PASSWORD MANAGER DEEP DIVE PROJECTS

Password Manager Deep Dive: From Zero to Building Your Own Secure Vault

Why This Matters

Every day, billions of people face an impossible task: remember dozens of unique, complex passwords. The human brain wasn’t designed for this. We evolved to remember faces, places, and stories—not 32-character random strings.

The Problem Password Managers Solve:

The average person has 100+ online accounts
Humans can reliably remember ~7 items in short-term memory
Password reuse leads to credential stuffing attacks (one breach compromises all accounts)
“Memorable” passwords are crackable in seconds with modern hardware

What You’ll Understand After This Learning Path:

How encryption actually protects your data (not just “it’s encrypted”)
Why the master password is the single point of failure AND the ultimate protection
How zero-knowledge architecture works (why even the company can’t read your passwords)
What key derivation functions do and why they’re critical
How password managers sync across devices securely
What happens if someone steals the encrypted database
How to evaluate password manager security claims

Core Concept Breakdown

Before building, understand these foundational pillars:

Pillar 1: The Master Password Problem

Your master password must derive a cryptographic key that encrypts everything. The challenge: passwords are weak (low entropy), but encryption needs strong keys. Key Derivation Functions (KDFs) bridge this gap by making password-to-key derivation computationally expensive.

Pillar 2: Zero-Knowledge Architecture

The password manager company stores your encrypted vault but NEVER has access to your master password or encryption key. All encryption/decryption happens on YOUR device. Even if their servers are breached, attackers only get encrypted blobs.

Pillar 3: Defense in Depth

Multiple layers of protection: KDF (slows brute-force), AES-256 encryption (protects data), HMAC (detects tampering), secure memory (protects against memory dumps), and optionally a Secret Key (protects against server-side attacks).

Pillar 4: The Trust Model

You trust: the cryptographic algorithms (AES, Argon2), the implementation (open-source helps), your device security, and your master password strength. You don’t need to trust: the company’s servers, their employees, or network security.

Project 1: Password Strength Analyzer & Entropy Calculator

File: PASSWORD_MANAGER_DEEP_DIVE_PROJECTS.md
Main Programming Language: Python
Alternative Programming Languages: Rust, Go, JavaScript
Coolness Level: Level 2: Practical but Forgettable
Business Potential: 2. The “Micro-SaaS / Pro Tool”
Difficulty: Level 1: Beginner
Knowledge Area: Cryptography / Information Theory
Software or Tool: Password Analysis Tool
Main Book: “Serious Cryptography, 2nd Edition” by Jean-Philippe Aumasson

What you’ll build: A command-line tool that calculates the true entropy (randomness) of any password and estimates crack time against various attack speeds.

Why it teaches password security: Before building a password manager, you must understand WHY certain passwords are weak. This project forces you to quantify password strength mathematically, understand character sets, and see why “P@ssw0rd!” is terrible despite looking complex.

Core challenges you’ll face:

Calculating entropy (log2 of keyspace) → maps to information theory fundamentals
Detecting common patterns (keyboard walks, dates, dictionary words) → maps to how attackers think
Estimating crack times (GPU speeds, cloud cracking farms) → maps to real-world threat modeling
Handling Unicode properly (emoji passwords, international characters) → maps to character encoding

Key Concepts:

Information Entropy: “Serious Cryptography, 2nd Edition” Chapter 1 - Jean-Philippe Aumasson
Password Cracking Techniques: “Practical Malware Analysis” Chapter 5 - Michael Sikorski
Character Encoding: “Fluent Python, 2nd Edition” Chapter 4 - Luciano Ramalho

Difficulty: Beginner Time estimate: Weekend Prerequisites: Basic programming, understanding of logarithms

Real world outcome:

$ ./entropy_calc "correct horse battery staple"
Password: correct horse battery staple
Length: 28 characters
Character Set: lowercase + space (27 chars)
Naive Entropy: 133.2 bits
Pattern Detected: 4-word passphrase
Adjusted Entropy: ~44 bits (dictionary attack)
Crack Time (10B guesses/sec): ~1.4 hours
Verdict: WEAK (use more words or add randomness)

$ ./entropy_calc "j8#kL9@mN2$pQ4"
Password: j8#kL9@mN2$pQ4
Length: 14 characters
Character Set: mixed case + digits + symbols (95 chars)
Entropy: 91.8 bits
Crack Time (10B guesses/sec): ~10^15 years
Verdict: STRONG

Implementation Hints: The core formula is: entropy = log2(charset_size ^ length) or equivalently entropy = length * log2(charset_size). But naive entropy overestimates strength for human-created passwords. You need to:

Detect if the password is in common password lists (entropy drops to nearly zero)
Identify dictionary words and calculate based on dictionary size
Recognize patterns like “123”, “abc”, “qwerty” and penalize accordingly
Consider using zxcvbn’s approach (Dropbox’s password strength estimator)

Pseudo-code:

function calculate_entropy(password):
    if password in common_passwords_list:
        return 0  # Instantly crackable

    detected_patterns = find_patterns(password)
    if detected_patterns:
        return calculate_pattern_entropy(detected_patterns)

    charset = determine_charset(password)
    return len(password) * log2(len(charset))

Learning milestones:

Calculate basic entropy → You understand keyspace and logarithms
Detect dictionary words and patterns → You think like an attacker
Estimate crack times accurately → You can evaluate real password strength

Project 2: Cryptographically Secure Password Generator

File: PASSWORD_MANAGER_DEEP_DIVE_PROJECTS.md
Main Programming Language: C
Alternative Programming Languages: Rust, Go, Python
Coolness Level: Level 3: Genuinely Clever
Business Potential: 2. The “Micro-SaaS / Pro Tool”
Difficulty: Level 2: Intermediate
Knowledge Area: Cryptography / Random Number Generation
Software or Tool: Password Generator
Main Book: “Serious Cryptography, 2nd Edition” by Jean-Philippe Aumasson

What you’ll build: A password generator that uses cryptographically secure random number generation (CSPRNG) to create truly unpredictable passwords, with options for length, character sets, and pronounceable passwords.

Why it teaches password security: Most “random” number generators are NOT suitable for security. Understanding the difference between rand() and /dev/urandom is crucial. This project teaches you why randomness matters and how to get it right.

Core challenges you’ll face:

Using the OS CSPRNG correctly (getrandom(), /dev/urandom, CryptGenRandom) → maps to secure randomness sources
Avoiding modulo bias (why random() % 62 is wrong) → maps to cryptographic correctness
Generating pronounceable passwords (without sacrificing too much entropy) → maps to usability vs security
Ensuring uniform distribution (every character equally likely) → maps to probability fundamentals

Key Concepts:

CSPRNG vs PRNG: “Serious Cryptography, 2nd Edition” Chapter 7 - Jean-Philippe Aumasson
Modulo Bias: Article “How to Generate Secure Random Numbers” - ParagonIE Blog
Entropy Sources in Linux: “The Linux Programming Interface” Chapter 7 - Michael Kerrisk

Difficulty: Intermediate Time estimate: Weekend Prerequisites: Basic C programming, understanding of randomness

Real world outcome:

$ ./pwgen --length 16 --charset alphanumeric
Generated: Kj8mN2pQr4sT6vWx

$ ./pwgen --length 20 --charset all
Generated: j8#kL9@mN2$pQ4!rS6^t

$ ./pwgen --words 4 --pronounceable
Generated: korba-munta-pilso-dreva

$ ./pwgen --length 16 --charset alphanumeric --count 5
1: Hj7nM3pLr5sK8vQw
2: Xt9bY4cZf6gA2hDe
3: Pw8qR5sT3uV7wX9y
4: Bm6nC4dF2gH8jK0l
5: Qr3sT7uV5wX9yZ1a

Implementation Hints: The critical insight is that rand() % N introduces bias when N doesn’t evenly divide the random range. For example, if your random source gives 0-255 and you want 0-61 (for 62 characters), some values appear slightly more often.

