Password Manager

My first security project: a command-line password vault that encrypts each stored password with Fernet. I built it to learn the fundamentals of symmetric encryption and key management, and it led directly to my Secure Login System.

Python
cryptography
Fernet

View code on GitHub

The password manager running in a VS Code terminal: a numbered menu to create or load a key, create or load a password file, add a password and get a password.

The password file: each site name followed by its Fernet-encrypted token, so no password is stored in plain text.

How it works

A menu loop in the terminal lets the user:

generate a new key (saved to its own file) or load an existing one;
create a new password file or load an existing one;
add a site and password, which is encrypted before it's written;
look up a site and decrypt its password.

Security

Authenticated encryption: Fernet combines AES-128 in CBC mode with an HMAC-SHA256 signature, so a tampered entry fails to decrypt instead of returning garbage.
Random keys: 32-byte keys from Fernet.generate_key(), split internally into signing and encryption keys.
No plain text at rest: only ciphertext tokens are written to the password file.

What I'd improve next

Derive the key from a master password with a slow key-derivation function (scrypt or Argon2) instead of keeping it in a file next to the vault.
Add a GUI that hides decrypted passwords again after a short timeout.