Offline Password Vault Desktop App with AES-256 Encryption and Auto-Lock

Most people reuse a handful of weak passwords because remembering dozens of strong, unique ones is genuinely hard — and every breach dump proves how costly that habit is. Cloud password managers solve the memory problem but ask users to trust a third-party server with their entire credential life, and several high-profile breaches have shown why some users refuse that trade. This project takes the offline route: a desktop password vault that stores every credential in a single file encrypted with AES-256-GCM, where the encryption key is derived from one master password using PBKDF2 with 600,000 iterations and is never stored anywhere. The app locks itself after five idle minutes, generates strong passwords with an entropy readout, and wipes copied passwords from the clipboard after twenty seconds. There is no account, no server and no sync — by design, forgetting the master password means the vault cannot be recovered, which is exactly the security property the project demonstrates.

1. On first run the app creates a vault: it generates a random 16-byte salt and stores it next to the (initially empty) encrypted blob.
2. When the master password is entered, PBKDF2-HMAC-SHA256 runs 600,000 iterations over the password and salt to derive a 256-bit key; the password is then discarded from memory.
3. The key decrypts the vault blob with AES-256-GCM. A wrong password fails authentication, and the app reports "incorrect master password" without revealing anything about the contents.
4. Every save serializes all entries to JSON, generates a fresh 96-bit nonce, re-encrypts with AES-256-GCM, and writes the single vault file — so each save produces completely different ciphertext.
5. A background timer tracks input idle time; after 5 minutes it zeroes the key in memory and returns to the lock screen.
6. Copying a password starts a 20-second timer that overwrites the clipboard; the generator draws from the OS cryptographic RNG and reports the password's entropy in bits.

Tech stack:

• Python 3 (desktop application)
• Tkinter (native desktop GUI)
• cryptography package (AESGCM, PBKDF2-HMAC-SHA256)
• HTML, CSS, JavaScript (working interactive demo)
• WebCrypto API (demo encryption: AES-GCM + PBKDF2)
• Single-file encrypted vault format
• Git

• [Master-password unlock with PBKDF2] PBKDF2-HMAC-SHA256 runs 600,000 iterations over the master password and a random salt to derive the 256-bit vault key; the password itself is never stored, so there is nothing on disk worth stealing.
• [AES-256-GCM encrypted vault] All entries live in one encrypted blob. GCM authenticated encryption means a tampered vault file fails to decrypt loudly instead of silently corrupting.
• [Idle auto-lock] The vault re-locks after 5 minutes without input (configurable 1–30 minutes in the desktop build), wiping the derived key from memory.
• [Strong password generator] Cryptographically random passwords, 8–64 characters with selectable character sets, plus a live entropy-bits readout so weak choices are visible.
• [Clipboard auto-clear] Any copied password is wiped from the system clipboard after 20 seconds, limiting exposure from an unattended machine.
• [Search, categories and favorites] Instant search across titles, usernames and URLs, six categories with counts, and favorite pinning for everyday credentials.
• [Full entry management] Add, edit and delete entries (title, username, password, URL, category, notes); every save re-encrypts the whole vault with a fresh 96-bit nonce.

• Complete Python desktop application source code (Tkinter GUI + cryptography package)
• Working interactive demo mirroring the vault flow (unlock, entries, generator, auto-lock)
• Encrypted vault file-format documentation
• Project report PDF (cryptography background, threat model, design decisions, methodology)
• PPT presentation for final review
• Viva Q&A preparation document (KDFs, AES-GCM, nonces, zero-knowledge design, threat modeling)
• Setup and usage guide