Correct approach (rejection sampling):

function secure_random_below(n):
    // Find the largest multiple of n that fits in our range
    limit = (MAX_RANDOM / n) * n

    loop:
        value = read_from_csprng()
        if value < limit:
            return value % n
        // Reject and try again (rare)

For the CSPRNG, use:

Linux/macOS: getrandom() syscall or read from /dev/urandom
Windows: CryptGenRandom() or BCryptGenRandom()

Learning milestones:

Generator produces uniform output → You understand unbiased sampling
Passes statistical randomness tests → You can verify cryptographic quality
Generates pronounceable passwords with calculable entropy → You balance usability and security

Project 3: Simple Encrypted Password Vault (CLI)

File: PASSWORD_MANAGER_DEEP_DIVE_PROJECTS.md
Main Programming Language: C
Alternative Programming Languages: Rust, Go, Python
Coolness Level: Level 3: Genuinely Clever
Business Potential: 3. The “Service & Support” Model
Difficulty: Level 3: Advanced
Knowledge Area: Cryptography / Symmetric Encryption
Software or Tool: Password Vault
Main Book: “Serious Cryptography, 2nd Edition” by Jean-Philippe Aumasson

What you’ll build: A command-line password vault that encrypts all entries with AES-256-GCM, derives the key from a master password using a KDF, and stores everything in a single encrypted file.

Why it teaches password manager fundamentals: This is the CORE of any password manager. You’ll implement the fundamental encryption loop: master password → KDF → encryption key → AES encrypt vault → store. You’ll understand exactly what “your vault is encrypted” means.

Core challenges you’ll face:

Implementing PBKDF2 correctly (iterations, salt handling) → maps to key derivation
Using AES-GCM properly (nonce handling, authenticated encryption) → maps to symmetric cryptography
Designing the vault file format (header, salt, nonce, ciphertext, tag) → maps to cryptographic protocol design
Secure memory handling (clearing passwords from RAM) → maps to operational security
Salt and nonce uniqueness (never reuse with same key) → maps to cryptographic hygiene

Key Concepts:

AES-GCM Mode: “Serious Cryptography, 2nd Edition” Chapter 8 - Jean-Philippe Aumasson
PBKDF2 Algorithm: RFC 2898 / “Practical Cryptography for Developers” - Svetlin Nakov (online)
Authenticated Encryption: “Serious Cryptography, 2nd Edition” Chapter 9 - Jean-Philippe Aumasson
Secure Coding in C: “Effective C, 2nd Edition” Chapter 10 - Robert C. Seacord

Difficulty: Advanced Time estimate: 1-2 weeks Prerequisites: C programming, basic understanding of encryption concepts

Real world outcome:

$ ./vault init
Enter master password: ********
Confirm master password: ********
Vault created at ~/.vault.enc
Using PBKDF2-SHA256 with 600000 iterations

$ ./vault add
Site: github.com
Username: myuser
Password (leave blank to generate):
Generated: Kj8mN2pQr4sT6vWx
Entry added and vault encrypted.

$ ./vault get github.com
Enter master password: ********
Username: myuser
Password: Kj8mN2pQr4sT6vWx
(Password copied to clipboard, clearing in 30 seconds)

$ ./vault list
Enter master password: ********
Entries in vault:
  1. github.com (myuser)
  2. gmail.com (myemail@gmail.com)
  3. aws.amazon.com (admin)

$ xxd ~/.vault.enc | head -5
00000000: 5641 554c 5401 0001 0927 0c00 a3b2 1f4e  VAULT....'.....N
00000010: 8c7d 2e5a 1b94 f3c8 d612 7a8b 4e2c 91f0  .}.Z......z.N,..
# Completely unreadable encrypted data

Implementation Hints: The vault file format should be:

[Magic bytes: "VAULT"] [Version: 1 byte] [KDF ID: 1 byte]
[KDF iterations: 4 bytes] [Salt: 32 bytes]
[Nonce: 12 bytes] [Ciphertext: variable] [Auth Tag: 16 bytes]

The encryption flow:

function encrypt_vault(master_password, entries):
    salt = generate_random_bytes(32)
    key = PBKDF2(master_password, salt, iterations=600000, output_len=32)

    plaintext = serialize_entries(entries)
    nonce = generate_random_bytes(12)
    ciphertext, tag = AES_GCM_encrypt(key, nonce, plaintext)

    // CRITICAL: Clear sensitive data from memory
    secure_zero(master_password)
    secure_zero(key)
    secure_zero(plaintext)

    return construct_vault_file(salt, nonce, ciphertext, tag)

Use a well-tested crypto library (OpenSSL, libsodium) rather than implementing AES yourself. The learning is in understanding HOW to use these primitives correctly, not in implementing the primitives.

Learning milestones:

Vault encrypts and decrypts successfully → You understand the basic crypto flow
Wrong password fails gracefully (auth tag verification) → You understand authenticated encryption
File format is parseable and versionable → You can design crypto protocols
Memory is securely cleared after use → You understand operational security

Project 4: Key Derivation Function Explorer

File: PASSWORD_MANAGER_DEEP_DIVE_PROJECTS.md
Main Programming Language: C
Alternative Programming Languages: Rust, Go
Coolness Level: Level 4: Hardcore Tech Flex
Business Potential: 1. The “Resume Gold”
Difficulty: Level 4: Expert
Knowledge Area: Cryptography / Key Derivation
Software or Tool: KDF Benchmarking Tool
Main Book: “Serious Cryptography, 2nd Edition” by Jean-Philippe Aumasson

What you’ll build: A tool that implements PBKDF2 from scratch, then compares it against Argon2 (using libargon2), demonstrating why memory-hard functions resist GPU/ASIC attacks.

Why it teaches password security: The KDF is the first line of defense. If someone gets your encrypted vault, the KDF is what makes brute-forcing the master password infeasible. Understanding WHY Argon2 is better than PBKDF2 requires understanding what “memory-hard” means.

