Skip to content
All projects
Software Development

Secure Password Manager

Full-stack password manager with AES-256 encrypted credential storage, TOTP two-factor authentication, and OpenCV face recognition as an optional biometric login. Authentication, authorization, and data access are separated into distinct layers, with least-privilege rules applied at each one.

Key result

AES-256 + TOTP— Encrypted vault with layered access control

01Problem

A password manager concentrates every credential a person owns behind a single login. That makes the login a single point of failure, and it makes every read of a stored secret an event worth controlling and recording.

02Objective

Build a complete application — client, API, and database — where credentials are encrypted at rest, a second factor is required to authenticate, and every access to a secret is authorized and logged.

03Architecture

  1. React
  2. REST API
  3. Django REST Framework
  4. PostgreSQL
Request path from browser to encrypted storage

04Technology

  • React
  • Django REST Framework
  • PostgreSQL
  • OpenCV
  • AES-256
  • TOTP

05Implementation

Key technical decisions

  1. 01Separated authentication, authorization, and data access into distinct layers, with least-privilege rules applied at each one.
  2. 02Encrypted credentials with AES-256 at rest rather than relying on database-level protection alone.
  3. 03Used TOTP for two-factor authentication, avoiding a dependency on SMS delivery.
  4. 04Kept face recognition as an optional biometric login rather than a required factor, so the vault stays usable when conditions are poor.
  5. 05Ran face verification server-side, so the check cannot be bypassed by a modified client.

What was built

  • REST endpoints covering credential CRUD, encrypt/decrypt operations, and biometric enrollment.
  • AES-256 encrypted credential storage behind the Django REST Framework API.
  • TOTP two-factor authentication on login.
  • OpenCV face recognition for optional biometric login, verified server-side.
  • Audit logging on every access event.

06Data

PostgreSQL storage and the audit trail

  • Credential records stored AES-256 encrypted at rest
  • Least-privilege access rules applied at the authentication, authorization, and data-access layers
  • Biometric enrollment data held separately from credential records
  • An audit log entry written for every access event

07Results

AES-256

Credential encryption at rest

TOTP

Two-factor authentication

Server-side

Face verification

Audit logged

Every access event

10Links

FrontendBackend