Password manager

Centralising credentials and controlling access

SecureVault centralises credentials and encrypts secrets on the server using AES-256-GCM before storage. Authentication combines a password hashed with Argon2id and a TOTP second factor. The application includes a password generator, a security dashboard and an audit trail of sensitive actions.

Accounting for key compromise scenarios

The project considers database leaks, repeated login attempts and token reuse. Protecting stored secrets also depends on protecting the master key, which is managed on the server.

Encrypting secrets and controlling access

• —AES-256-GCM envelope encryption, versioned master key, never exposed to the client
• —Strong authentication: Argon2id + TOTP 2FA, revocable sessions and devices
• —Advanced generator, instant search and a security dashboard
• —Rate-limiting, anti-brute-force and an audit trail of sensitive actions

Tested security controls

Tests and configuration cover encrypted storage, login limits and token handling. They check these mechanisms without providing a blanket guarantee against compromise.

• —A test checks that the stored encrypted value does not contain the plaintext secret
• —Login limited to 5 attempts per minute; account locked for 15 minutes after 5 failures
• —Tokens rotated on every refresh, reuse detected; tampered tokens rejected
• —88 automated tests (69 on the API, 12 front-end unit tests, 7 end-to-end journeys), 80% minimum coverage enforced in CI