Core challenges you’ll face:

Implementing PBKDF2 from the RFC (HMAC, iterations, key stretching) → maps to reading and implementing standards
Understanding memory-hardness (why RAM access is slow on GPUs) → maps to hardware security
Benchmarking GPU vs CPU (simulating attacker economics) → maps to threat modeling
Tuning Argon2 parameters (memory, iterations, parallelism) → maps to security configuration

Key Concepts:

PBKDF2 Specification: RFC 2898 - IETF
Argon2 Design: “Argon2: the memory-hard function” - Biryukov, Dinu, Khovratovich (original paper)
Memory-Hardness: “Serious Cryptography, 2nd Edition” Chapter 7 - Jean-Philippe Aumasson
GPU Architecture: Article “Why Memory-Hard Functions Are Hard on GPUs” - Deepak Gupta

Difficulty: Expert Time estimate: 1-2 weeks Prerequisites: C programming, understanding of HMAC, basic computer architecture

Real world outcome:

$ ./kdf_explorer benchmark
Testing password: "correct horse battery staple"

PBKDF2-SHA256 (600,000 iterations):
  Time: 245ms
  Memory: 0.1 MB
  Estimated GPU speedup: 100-1000x
  Crack rate (RTX 4090): ~50,000 passwords/sec

Argon2id (64MB, 3 iterations):
  Time: 250ms
  Memory: 64 MB
  Estimated GPU speedup: 2-5x (memory-bound!)
  Crack rate (RTX 4090): ~50 passwords/sec

$ ./kdf_explorer derive --algo pbkdf2 --password "test" --salt "randomsalt"
PBKDF2-SHA256 Output (hex):
  c5e478d...a3f1b2c (32 bytes)
  Iterations: 600000
  Salt: randomsalt

$ ./kdf_explorer recommend --target-time 250ms
Recommended parameters for 250ms derive time:
  PBKDF2-SHA256: 610,000 iterations
  Argon2id: m=65536 (64MB), t=3, p=1

Recommendation: Argon2id (1000x more GPU-resistant)

Implementation Hints: PBKDF2 is essentially: DK = T1 || T2 || ... || Tn where each Ti = F(Password, Salt, c, i) and:

F(Password, Salt, c, i) = U1 ^ U2 ^ ... ^ Uc

U1 = HMAC(Password, Salt || INT(i))
U2 = HMAC(Password, U1)
...
Uc = HMAC(Password, U_{c-1})

The memory-hardness insight: PBKDF2 only needs a few bytes of state, so you can run millions of instances in parallel on GPU cores. Argon2 fills a large memory buffer with pseudorandom data, then accesses it randomly. GPUs have limited memory bandwidth, so they can’t parallelize effectively.

// Simplified Argon2 concept (not actual algorithm)
function argon2_concept(password, memory_size):
    blocks = allocate(memory_size)  // 64MB+

    // Fill phase: generate blocks
    for i in 0..num_blocks:
        blocks[i] = hash(password, i, previous_blocks)

    // Random access phase: reference unpredictable positions
    for round in 0..iterations:
        for i in 0..num_blocks:
            j = random_index(blocks[i])  // Unpredictable memory access!
            blocks[i] = hash(blocks[i], blocks[j])

    return final_hash(blocks)

Learning milestones:

PBKDF2 implementation matches test vectors → You can read and implement RFCs
Understand why GPU speedup differs → You understand memory-hardness
Can recommend appropriate parameters → You can make security tradeoffs

Project 5: Secure Memory Handler Library

File: PASSWORD_MANAGER_DEEP_DIVE_PROJECTS.md
Main Programming Language: C
Alternative Programming Languages: Rust
Coolness Level: Level 4: Hardcore Tech Flex
Business Potential: 1. The “Resume Gold”
Difficulty: Level 4: Expert
Knowledge Area: Systems Programming / Security
Software or Tool: Secure Memory Library
Main Book: “The Linux Programming Interface” by Michael Kerrisk

What you’ll build: A library that allocates, locks, and securely wipes memory for sensitive data (passwords, keys), preventing them from being swapped to disk or left in RAM after use.

Why it teaches password security: Your master password and encryption keys exist in RAM during use. If the computer crashes, hibernates, or is compromised, that memory could be read. Professional password managers go to great lengths to minimize this exposure window.

Core challenges you’ll face:

Preventing memory from being swapped (mlock(), VirtualLock()) → maps to OS memory management
Securely zeroing memory (avoiding compiler optimization) → maps to low-level C quirks
Handling allocation failures gracefully → maps to defensive programming
Memory guards and canaries (detect buffer overflows) → maps to exploit mitigation

Key Concepts:

Memory Locking: “The Linux Programming Interface” Chapter 50 - Michael Kerrisk
Secure Memory Wiping: “Secure Coding in C and C++” Chapter 5 - Robert Seacord
Compiler Optimizations: “Expert C Programming” Chapter 4 - Peter van der Linden
Memory Protection: “Computer Systems: A Programmer’s Perspective” Chapter 9 - Bryant & O’Hallaron

Difficulty: Expert Time estimate: 1-2 weeks Prerequisites: C programming, understanding of virtual memory, OS concepts

Real world outcome:

// Usage example
#include "secure_mem.h"

int main() {
    // Allocate 64 bytes of locked, guarded memory
    secure_buffer_t *password = secure_alloc(64);

    if (!password) {
        fprintf(stderr, "Failed to allocate secure memory\n");
        return 1;
    }

    // Use the buffer
    read_password_from_user(password->data, password->size);
    derive_key(password->data);

    // Securely wipe and free
    secure_free(password);  // Memory is now zeros, unlocked, freed

    return 0;
}

$ ./test_secure_mem
Allocating 1KB secure buffer... OK
Memory locked (cannot swap): OK
Guard pages installed: OK
Writing test data... OK
Wiping memory... OK
Verifying zeros: OK (all 1024 bytes are 0x00)
Memory unlocked and freed: OK

$ cat /proc/self/maps | grep locked
# Shows your locked memory regions

Implementation Hints: The key challenges:

Preventing optimization of zeroing: Compilers may optimize away memset(ptr, 0, size) if they see the memory isn’t used afterward. Solutions: ```c // Method 1: Volatile function pointer typedef void (memset_t)(void *, int, size_t); static volatile memset_t memset_func = memset; memset_func(ptr, 0, size);

// Method 2: Memory barrier memset(ptr, 0, size); asm volatile(“” ::: “memory”);

// Method 3: explicit_bzero() on systems that have it explicit_bzero(ptr, size);

