Argus Password Manager

I started the password manager as one of my first non-university projects back in early 2024. Choosing what kind of project I would do took some time; I wanted something non-trivial and useful, but not too complex for me to manage. There were also other factors, I'm sure, as I kept watching videos about what kind of project to do for some months before I actually started coding.

In any case, I had a few objectives in mind when I decided on a password manager. Firstly, I wanted to learn cryptography well and work with binaries. That was certainly a success - ingrained in my mind are all the salting and Base64 issues I had to face when developing the encryption algorithm. Looking back at it, the crypto module was the only thing there that was actually useful, mostly due to its simplicity. After all, the Fernet object from Cryptography (the Python library) did almost all of the job, so there was not that much room for mistakes. Secondly, I wanted to learn SQL, more specifically PostgreSQL. I wouldn't say it was a complete success, but given that LLMs at the time were sub-optimal, I had to manually write a ton of boilerplate SQL code to be run by psycopg2, so it made it easier for me to re-learn SQL at college a few semesters later. I did make a lot of architecturally questionable choices, however, such as using Postgres stashes as a per-user division (which I later, naturally, removed). It was also a concern of mine to try and "protect" each stash independently, even though the data inside was already encrypted - some type of double-layer security I had in mind. Due to my inexperienced self, the fact that a superuser could just access any table arbitrarily made me concerned.

Well, most of these initial, problematic decisions I eventually fixed. What sealed the death sentence of this project were two factors, one relating to the other: (1) it was a CLI application in Python, and no one, not even myself, wants to use a CLI, especially nowadays when you can just vibe-code a frontend; and (2) because I don't want to touch Tkinter, PyQt, or any Python GUI framework, for any frontend I try to implement - unless I turn the Python application into a sidecar to some Tauri frontend with a SQLite database, absolutely destroying my current Docker setup - the only logical way to connect to the backend is through an API. That was the main reason why I added FastAPI to it and decided to create a small GUI frontend. And then comes the main problem: the encryption, because it was originally designed to be a CLI application, happens server-side, so any kind of non-HTTPS traffic could be intercepted and credentials - the master password - stolen. And from there it was doomed - the client-server setup just won't work with the current stack.

Technically, it is still usable. You can use an older version through the CLI, or just use my vibe-coded frontend with unsafe HTTP. If you have a sniffer reading your packets locally and intercepting the master password, you might have bigger problems than some random password manager's safety. Well, needless to say, this is just a small project for learning. There are whole companies with cybersecurity specialists and intricate architectural designs that provide password managers, and they are probably more trustworthy than whatever this is. That being said, this is as simple as it gets. Just a small symmetric encryption algorithm, and complexity is not really ideal when it comes to security.