Best Password Manager

A reason to build

Password reuse and insecure credential storage expose users to unnecessary security risks. Building a trustworthy password manager requires more than storing passwords behind a login: it requires careful key management, encryption boundaries, secure authentication, and protection against unauthorized access. This project explores those engineering challenges through a self-built password management system.

What I worked on

Independently designed and developed a full-stack password manager using Next.js, Hono, TypeScript, PostgreSQL, and Drizzle ORM. Implemented custom session-based authentication, Argon2id password hashing, client-side vault encryption using AES-256-GCM, master-password-derived vault keys, protected API routes, and encrypted credential CRUD operations. Developed the vault interface, account management workflows, and authentication screens, while expanding the project toward browser extension integration.

How the pieces fit

1. Structured the application as an npm-workspaces monorepo with separate Next.js frontend and Hono backend applications.
2. Designed PostgreSQL schemas using Drizzle ORM for users, sessions, and encrypted vault records.
3. Implemented registration and login using Argon2id password hashing and Zod input validation.
4. Built custom session authentication using cryptographically random tokens, SHA-256 token hashes, and HttpOnly cookies.
5. Separated account authentication from vault unlocking, deriving encryption keys from a dedicated master password using Argon2id.
6. Implemented client-side AES-256-GCM encryption so credential contents are encrypted before being sent to the backend.
7. Kept the vault encryption key in memory rather than persisting the plaintext key in browser storage.
8. Developed authenticated Hono API endpoints for managing user accounts and encrypted vault entries.
9. Built credential creation, editing, deletion, search, and visibility controls within the Next.js vault interface.
10. Added account management and authentication-related UI states.
11. Planned browser extension functionality for credential detection, saving, and autofill.
12. Introduced Vitest and Playwright into the development stack for automated testing.

The detail that matters

Separated login authentication from vault encryption so an authenticated session alone does not unlock stored credentials. Chose client-side AES-256-GCM encryption with Argon2id-derived keys, storing encrypted vault data on the server while keeping the decryption key in browser memory. Used Hono and Drizzle ORM to maintain explicit control over backend behavior, database access, and security-sensitive application logic.

Where it stands

Developed a working full-stack foundation with user registration, login, session management, encrypted vault operations, and account management. The project remains under active development, with browser extension support, password generation, automatic locking, deployment, and further security hardening forming part of the ongoing roadmap. It is an educational security-engineering project, not an independently audited password manager.

Gained hands-on experience with applied cryptography, authentication design, secure session handling, relational database architecture, and full-stack TypeScript development. Learned that security depends on the interaction of many systems, including key lifecycle management, encryption boundaries, authorization, browser behavior, and operational safeguards—not simply choosing strong cryptographic algorithms.