2. **Memory locking structure**:
```c
typedef struct {
    void *data;
    size_t size;
    void *guard_before;  // Unmapped page before data
    void *guard_after;   // Unmapped page after data
} secure_buffer_t;

secure_buffer_t *secure_alloc(size_t size):
    // Allocate with guard pages
    total = PAGE_SIZE + round_up(size, PAGE_SIZE) + PAGE_SIZE
    region = mmap(NULL, total, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0)

    // Make guard pages inaccessible
    mprotect(region, PAGE_SIZE, PROT_NONE)
    mprotect(region + PAGE_SIZE + data_size, PAGE_SIZE, PROT_NONE)

    // Lock the data region (prevent swapping)
    mlock(region + PAGE_SIZE, data_size)

    return buffer

Learning milestones:

Memory is properly locked (verify via /proc/[pid]/maps) → You understand mlock()
Guard pages catch overflows → You understand memory protection
Zeroing survives -O3 optimization → You understand compiler behavior
Library is usable in the vault project → You can build reusable components

Project 6: TOTP Authenticator (2FA Companion)

File: PASSWORD_MANAGER_DEEP_DIVE_PROJECTS.md
Main Programming Language: C
Alternative Programming Languages: Rust, Go, Python
Coolness Level: Level 3: Genuinely Clever
Business Potential: 2. The “Micro-SaaS / Pro Tool”
Difficulty: Level 2: Intermediate
Knowledge Area: Cryptography / Authentication
Software or Tool: TOTP Generator
Main Book: “Serious Cryptography, 2nd Edition” by Jean-Philippe Aumasson

What you’ll build: A TOTP (Time-based One-Time Password) generator compatible with Google Authenticator, implementing RFC 6238 from scratch.

Why it teaches password security: Many password managers now include 2FA. Understanding TOTP shows you how a shared secret + current time = one-time code. This is a beautiful example of HMAC in action.

Core challenges you’ll face:

Implementing HMAC-SHA1 (the core of TOTP) → maps to message authentication codes
Handling time synchronization (30-second windows) → maps to protocol design
Base32 decoding (how secrets are shared via QR codes) → maps to encoding standards
Truncation to 6 digits (dynamic truncation algorithm) → maps to bit manipulation

Key Concepts:

HMAC Algorithm: “Serious Cryptography, 2nd Edition” Chapter 6 - Jean-Philippe Aumasson
TOTP Specification: RFC 6238 - IETF
HOTP Specification: RFC 4226 - IETF (TOTP builds on HOTP)

Difficulty: Intermediate Time estimate: Weekend to 1 week Prerequisites: Basic crypto understanding, bit manipulation

Real world outcome:

$ ./totp add github
Enter secret (base32): JBSWY3DPEHPK3PXP
Added 'github' to TOTP database.

$ ./totp
github: 482593 (expires in 12s)
aws:    719038 (expires in 12s)
gmail:  294571 (expires in 12s)

$ ./totp github
482593
# Copies to clipboard

# The generated code matches Google Authenticator exactly!

Implementation Hints: TOTP is HOTP with counter = floor(current_time / 30). HOTP is:

function HOTP(secret, counter):
    // HMAC-SHA1 of counter with secret key
    hmac = HMAC_SHA1(secret, counter_as_8_bytes)  // 20 bytes

    // Dynamic truncation
    offset = hmac[19] & 0x0F  // Last nibble determines offset

    // Extract 4 bytes starting at offset
    code = ((hmac[offset] & 0x7F) << 24)
         | (hmac[offset+1] << 16)
         | (hmac[offset+2] << 8)
         | hmac[offset+3]

    // Take last 6 digits
    return code % 1000000

function TOTP(secret):
    counter = floor(unix_time() / 30)
    return HOTP(secret, counter)

The Base32 alphabet is: ABCDEFGHIJKLMNOPQRSTUVWXYZ234567. Each character represents 5 bits.

Learning milestones:

Generated codes match Google Authenticator → You correctly implemented RFC 6238
Codes change every 30 seconds → You understand time-based tokens
Can scan QR codes and extract secrets → You understand the otpauth:// URI format

Project 7: Password Breach Checker (k-Anonymity)

File: PASSWORD_MANAGER_DEEP_DIVE_PROJECTS.md
Main Programming Language: Python
Alternative Programming Languages: Rust, Go, JavaScript
Coolness Level: Level 3: Genuinely Clever
Business Potential: 2. The “Micro-SaaS / Pro Tool”
Difficulty: Level 2: Intermediate
Knowledge Area: Security / Privacy
Software or Tool: Breach Detection Tool
Main Book: “Foundations of Information Security” by Jason Andress

What you’ll build: A tool that checks if passwords have been exposed in data breaches using the Have I Been Pwned API, WITHOUT sending your password to anyone (using k-anonymity).

Why it teaches password security: This teaches a brilliant privacy technique: you can check if your password is breached without revealing it to the checking service. Understanding k-anonymity is essential for privacy-preserving protocols.

Core challenges you’ll face:

Understanding k-anonymity (hide in a crowd) → maps to privacy engineering
SHA-1 hashing (the format HIBP uses) → maps to hash functions
Prefix queries (send only first 5 chars of hash) → maps to protocol design
Secure comparison (don’t leak timing information) → maps to side-channel attacks

Key Concepts:

k-Anonymity: Paper “k-Anonymity: A Model for Protecting Privacy” - Sweeney
Hash Functions: “Serious Cryptography, 2nd Edition” Chapter 5 - Jean-Philippe Aumasson
HIBP API Design: Troy Hunt’s blog post on k-anonymity implementation

Difficulty: Intermediate Time estimate: Weekend Prerequisites: HTTP basics, hash function understanding

Real world outcome:

$ ./breach_check
Enter password to check: ********

Checking against known breaches (your password never leaves your device)...
SHA-1 hash: 5BAA61E4C9B93F3F0682250B6CF8331B7EE68FD8
Prefix sent to API: 5BAA6
Suffixes received: 527 potential matches

RESULT: PASSWORD FOUND IN BREACHES!
This password has appeared 9,545,824 times in data breaches.
DO NOT USE THIS PASSWORD!

$ ./breach_check
Enter password to check: ********

RESULT: Password not found in known breaches.
Note: This doesn't guarantee safety - it may appear in future breaches.

Implementation Hints: The k-anonymity protocol:

function check_password(password):
    hash = SHA1(password).to_hex().upper()  // e.g., "5BAA61E..."
    prefix = hash[0:5]   // "5BAA6"
    suffix = hash[5:]    // "1E4C9B93..."

    // Only prefix is sent to API
    response = HTTP_GET(f"https://api.pwnedpasswords.com/range/{prefix}")

    // Response contains all hashes starting with that prefix
    // Format: "SUFFIX:COUNT\n..."
    for line in response.split('\n'):
        resp_suffix, count = line.split(':')
        if constant_time_compare(suffix, resp_suffix):
            return (True, int(count))

    return (False, 0)

Why this is private: The API sees “5BAA6” but there are ~500 passwords with that prefix. It can’t tell which one you’re checking. You check the full hash locally.

Learning milestones:

Correctly queries HIBP API → You understand the protocol
Uses constant-time comparison → You prevent timing attacks
Integrates with your password manager → You build feature-complete tools

Project 8: Encrypted Vault Sync Protocol

File: PASSWORD_MANAGER_DEEP_DIVE_PROJECTS.md
Main Programming Language: Rust
Alternative Programming Languages: Go, Python
Coolness Level: Level 4: Hardcore Tech Flex
Business Potential: 4. The “Open Core” Infrastructure
Difficulty: Level 4: Expert
Knowledge Area: Distributed Systems / Cryptography
Software or Tool: Sync Server
Main Book: “Designing Data-Intensive Applications” by Martin Kleppmann

What you’ll build: A server and client that sync encrypted vaults across devices, handling conflict resolution, change detection, and efficient delta sync—all while maintaining zero-knowledge.

Why it teaches password security: This is how cloud-synced password managers work. The server stores encrypted blobs but knows nothing about contents. You’ll understand why this is secure and what the tradeoffs are.

