⚠️ Educational project — not a real password manager. This is a small teaching example of the Java AES API, kept deliberately tiny so it can be read in one sitting. It contains known security flaws, documented below on purpose. Do not use it to store real passwords — use an established manager like Bitwarden or KeePassXC.
Console app: add site/password pairs, retrieve them. Passwords are AES-encrypted and held in memory while the program runs.
| Flaw | Why it's a problem | Production-grade fix |
|---|---|---|
| Anyone with the code can decrypt everything | Key is now derived from a master password via PBKDF2-HMAC-SHA256 with a random salt — see CryptoUtil |
|
Cipher.getInstance("AES") defaults to ECB mode |
ECB leaks patterns — identical plaintexts produce identical ciphertexts | Now uses AES/GCM/NoPadding with a random IV per entry — see CryptoUtil |
| Same input always encrypts to the same output | Random salt (key derivation) and random IV (per encryption) are now generated and stored alongside the ciphertext — see CryptoUtil |
|
In-memory HashMap only |
Nothing is saved — all entries are lost when the program exits | Encrypted vault file or SQLite |
Want to fix one? See the open good first issues.
git clone https://github.com/chaudhary-lakshay/Password-Manager.git
cd Password-Manager/src
javac PasswordManager/PasswordManager.java
java PasswordManager.PasswordManagerThis repo is a learning artifact. For production-grade projects, see:
- CarCatalog — Spring Boot vehicle catalog & rental API: JWT auth, Flyway migrations, Stripe PaymentIntents
- VitaLink — remote patient monitoring backend: HL7 ADT, MQTT device ingest, live ECG streaming (TimescaleDB + STOMP), FHIR R4
- VitaLink Android — Jetpack Compose clinician app for the above
MIT