r/Python • u/KrypticMess • 7d ago
Discussion Creating my own password manager bc I can
I started off with creating a CLI app and want to slowly move into making a desktop app, a web app, and a mobile app so I can just host my db and encryption key somewhere and be done with it. I was wondering if anyone can take a peek and give me some criticisms here and there since I don't normally create apps in python: https://github.com/mariaalexissales/password-manager
7
u/Lucas_csgo 7d ago
Fun as a learning project, but I won’t suggest using this for real.
If you are fed up with paying for password manager services, check out Bitwarden. They are open source, provide self hosting options, have apps for all platforms including iPhone and Android. Oh and they have a CLI tool as well. Their free tier is already really good, but I suggest to just pay the 10 bucks a year for the benefits.
2
u/Fun_Shoulder_9524 7d ago
Not sure if you are aware of the recent Bitwarden update but it's dreadful. I would be recommending Proton Pass instead.
1
u/KrypticMess 7d ago
Yeah, mainly learning project. Would wanna do this for my family and friends though where they can just self-host this whenever I get more knowledge. Not really looking to monetize or use other options at the moment 😅
7
u/turtle4499 7d ago
I wouldn’t use this for urself whatsoever. When you have more knowledge I still wouldn’t use one you wrote. That’s not how this field works. Use off the shelf verified programs.
1
u/KrypticMess 7d ago
What kind of off shelf verified programs would you suggest? I would also like more insight on why you added "that's not how this field works".
3
u/mpember 7d ago
The comment about "how this field works" is that there should be a high bar set for storing such critical data. There are a number of existing products that make it possible to securely store and share passwords.
While it may sound like an interesting project to undertake, it isn't just a simple case of chucking password protection on a plain text database and adding a UI.
Vaulwarden is an API-compatible option for hosting a Bitwarden account. You can share passwords between multiple users and the data is secured by a master password that even the server doesn't know. And the compatibility with Bitwarden clients means you already have browser addons and mobile apps available.
1
u/KrypticMess 7d ago
Gotcha. I'd like to learn more about these security standards. Got any resources you'd like to share so I'm not aimlessly searching?
1
u/tehsilentwarrior 7d ago
Have a look at GoPass. Learn it, improve it, replace it.
It’s a good project that is unmaintained. Specially the UI
1
u/DuckDatum 7d ago
I had taken up this endeavor while unemployed, but then I found a job. I’ll share some notes from the design I was going for, in case you are interested.
I was going to use RocksDB, because it’s small performant and embeddable much like SQLite—but it’s also partition-able. I wanted to implement partitions for branching. The plan was that branching could mimic environments (dev/prod/staging). It would able be possible to separate and isolate the actual passwords on the filesystem, which I liked.
I was going to organize passwords around projects. A single project gets its own location on disk somewhere, managed by my password manager of course. Something like:
~/.pypassman/{project}/{environment}/rocksdb_files
I was going to have everything wrapped in key pairs, encrypted at rest at all times. There was going to be support for system managed keys, remote keys, and user managed keys.
It was going to be set up for distributed systems. Git workflow and stuff… I gotta go though, light turned green.
-2
u/expiredUserAddress It works on my machine 7d ago
Try using nosql. It'll be fast for large database and more flexible
9
u/WalkingAFI 7d ago
For different commands like
add
,get
, andlist
, consider using subparsers instead of positional args. It will make your CLI more flexible in the future.Storing the key file in plain text without any protection for it isn’t a great idea. You probably want to have a master password for the database.