Core challenges you’ll face:

Zero-knowledge server design (server stores only encrypted data) → maps to security architecture
Conflict resolution (two devices edit offline) → maps to distributed systems
Efficient sync (don’t re-upload entire vault for one change) → maps to protocol optimization
Authentication without revealing vault key → maps to key separation

Key Concepts:

Zero-Knowledge Architecture: Bitwarden Zero-Knowledge Whitepaper
Conflict Resolution: “Designing Data-Intensive Applications” Chapter 5 - Martin Kleppmann
End-to-End Encryption: “Serious Cryptography, 2nd Edition” Chapter 9 - Jean-Philippe Aumasson

Difficulty: Expert Time estimate: 2-4 weeks Prerequisites: Networking, cryptography basics, API design

Real world outcome:

# On Device 1
$ vault sync init --server https://my-sync-server.com
Creating account...
Derived sync key from master password.
Vault uploaded (encrypted). Server has NO access to contents.

# On Device 2
$ vault sync login --server https://my-sync-server.com
Enter master password: ********
Downloading vault...
Decrypting locally...
Vault synced! 47 entries available.

# After adding entry on Device 1
$ vault add github.com
$ vault sync push
Encrypting changes...
Uploading delta (1.2KB)...
Synced!

# On Device 2
$ vault sync pull
Downloading changes (1.2KB)...
Decrypting...
New entry: github.com

Implementation Hints: Key architecture decisions:

Separate auth from vault encryption: Use a different key derived from master password for server auth vs. vault encryption. This way, the server can verify you’re authorized without accessing vault contents.

master_password
    |
    +--[PBKDF2 with "auth" salt]--> auth_key (sent to server for login)
    |
    +--[PBKDF2 with "vault" salt]--> vault_key (never leaves device)

Delta sync with encrypted entries: Store each password entry as a separate encrypted blob with a unique ID and version number. Sync only changed entries.

Vault structure on server:
{
    "user_id": "abc123",
    "entries": {
        "entry_001": {"ciphertext": "...", "version": 3, "modified": 1699012345},
        "entry_002": {"ciphertext": "...", "version": 1, "modified": 1699012300},
        ...
    }
}

Conflict resolution: Last-write-wins is simplest. More sophisticated: keep both versions and let user resolve.

Learning milestones:

Vault syncs between two devices → You understand the basic protocol
Server restart doesn’t affect data → You have proper persistence
Concurrent edits are handled → You understand conflict resolution
Server has zero knowledge → You’ve verified the security model

Project 9: Browser Extension Password Manager

File: PASSWORD_MANAGER_DEEP_DIVE_PROJECTS.md
Main Programming Language: JavaScript/TypeScript
Alternative Programming Languages: None (browser-specific)
Coolness Level: Level 3: Genuinely Clever
Business Potential: 3. The “Service & Support” Model
Difficulty: Level 3: Advanced
Knowledge Area: Browser Security / Web Development
Software or Tool: Browser Extension
Main Book: “Bug Bounty Bootcamp” by Vickie Li

What you’ll build: A Chrome/Firefox extension that detects login forms, offers to fill saved credentials, and captures new logins—all while keeping the vault encrypted.

Why it teaches password security: Browser integration is where security meets usability. You’ll learn about the browser security model, content scripts, message passing, and why autofill is both convenient and a potential security risk.

Core challenges you’ll face:

Content script isolation (accessing page DOM safely) → maps to browser security model
Form detection (finding username/password fields) → maps to DOM manipulation
Phishing resistance (matching URLs correctly) → maps to security validation
Secure message passing (between content script, background, popup) → maps to IPC security
Clipboard handling (copy passwords, auto-clear) → maps to sensitive data handling

Key Concepts:

Browser Extension Security: Chrome Extension Security Model documentation
Content Security Policy: “Bug Bounty Bootcamp” Chapter 9 - Vickie Li
DOM Security: OWASP DOM-based XSS Prevention Cheat Sheet

Difficulty: Advanced Time estimate: 2-3 weeks Prerequisites: JavaScript, browser APIs, basic web security

Real world outcome:

[Browser shows login page for github.com]

Extension popup shows:
┌─────────────────────────────┐
│ 🔐 MyVault                  │
│ ─────────────────────────── │
│ github.com                  │
│ 👤 myusername              │
│ [Fill Login]  [Copy Pass]   │
└─────────────────────────────┘

[Clicking "Fill Login" populates the form]
[Submitting a new login shows "Save this password?"]

Implementation Hints: Extension architecture:

manifest.json
├── background.js     // Manages vault, handles encryption
├── content.js        // Injected into web pages, finds forms
├── popup/
│   ├── popup.html    // Unlock interface
│   └── popup.js      // User interaction
└── lib/
    └── crypto.js     // Encryption (use Web Crypto API)

Form detection heuristics:

function findLoginForms() {
    const forms = [];

    // Find password fields
    const passwordFields = document.querySelectorAll(
        'input[type="password"]'
    );

    for (const passField of passwordFields) {
        // Find associated username field
        const form = passField.closest('form');
        const userField = form?.querySelector(
            'input[type="text"], input[type="email"], ' +
            'input[autocomplete*="user"], input[name*="user"], ' +
            'input[name*="email"], input[name*="login"]'
        );

        if (userField) {
            forms.push({ form, userField, passField });
        }
    }

    return forms;
}

Security considerations:

Verify URL matches saved entry (prevent phishing)
Don’t autofill on HTTP pages (or warn)
Use secure messaging between content script and background
Clear clipboard after timeout

Learning milestones:

Extension detects login forms → You understand DOM traversal
Autofill works on major sites → You handle edge cases
Phishing warning works → You understand URL security
Vault remains encrypted when locked → You maintain security model

Project 10: Hardware Key Integration (FIDO2/WebAuthn)

File: PASSWORD_MANAGER_DEEP_DIVE_PROJECTS.md
Main Programming Language: Rust
Alternative Programming Languages: Go, Python
Coolness Level: Level 4: Hardcore Tech Flex
Business Potential: 3. The “Service & Support” Model
Difficulty: Level 4: Expert
Knowledge Area: Cryptography / Hardware Security
Software or Tool: FIDO2 Client
Main Book: “Serious Cryptography, 2nd Edition” by Jean-Philippe Aumasson

What you’ll build: A CLI tool that uses a YubiKey or other FIDO2 device as an additional factor for unlocking your vault, implementing the WebAuthn protocol.

Why it teaches password security: Hardware keys are the gold standard for 2FA. Understanding FIDO2/WebAuthn shows you how public-key cryptography can replace or augment passwords, and why hardware keys are phishing-resistant.

Core challenges you’ll face:

CTAP2 protocol (communicating with FIDO2 devices) → maps to protocol implementation
Public-key cryptography (signing challenges) → maps to asymmetric crypto
Attestation verification (proving key authenticity) → maps to PKI
Challenge-response flow → maps to authentication protocols

Key Concepts:

FIDO2/WebAuthn: W3C WebAuthn Specification
CTAP Protocol: FIDO Alliance CTAP2 Specification
Public Key Cryptography: “Serious Cryptography, 2nd Edition” Chapter 11 - Jean-Philippe Aumasson

Difficulty: Expert Time estimate: 2-4 weeks Prerequisites: Understanding of public-key crypto, USB protocols

Real world outcome:

