Password Vault

Desktop password manager. Credentials go into a local SQLite file with the passwords encrypted, and the whole thing is locked behind one master password. There is a generator for making strong passwords and an export option that writes an encrypted backup file.

Running it

Python 3.8 or newer. This one needs a package, unlike the earlier projects:

git clone https://github.com/tsarumar/Password-Vault.git
cd Password-Vault
pip install -r requirements.txt
python main.py

On Linux you might also need sudo apt install python3-tk.

First launch asks you to create a master password. After that, the same screen asks for it to unlock. There is no reset and no recovery question, which is the entire point.

Screenshots

Lock screen on first run:

The vault after adding some entries. Passwords stay masked until you double-click a row:

Adding an entry, with the generator filled in:

How the code is split

Each class has one job.

• crypto.py turns the master password into an encryption key with PBKDF2 (390k iterations, random 16-byte salt) and does the Fernet encrypt/decrypt. The master password is never written anywhere.
• database.py is the SQLite layer. Two tables: meta holds the salt and a verifier token, entries holds site/username/password/notes. It stores whatever bytes it is handed, so it knows nothing about encryption.
• generator.py builds random passwords using secrets, and gives a rough strength label.
• vault.py is the class everything else uses. It composes the other three, validates input, and makes sure a password is encrypted on the way in and decrypted on the way out.
• gui.py is tkinter: lock screen first, then the list with add/edit/delete/search/copy/export.
• main.py opens the window.

How the master password works

The password itself is never stored. On first run the app generates a random salt, derives a key from password + salt, encrypts a short check value with that key, and saves the salt and the encrypted check value in the database. On every later launch it derives a key from whatever you typed and tries to decrypt that check value. If it comes back correct, the password was right.

That means there is no password hash sitting in the file to attack, and no way for the app to recover your data if you forget the master password. Losing it means losing the vault.

About errors

Empty site, empty username and empty password are rejected before anything is written. Wrong master password raises WrongMasterPassword and the lock screen just shows a message. A database written under a different master password fails to decrypt cleanly rather than returning garbage.

vault.db and any exported backup are in .gitignore so real credentials never end up in the repo by accident.