross-references users data harvested from many products and services, including mobile phone data, to build profiles of users including their physical location and movements.

ISP's harvest and sell their users internet activities, and of course provide those details to government agencies.
 
As more and more opportunists jump on the bandwagon to harvest and sell users data, it's become normal and expected to be forced into agreeing terms and conditions before being allowed into to websites - failure to give up your privacy often means you must leave.

Data customers are willing to pay big money to influence such things as product purchase and public opinion... without the public even knowing or caring.

Data harvesters and their paying customers only consider users data a resource to make money from. Although the sale of harvested data should technically be limited to less personal 'metadata' for statistical analysis, that is known to not always be the case, but even if it is just the tip of a dangerous iceberg, there is nobody on iceberg watch anyway.
Even IF the legal data harvesters can be arguably considered ethical themselves, they have little control over how it is initially used after they sell your data, or how often it finds its way into other less scrupulous hands, or for what purposes it will eventually be used.

There is little effective oversight on omnipotent government agencies who are given access to the harvested data, and even less after being handed to other nations with different laws and ethics, participating in 5 eyes 9 eyes 14 eyes and other data sharing accords.

Illegal data harvesting is done on a massive scale by criminals who hack into servers to steal user data, thus avoiding need for users consent ... Yahoo has been hacked so many times resulting in data thefts to millions of users that it has become almost a regular crop harvest - and countless similar data thefts are such a frequent occurrence that they hardly make news anymore, let alone headlines.

Returning to the subject of your private logins and passwords contained in your 'list.txt' file... an awareness of data-harvesting offers you opportunity to improve your own privacy and security to lessen the risk of personal loss or disaster... but what you do about it - if anything - is entirely up to you.

To avoid commercial or political harvesting of your browsing history and personal data you could use an independent browser such as Firefox.
To avoid your ISP harvesting your browsing history from its DNS servers... in Firefox go into Preferences, Network Settings, then tick "Enable DNS over HTTPS" - this will use alternative DNS server look-ups which cannot be tracked by your ISP.

To reduce manipulation by commercially biased search results, and stop your personal data and usage from being recorded, you could change the default search engine to DuckDuckGo, who say (quote)... "We don't store your personal information. Ever.
 Our privacy policy is simple: we don't collect or share any of your personal information."
A couple of less familiar alternative search engines which also respect your privacy are Startpage and Qwant, but there are others.

Proton to Proton emails are encrypted end to end, so they are secure from sender to recipient every step of the way.

TIP: If you had 2 Proton accounts you could securely send all your passwords to yourself from one account to the other and vice versa, then even if you got locked out of one account due to forgetting its password... you could easily get it back from the other account and regain access to all your encrypted mail again.

TIP: If you have a Proton account, you could securely create and maintain your 'list.txt' file of logins and passwords directly from within your encrypted mailbox, allowing you to remove all trace of it from your computer after uploading to your Annex Key Vault.

In addition, Proton offers (quote):
 "a free virtual private network (VPN).
  ProtonVPN enables you to:
    protect your privacy by hiding your IP address
    browse the web securely (even on public WiFi)
    visit blocked or censored websites"
Don't expect it to be as fast as a paid VPN - but hey, it offers you free online privacy!

We think users should own their content (and their privacy) instead of handing it over to a corporate giant and their advertising buddies. If you think we're paranoid, there are dozens of examples of companies abusing users and acting against their interests. It's not paranoia if they're actually out to get you."

LiBRaRY uses a secure blockchain protocol which is completely free to use, and offers incentive for registered users by giving LBC as virtual currency rewards for eg: just watching Annex content. Using this link to join will earn some additional LBC as a first reward.  

You can reduce the personal profile which Google collates about you from cross-referencing your Facebook data with other social media accounts, email addresses, phone numbers,etc... by 'compartmentalising' your different accounts - ie: use different email addresses and contact information, and avoid including links from other social media platform in each other.

Firefox says (quote):

"if you still kinda like Facebook but don’t trust them, then try the Facebook Container extension by Firefox and make it harder for them to track you around the web"

There are sites which actually offer free fake ID's in many countries ... so although you may be bullied into agreeing terms and conditions or giving out contact information, you can avoid meekly handing over your true identity and giving away your privacy.

Likewise for sites that want your email address before allowing access... you can grab a free temporary '10 minute' email address to register for free downloads etc without being forever haunted by spam or pestered by sales blurb, 

The bottom line is that your privacy and security are your responsibility, and you should assume that everyone else is out to get what they can from you, so it is up to you to take whatever steps you feel necessary to stay safe and secure, The Key Vault offers a practical way to help you improve the security of your passwords, but it can only be as safe as you choose to make it.