$ vault setup-hardware-key
Insert your FIDO2 security key and press the button...
[LED blinks, user touches key]
Hardware key registered!
Public key stored. Your vault now requires this key to unlock.

$ vault unlock
Enter master password: ********
Touch your security key...
[LED blinks, user touches key]
Vault unlocked!

$ vault unlock  # Without key present
Enter master password: ********
ERROR: Hardware key required but not detected.
Insert your security key and try again.

Implementation Hints: The FIDO2 flow for vault decryption:

During setup: Generate a credential on the device, store the credential ID and public key
During unlock: Send a challenge, device signs it with private key, verify signature

// Setup (simplified)
function register_hardware_key():
    // Generate random challenge
    challenge = random_bytes(32)

    // Request credential creation
    // This uses CTAP2 over USB HID
    attestation = fido2_make_credential(
        rp_id = "my-password-vault",
        user_id = vault_user_id,
        challenge = challenge
    )

    // Extract and store
    credential_id = attestation.credential_id
    public_key = attestation.public_key
    store_in_vault_config(credential_id, public_key)

// Unlock (simplified)
function verify_hardware_key():
    challenge = random_bytes(32)

    assertion = fido2_get_assertion(
        rp_id = "my-password-vault",
        credential_id = stored_credential_id,
        challenge = challenge
    )

    // Verify signature using stored public key
    if verify_signature(public_key, challenge, assertion.signature):
        return True  // Key verified
    return False

Use a library like libfido2 or the ctap-hid-fido2 Rust crate to handle USB HID communication.

Learning milestones:

Can detect connected FIDO2 devices → You understand USB HID
Registration creates valid credential → You understand makeCredential
Assertion verification works → You understand the challenge-response flow
Vault requires both password and key → You’ve implemented true 2FA

File: PASSWORD_MANAGER_DEEP_DIVE_PROJECTS.md
Main Programming Language: Rust
Alternative Programming Languages: Python, Go
Coolness Level: Level 4: Hardcore Tech Flex
Business Potential: 3. The “Service & Support” Model
Difficulty: Level 4: Expert
Knowledge Area: Cryptography / Threshold Cryptography
Software or Tool: Secret Sharing Tool
Main Book: “Serious Cryptography, 2nd Edition” by Jean-Philippe Aumasson

What you’ll build: A backup and recovery system using Shamir’s Secret Sharing, allowing you to split your vault key into N shares where any K can reconstruct it (e.g., 3-of-5).

Why it teaches password security: What happens if you forget your master password? Most password managers can’t help—that’s the tradeoff of zero-knowledge. Shamir’s Secret Sharing provides a mathematical way to create recoverable backups that require multiple trusted parties.

Core challenges you’ll face:

Implementing polynomial interpolation (over finite fields) → maps to abstract algebra
Finite field arithmetic (GF(256) operations) → maps to number theory
Share distribution (how to give shares to trustees) → maps to key ceremony
Threshold schemes (why k-of-n works) → maps to threshold cryptography

Key Concepts:

Shamir’s Secret Sharing: Original paper by Adi Shamir (1979)
Finite Field Arithmetic: “Serious Cryptography, 2nd Edition” Chapter 10 - Jean-Philippe Aumasson
Polynomial Interpolation: “Concrete Mathematics” Chapter 7 - Graham, Knuth, Patashnik

Difficulty: Expert Time estimate: 1-2 weeks Prerequisites: Linear algebra basics, polynomial math

Real world outcome:

$ vault backup create --threshold 3 --shares 5
Creating 3-of-5 secret sharing scheme...

Share 1 (give to: Partner):
  SSS-1-3XkQ9mN2pRsT7uVwYz...

Share 2 (give to: Parent):
  SSS-2-7bCdEfGhJkLmNpQr...

Share 3 (give to: Sibling):
  SSS-3-2SsTtUuVvWwXxYy...

Share 4 (give to: Best Friend):
  SSS-4-8AaBbCcDdEeFfGg...

Share 5 (give to: Safety Deposit Box):
  SSS-5-4HhIiJjKkLlMmNn...

Distribute these shares. Any 3 can recover your vault key.
KEEP AT LEAST ONE YOURSELF.

$ vault backup recover
Enter share 1: SSS-1-3XkQ9mN2pRsT7uVwYz...
Enter share 2: SSS-4-8AaBbCcDdEeFfGg...
Enter share 3: SSS-2-7bCdEfGhJkLmNpQr...

Reconstructing secret...
SUCCESS! Vault key recovered.
Set new master password: ********
Vault re-encrypted with new password.

Implementation Hints: Shamir’s scheme is based on polynomial interpolation. A polynomial of degree k-1 is uniquely determined by k points.

Secret = s (a number we want to protect)
Threshold = k (shares needed to reconstruct)

// Create shares
function split(secret, k, n):
    // Random polynomial of degree k-1 with constant term = secret
    // f(x) = secret + a1*x + a2*x^2 + ... + a_{k-1}*x^{k-1}
    coefficients = [secret] + random_coefficients(k-1)

    shares = []
    for i in 1..n:
        // Each share is a point (i, f(i))
        shares.append( (i, evaluate_polynomial(coefficients, i)) )

    return shares

// Reconstruct from k shares
function combine(shares):  // shares = [(x1,y1), (x2,y2), ...]
    // Lagrange interpolation to find f(0) = secret
    secret = 0
    for (xi, yi) in shares:
        // Calculate Lagrange basis polynomial at x=0
        basis = 1
        for (xj, _) in shares:
            if xi != xj:
                basis *= (0 - xj) / (xi - xj)  // In finite field!
        secret += yi * basis
    return secret

Important: All arithmetic must be in a finite field (typically GF(256) for byte-sized secrets). This means division is multiplication by the modular inverse.

Learning milestones:

Can split and recombine a simple secret → You understand the basic scheme
k-1 shares reveal nothing → You understand information-theoretic security
Works with 32-byte encryption keys → You can protect real secrets
Integrates with vault recovery → You’ve built a complete solution

Project 12: Vault Format Parser & Migration Tool

File: PASSWORD_MANAGER_DEEP_DIVE_PROJECTS.md
Main Programming Language: Python
Alternative Programming Languages: Rust, Go
Coolness Level: Level 2: Practical but Forgettable
Business Potential: 2. The “Micro-SaaS / Pro Tool”
Difficulty: Level 2: Intermediate
Knowledge Area: Data Formats / Security
Software or Tool: Password Migration Tool
Main Book: “Fluent Python, 2nd Edition” by Luciano Ramalho

What you’ll build: A tool that parses and converts between password manager export formats (1Password, LastPass, Bitwarden, Chrome CSV), handling the various encryption and data models.

Why it teaches password security: Understanding how different password managers structure data reveals their security models. You’ll see the tradeoffs they make and why some formats are more secure than others.

Core challenges you’ll face:

Parsing multiple formats (JSON, CSV, encrypted blobs) → maps to data format handling
Handling encrypted exports (some managers encrypt exports) → maps to format-specific crypto
Field mapping (different managers store different fields) → maps to data modeling
Secure handling of plaintext (exports are often unencrypted!) → maps to operational security

Key Concepts:

Data Serialization: “Fluent Python, 2nd Edition” Chapter 20 - Luciano Ramalho
Secure File Handling: “Effective C, 2nd Edition” Chapter 10 - Robert C. Seacord

Difficulty: Intermediate Time estimate: 1 week Prerequisites: File parsing, JSON/CSV handling

Real world outcome:

$ pwmigrate detect passwords.csv
Detected format: Chrome Password Export (CSV)
Found 247 entries.

$ pwmigrate convert passwords.csv --to bitwarden --output bitwarden_import.json
Converting 247 entries...
Mapped fields:
  - url → login.uris[0].uri
  - username → login.username
  - password → login.password
