Rust Password Manager

Overview

I started this project while learning Rust and experimenting with password-based key derivation and encrypted files. The CLI defines commands for account creation, login, adding and retrieving credentials, deletion, and logout.

The cryptographic helpers and database operations are implemented, but the account and persistence flows are incomplete. This is an archived learning project and should not hold real credentials.

Key management

The intended flow derives a master key with Argon2, passes it through HKDF-SHA256, and uses the result to encrypt a randomly generated 256-bit vault key. That vault key encrypts the credential file with AES-256-GCM-SIV. The encryption helper prefixes its output with a randomly generated 12-byte nonce.

The helper tests cover deterministic key derivation and encryption/decryption round trips. These check individual functions; they do not establish that signup, login, and data recovery work together.

Credential storage

Credentials live in an in-memory SQLite table accessed through rusqlite. Saving exports the rows as JSON to a local file; it does not write an encrypted SQLite database. The login path decrypts that file, and logout is intended to save and encrypt it again.

This leaves plaintext credentials on disk during a session. The command that adds a password also writes it into the session log, so file encryption alone does not protect the stored credentials.

Unfinished parts

The wrapped-key map exists only in memory, with no implemented recovery path across application restarts. Its fixed-size entries also do not match the full nonce-prefixed authenticated ciphertext produced by the encryption helper, causing key conversion during signup to fail. Password lookup constructs SQL from the service name rather than binding it as a parameter.

The repository preserves the cryptographic helpers, database tests, and incomplete CLI as an early Rust project. The planned client/server split was never completed in this codebase.