Password Manager

A single-user local Password Manager web application built with Python Flask. This application securely stores, views, adds, edits, and deletes credentials with encryption at rest.

Features

• Securely store credentials encrypted at rest
• Simple, responsive UI to add/search/manage credentials
• Local-only storage (SQLite database)
• Master password authentication with PBKDF2 hashing
• AES encryption for passwords using Fernet (cryptography library)
• Password strength meter
• Export functionality

Security Implementation

• Master password is never stored in plaintext
• PBKDF2 is used to derive encryption keys from the master password
• All credentials are encrypted using Fernet (symmetric encryption)
• Encryption/decryption occurs server-side for simplicity

Tech Stack

• Backend: Python 3.10+, Flask, SQLAlchemy, cryptography (Fernet)
• Database: SQLite
• Frontend: HTML5, CSS (Bootstrap 5), JavaScript (Fetch API)

Setup Instructions

1. Install Python 3.10+ if not already installed

2. Create a virtual environment (recommended):

   python -m venv venv
   

3. Activate the virtual environment:

   • On Windows:

     venv\Scripts\activate
     

   • On macOS/Linux:

     source venv/bin/activate
     

4. Install dependencies:

   pip install -r requirements.txt
   

5. Run the application:

   python app.py
   

6. Access the application: Open your browser and go to http://localhost:5000

Usage

1. First Run:

   • Set a master password (registration)
   • This password will be used to encrypt/decrypt all your credentials

2. Adding Credentials:

   • Click "Add" button
   • Fill in site, username, password, and notes
   • Use the password generator for strong passwords
   • Save the credential

3. Viewing Credentials:

   • Click "View" on any credential
   • Enter your master password when prompted
   • The decrypted password will be displayed

4. Editing Credentials:

   • Click "Edit" on any credential
   • Modify the fields as needed
   • Save changes

5. Deleting Credentials:

   • Click "Delete" on any credential
   • Confirm deletion in the modal

6. Searching:

   • Use the search bar to filter credentials by site or username

7. Exporting Data:

   • Click "Export" to download your encrypted credentials as JSON

Security Notes

⚠️ Educational Purposes Only: This is a learning application. For production use:

• Review the threat model
• Use hardened libraries
• Consider client-side encryption
• Use HTTPS for deployment beyond localhost
• Implement additional security measures

Project Structure

password-manager/
├── app.py              # Flask application
├── requirements.txt    # Python dependencies
├── README.md           # This file
├── templates/
│   └── index.html      # Frontend UI
└── password_manager.db # SQLite database (created automatically)

API Endpoints

• POST /api/register - Register with master password
• POST /api/login - Login with master password
• POST /api/logout - Logout
• GET /api/credentials - Get all credentials (without passwords)
• POST /api/credentials - Add new credential
• GET /api/credentials/<id> - Get specific credential (with decrypted password)
• PUT /api/credentials/<id> - Update credential
• DELETE /api/credentials/<id> - Delete credential
• GET /api/export - Export all credentials

License

This project is for educational purposes only.