  - name → name

WARNING: Chrome export is UNENCRYPTED plaintext!
Convert completed. Shredding source file...
Source file securely deleted.

Output: bitwarden_import.json (ready for Bitwarden import)

$ pwmigrate convert 1password_export.1pux --to vault --output myvault.enc
Enter 1Password export password: ********
Decrypting 1Password export...
Found 183 entries (passwords, secure notes, cards)
Enter master password for new vault: ********
Created encrypted vault: myvault.enc

Implementation Hints: Common export formats:

# Chrome CSV (UNENCRYPTED!)
# name,url,username,password
"GitHub","https://github.com/login","myuser","mypass123"

# Bitwarden JSON (unencrypted export)
{
  "items": [{
    "type": 1,  // Login
    "name": "GitHub",
    "login": {
      "uris": [{"uri": "https://github.com"}],
      "username": "myuser",
      "password": "mypass123"
    }
  }]
}

# 1Password 1PUX (encrypted archive)
# ZIP file containing encrypted JSON
# Encryption key derived from export password

Security considerations:

def convert_file(source, dest_format):
    # Read and parse
    entries = parse_source(source)

    # Convert
    output = format_for(entries, dest_format)

    # Write output
    write_output(output)

    # CRITICAL: Securely delete source if unencrypted
    if is_plaintext(source):
        secure_delete(source)  # Overwrite with random data, then delete

    # Clear from memory
    entries.clear()
    import gc; gc.collect()

Learning milestones:

Parse Chrome CSV correctly → You understand basic formats
Handle 1Password encrypted exports → You understand format-specific crypto
Secure deletion of plaintext exports → You understand operational security
Round-trip preserves all data → You handle edge cases

Project 13: Secure Clipboard Manager

File: PASSWORD_MANAGER_DEEP_DIVE_PROJECTS.md
Main Programming Language: Rust
Alternative Programming Languages: Go, C
Coolness Level: Level 3: Genuinely Clever
Business Potential: 2. The “Micro-SaaS / Pro Tool”
Difficulty: Level 3: Advanced
Knowledge Area: Systems Programming / Security
Software or Tool: Clipboard Manager
Main Book: “The Linux Programming Interface” by Michael Kerrisk

What you’ll build: A clipboard manager that intercepts password copies, stores them securely, auto-clears after a timeout, and prevents other applications from reading sensitive data.

Why it teaches password security: The clipboard is a security nightmare—any application can read it. Password managers must handle this carefully. You’ll learn about clipboard ownership, selection protocols (on Linux), and timing attacks.

Core challenges you’ll face:

Platform-specific clipboard APIs (X11 selections, Wayland, macOS pasteboard, Windows) → maps to OS interfaces
Clipboard ownership (becoming the selection owner) → maps to IPC
Auto-clear timing (clear after 30 seconds) → maps to timer management
Detecting sensitive content (was this a password?) → maps to heuristics

Key Concepts:

X11 Clipboard: ICCCM and X11 Selection Mechanism
macOS Pasteboard: Apple Pasteboard Programming Guide
Timer Management: “The Linux Programming Interface” Chapter 23 - Michael Kerrisk

Difficulty: Advanced Time estimate: 1-2 weeks Prerequisites: Systems programming, platform-specific APIs

Real world outcome:

$ secure-clip watch
Secure Clipboard Manager running...
Watching for password copies.

[User copies password from vault]

[SECURE] Password detected (from vault)
  Auto-clear in: 30 seconds
  Other apps: BLOCKED from reading

[After 30 seconds]
[SECURE] Clipboard cleared.

$ secure-clip history
Recent secure copies:
  1. [CLEARED] 2 minutes ago - github.com password
  2. [CLEARED] 5 minutes ago - aws console password

Non-sensitive copies:
  1. "Hello world" - 1 minute ago
  2. "/usr/local/bin" - 3 minutes ago

Implementation Hints: On Linux (X11), clipboard works via “selections”:

// Become the clipboard owner
fn set_clipboard(data: &[u8]) {
    // 1. Claim ownership of CLIPBOARD selection
    // 2. When another app requests it:
    //    - If it's our vault app: provide data
    //    - Otherwise: deny or provide placeholder
}

// Auto-clear implementation
fn schedule_clear(delay: Duration) {
    thread::spawn(move || {
        thread::sleep(delay);
        clear_clipboard();
        println!("[SECURE] Clipboard cleared");
    });
}

On macOS, use NSPasteboard and set concealed attribute:

// Mark content as sensitive
NSPasteboardItem *item = [[NSPasteboardItem alloc] init];
[item setString:password forType:NSPasteboardTypeString];
[item setData:[@"YES" dataUsingEncoding:NSUTF8StringEncoding]
      forType:@"org.nspasteboard.ConcealedType"];

Learning milestones:

Clipboard operations work on your platform → You understand the clipboard API
Auto-clear reliably fires → You understand timer management
Sensitive detection works → You can identify passwords
Other apps can’t snoop → You understand clipboard security

Project 14: Password Manager Audit Tool

File: PASSWORD_MANAGER_DEEP_DIVE_PROJECTS.md
Main Programming Language: Python
Alternative Programming Languages: Rust, Go
Coolness Level: Level 3: Genuinely Clever
Business Potential: 3. The “Service & Support” Model
Difficulty: Level 2: Intermediate
Knowledge Area: Security Analysis
Software or Tool: Vault Auditing Tool
Main Book: “Foundations of Information Security” by Jason Andress

What you’ll build: A tool that analyzes your password vault and generates a security report: weak passwords, reused passwords, old passwords, entries without 2FA, and breach exposure.

Why it teaches password security: Understanding what makes a vault secure requires knowing the common weaknesses. This project forces you to think about password hygiene at scale.

Core challenges you’ll face:

Detecting password reuse (exact matches and similar passwords) → maps to similarity analysis
Scoring password strength (consistent metrics) → maps to entropy calculation
Checking 2FA availability (which sites support it?) → maps to external data integration
Report generation (actionable recommendations) → maps to UX design

Key Concepts:

Password Policy: NIST SP 800-63B Guidelines
Similarity Metrics: Levenshtein distance, fuzzy matching
2FA Directory: twofactorauth.org database

Difficulty: Intermediate Time estimate: 1 week Prerequisites: Password strength understanding, basic reporting

Real world outcome:

$ vault audit

════════════════════════════════════════════════════════
         PASSWORD VAULT SECURITY AUDIT REPORT
════════════════════════════════════════════════════════

Overall Score: 67/100 (Needs Improvement)

╔════════════════════════════════════════════════════════╗
║ CRITICAL ISSUES (Fix Immediately)                      ║
╠════════════════════════════════════════════════════════╣
║ 🔴 3 passwords found in known breaches                 ║
║    - linkedin.com (exposed in 2012 breach)             ║
║    - dropbox.com (exposed in 2012 breach)              ║
║    - adobe.com (exposed in 2013 breach)                ║
║                                                        ║
║ 🔴 5 passwords reused across multiple sites            ║
║    - "Summer2023!" used on: facebook, twitter, reddit  ║
║    - "MyP@ssw0rd" used on: gmail, yahoo                ║
╚════════════════════════════════════════════════════════╝

╔════════════════════════════════════════════════════════╗
║ WARNINGS (Address Soon)                                ║
╠════════════════════════════════════════════════════════╣
║ ⚠️  12 weak passwords (< 40 bits entropy)              ║
║ ⚠️  8 passwords older than 1 year                      ║
║ ⚠️  15 sites support 2FA but you haven't enabled it    ║
║     Top priority: google.com, github.com, amazon.com   ║
