Password Manager

A secure command-line password manager with AES-256 encryption, built to teach cryptography and security best practices in Python.

Features

• Military-grade encryption: AES-256-GCM for data at rest
• Master password: PBKDF2 key derivation with high iteration count
• Password generation: Cryptographically secure random passwords
• Clipboard integration: Auto-clear clipboard after timeout
• Password strength analysis: Check password security
• Categories and tags: Organize passwords
• Search: Find entries quickly
• Import/Export: CSV and JSON formats
• Secure memory: Wipe sensitive data from memory
• Auto-lock: Timeout-based security

Project Structure

06_password_manager/
├── README.md
├── requirements.txt
├── pwm/
│   ├── __init__.py
│   ├── __main__.py
│   ├── cli.py
│   ├── manager.py
│   ├── crypto.py
│   ├── storage.py
│   ├── models.py
│   ├── generator.py
│   └── utils.py
└── tests/
    ├── __init__.py
    ├── conftest.py
    └── test_manager.py

Learning Concepts

Cryptography

• AES-256-GCM: Authenticated encryption
• PBKDF2: Key derivation from passwords
• Salt: Preventing rainbow table attacks
• Nonce/IV: Ensuring encryption uniqueness
• HMAC: Message authentication

Security Best Practices

• Secure random: Using secrets module
• Memory wiping: Clearing sensitive data
• Constant-time comparison: Preventing timing attacks
• Input validation: Avoiding injection attacks

Python Concepts

• Dataclasses: Data modeling
• Context managers: Resource cleanup
• Decorators: Function wrapping
• Type hints: Code documentation

Installation

cd 06_password_manager
pip install -r requirements.txt

Usage

First Time Setup

# Initialize vault with master password
python -m pwm init

# You'll be prompted to create a master password

Basic Commands

# Add a new password entry
pwm add github.com --username myuser --generate

# Get a password (copies to clipboard)
pwm get github.com

# List all entries
pwm list

# Search entries
pwm search github

# Generate a password
pwm generate --length 20 --symbols

Managing Entries

# Add entry with all options
pwm add example.com \
    --username john@example.com \
    --password "MySecretPass123!" \
    --url "https://example.com" \
    --notes "Personal account" \
    --category "Work"

# Update existing entry
pwm update github.com --password "NewPassword123!"

# Delete entry
pwm delete github.com

# Show entry details (without revealing password)
pwm show github.com

# Copy password to clipboard
pwm copy github.com

Password Generation

# Generate random password
pwm generate

# Custom length
pwm generate --length 24

# Include/exclude character types
pwm generate --length 16 --no-symbols

# Generate passphrase
pwm generate --passphrase --words 4

Organization

# List by category
pwm list --category Work

# Add tags
pwm add site.com --tags "important,work"

# Search with filters
pwm search --category Personal --tags important

Security Features

# Check password strength
pwm strength "MyPassword123"

# Audit all passwords
pwm audit

# Change master password
pwm change-master

# Lock vault
pwm lock

# Export (encrypted)
pwm export backup.enc

# Import
pwm import backup.enc

Security Architecture

Encryption Flow

Master Password
      │
      ▼
   PBKDF2 (100,000 iterations)
      │
      ▼
   256-bit Key
      │
      ▼
   AES-256-GCM
      │
      ▼
Encrypted Vault

Vault Structure

{
  "version": "1.0",
  "salt": "base64_encoded_salt",
  "nonce": "base64_encoded_nonce",
  "data": "base64_encoded_encrypted_data",
  "auth_tag": "base64_encoded_auth_tag"
}

Key Derivation

# PBKDF2 parameters
iterations = 100_000
key_length = 32  # 256 bits
hash_algorithm = "sha256"

key = PBKDF2(master_password, salt, iterations, key_length, hash_algorithm)

Password Strength Criteria

Types: lowercase, uppercase, digits, symbols

API Usage

from pwm import PasswordManager

# Initialize
pm = PasswordManager("vault.enc")
pm.unlock("master_password")

# Add entry
pm.add(
    name="github.com",
    username="myuser",
    password=pm.generate_password(length=20)
)

# Get password
entry = pm.get("github.com")
print(entry.username)

# Always lock when done
pm.lock()

Testing

# Run all tests
pytest tests/ -v

# With coverage
pytest tests/ --cov=pwm

# Run specific test
pytest tests/test_manager.py -v

Exercises

1. Add TOTP support: Store and generate 2FA codes
2. Add password history: Track previous passwords
3. Add browser extension: Build a browser helper
4. Add sync support: Encrypt and sync to cloud
5. Add biometric auth: Fingerprint/Face ID support

Security Notes

⚠️ Important Security Considerations:

1. Master Password: Choose a strong, unique password
2. Backup: Keep encrypted backups of your vault
3. Memory: Vault data is decrypted in memory while unlocked
4. Clipboard: Auto-clears after 30 seconds by default
5. File Permissions: Vault file should be readable only by you

License

MIT License - Educational use