# Best Password Manager

> An open-source password manager built around client-side AES-256-GCM encryption, Argon2id key derivation, custom session authentication, and a TypeScript monorepo with a Next.js frontend and Hono API.

Case study: https://sushandahal.com.np/work/best-password-manager

Author: Sushan Dahal

Role: Solo Developer & System Architect

Status: Actively Building

Technologies: TypeScript, Next.js, React, Hono, Node.js, PostgreSQL, Neon, Drizzle ORM, Argon2id, AES-256-GCM, Zod, Tailwind CSS, Vitest, Playwright

## Problem

Password reuse and insecure credential storage expose users to unnecessary security risks. Building a trustworthy password manager requires more than storing passwords behind a login: it requires careful key management, encryption boundaries, secure authentication, and protection against unauthorized access. This project explores those engineering challenges through a self-built password management system.

## Contribution

Independently designed and developed a full-stack password manager using Next.js, Hono, TypeScript, PostgreSQL, and Drizzle ORM. Implemented custom session-based authentication, Argon2id password hashing, client-side vault encryption using AES-256-GCM, master-password-derived vault keys, protected API routes, and encrypted credential CRUD operations. Developed the vault interface, account management workflows, and authentication screens, while expanding the project toward browser extension integration.

## Approach

- Structured the application as an npm-workspaces monorepo with separate Next.js frontend and Hono backend applications.
- Designed PostgreSQL schemas using Drizzle ORM for users, sessions, and encrypted vault records.
- Implemented registration and login using Argon2id password hashing and Zod input validation.
- Built custom session authentication using cryptographically random tokens, SHA-256 token hashes, and HttpOnly cookies.
- Separated account authentication from vault unlocking, deriving encryption keys from a dedicated master password using Argon2id.
- Implemented client-side AES-256-GCM encryption so credential contents are encrypted before being sent to the backend.
- Kept the vault encryption key in memory rather than persisting the plaintext key in browser storage.
- Developed authenticated Hono API endpoints for managing user accounts and encrypted vault entries.
- Built credential creation, editing, deletion, search, and visibility controls within the Next.js vault interface.
- Added account management and authentication-related UI states.
- Planned browser extension functionality for credential detection, saving, and autofill.
- Introduced Vitest and Playwright into the development stack for automated testing.

## Decision

Separated login authentication from vault encryption so an authenticated session alone does not unlock stored credentials. Chose client-side AES-256-GCM encryption with Argon2id-derived keys, storing encrypted vault data on the server while keeping the decryption key in browser memory. Used Hono and Drizzle ORM to maintain explicit control over backend behavior, database access, and security-sensitive application logic.

## Tradeoff

Client-side encryption introduces additional complexity around key derivation, vault unlocking, session management, and recovery. Keeping the vault key exclusively in memory requires users to unlock the vault again after a refresh or new session. A custom authentication and cryptography architecture also increases the responsibility for testing, threat modeling, and security review compared with relying entirely on established managed services.

## Outcome

Developed a working full-stack foundation with user registration, login, session management, encrypted vault operations, and account management. The project remains under active development, with browser extension support, password generation, automatic locking, deployment, and further security hardening forming part of the ongoing roadmap. It is an educational security-engineering project, not an independently audited password manager.

## Lessons

Gained hands-on experience with applied cryptography, authentication design, secure session handling, relational database architecture, and full-stack TypeScript development. Learned that security depends on the interaction of many systems, including key lifecycle management, encryption boundaries, authorization, browser behavior, and operational safeguards—not simply choosing strong cryptographic algorithms.

Interface illustrations on the case-study page explain the concept; they are not project screenshots.

Source: https://github.com/Sushan2589/Best-Password-Manager-LEARNING