╚════════════════════════════════════════════════════════╝

╔════════════════════════════════════════════════════════╗
║ GOOD PRACTICES ✓                                       ║
╠════════════════════════════════════════════════════════╣
║ ✅ 89% of passwords are unique                         ║
║ ✅ 23 accounts have 2FA enabled                        ║
║ ✅ Average password entropy: 58 bits                   ║
╚════════════════════════════════════════════════════════╝

Detailed report: ./audit_report_2024-01-15.html

Implementation Hints:

def audit_vault(vault):
    report = AuditReport()

    # Check for breached passwords (using Project 7)
    for entry in vault.entries:
        is_breached, count = check_hibp(entry.password)
        if is_breached:
            report.add_critical(f"{entry.site} password in {count} breaches")

    # Detect reuse
    password_groups = group_by_password(vault.entries)
    for password, entries in password_groups.items():
        if len(entries) > 1:
            sites = [e.site for e in entries]
            report.add_critical(f"Password reused on: {', '.join(sites)}")

    # Check strength
    for entry in vault.entries:
        entropy = calculate_entropy(entry.password)
        if entropy < 40:
            report.add_warning(f"{entry.site}: weak password ({entropy} bits)")

    # Check 2FA availability (using external database)
    twofactor_sites = load_twofactor_directory()
    for entry in vault.entries:
        if entry.site in twofactor_sites and not entry.has_2fa:
            report.add_warning(f"{entry.site} supports 2FA - consider enabling")

    return report

Learning milestones:

Identify all password issues in your vault → You understand password hygiene
Integrate with breach checker → You combine multiple tools
Generate actionable report → You think about user experience
Prioritize recommendations → You understand risk assessment

Project 15: Full-Featured Password Manager (Capstone)

File: PASSWORD_MANAGER_DEEP_DIVE_PROJECTS.md
Main Programming Language: Rust
Alternative Programming Languages: Go, C
Coolness Level: Level 5: Pure Magic
Business Potential: 4. The “Open Core” Infrastructure
Difficulty: Level 5: Master
Knowledge Area: Full Stack / Security
Software or Tool: Complete Password Manager
Main Book: Multiple (see below)

What you’ll build: A complete, production-quality password manager combining ALL the previous projects: encrypted vault, KDF, secure memory, sync, browser extension, 2FA, breach checking, and auditing.

Why it teaches password security: This is the synthesis. You’ll face real-world tradeoffs: security vs. usability, complexity vs. maintainability, features vs. attack surface. Building a complete system teaches integration skills no single project can.

Core challenges you’ll face:

Secure architecture (keeping the attack surface small) → maps to security design
Cross-platform support (Linux, macOS, Windows, mobile) → maps to portability
Code auditing (is this actually secure?) → maps to security review
Key management (multiple keys for different purposes) → maps to cryptographic hygiene
Usability (secure by default, easy to use) → maps to security UX

Key Concepts:

Secure Software Development: OWASP Secure Coding Practices
Threat Modeling: “Foundations of Information Security” - Jason Andress
Architecture: Bitwarden Architecture Documentation
Cryptography: “Serious Cryptography, 2nd Edition” - Jean-Philippe Aumasson

Difficulty: Master Time estimate: 2-3 months Prerequisites: All previous projects, software architecture experience

Real world outcome:

┌─────────────────────────────────────────────────────────┐
│                    MyVault v1.0                         │
│                Password Manager                          │
├─────────────────────────────────────────────────────────┤
│                                                          │
│  Features:                                               │
│  ✓ AES-256-GCM encryption with Argon2id KDF             │
│  ✓ Secure memory handling (locked, zeroed)              │
│  ✓ TOTP 2FA built-in                                    │
│  ✓ Browser extension (Chrome, Firefox)                  │
│  ✓ Cloud sync (zero-knowledge)                          │
│  ✓ Hardware key support (FIDO2)                         │
│  ✓ Password generator                                    │
│  ✓ Breach monitoring                                     │
│  ✓ Security audit reports                                │
│  ✓ Shamir backup/recovery                                │
│  ✓ Import from other managers                            │
│  ✓ Secure clipboard with auto-clear                      │
│                                                          │
│  Platforms: Linux, macOS, Windows                        │
│  Mobile: Android, iOS (via browser extension)            │
│                                                          │
│  Open source: github.com/you/myvault                     │
│  Security audited: [pending]                             │
│                                                          │
└─────────────────────────────────────────────────────────┘

Implementation Hints: Architecture overview:

myvault/
├── core/                  # Shared library (Rust)
│   ├── crypto/            # Encryption, KDF, secure memory
│   ├── vault/             # Vault format, entries
│   ├── sync/              # Sync protocol client
│   └── audit/             # Breach checking, auditing
│
├── cli/                   # Command-line interface
├── desktop/               # Desktop GUI (Tauri/Electron)
├── browser-ext/           # Browser extension (JS/TS)
├── server/                # Sync server (if self-hosted)
└── mobile/                # Mobile apps

Security principles to follow:

Defense in depth: Multiple layers of protection
Least privilege: Components only have access they need
Fail secure: On error, stay locked
No plaintext at rest: Everything encrypted
Memory safety: Use Rust or very careful C
Open source: Allow community review

Learning milestones:

All components integrate cleanly → You understand system design
Security review reveals no critical issues → You write secure code
Users find it usable → You balance security and UX
You use it as your daily driver → You trust your own work

Project Comparison Table

Project	Difficulty	Time	Depth of Understanding	Fun Factor
1. Password Strength Analyzer	Beginner	Weekend	⭐⭐⭐	⭐⭐⭐
2. Secure Password Generator	Intermediate	Weekend	⭐⭐⭐	⭐⭐⭐⭐
3. Encrypted Password Vault	Advanced	1-2 weeks	⭐⭐⭐⭐⭐	⭐⭐⭐⭐
4. KDF Explorer	Expert	1-2 weeks	⭐⭐⭐⭐⭐	⭐⭐⭐
5. Secure Memory Library	Expert	1-2 weeks	⭐⭐⭐⭐⭐	⭐⭐⭐
6. TOTP Authenticator	Intermediate	Weekend-1 week	⭐⭐⭐⭐	⭐⭐⭐⭐⭐
7. Breach Checker	Intermediate	Weekend	⭐⭐⭐⭐	⭐⭐⭐⭐
8. Sync Protocol	Expert	2-4 weeks	⭐⭐⭐⭐⭐	⭐⭐⭐⭐
9. Browser Extension	Advanced	2-3 weeks	⭐⭐⭐⭐	⭐⭐⭐⭐⭐
10. Hardware Key Integration	Expert	2-4 weeks	⭐⭐⭐⭐⭐	⭐⭐⭐⭐⭐
11. Shamir Secret Sharing	Expert	1-2 weeks	⭐⭐⭐⭐⭐	⭐⭐⭐⭐
12. Format Migration Tool	Intermediate	1 week	⭐⭐⭐	⭐⭐⭐
13. Secure Clipboard	Advanced	1-2 weeks	⭐⭐⭐⭐	⭐⭐⭐⭐
14. Vault Audit Tool	Intermediate	1 week	⭐⭐⭐⭐	⭐⭐⭐⭐
15. Full Password Manager	Master	2-3 months	⭐⭐⭐⭐⭐	⭐⭐⭐⭐⭐

Recommended Learning Path

For Beginners (Start Here)

Project 1: Password Strength Analyzer - Understand why passwords matter
Project 2: Secure Password Generator - Learn about randomness
Project 6: TOTP Authenticator - See crypto in action
Project 7: Breach Checker - Learn about privacy techniques

For Intermediate Developers

Project 3: Encrypted Password Vault - The core of everything
Project 14: Vault Audit Tool - Think about security holistically
Project 12: Format Migration Tool - Understand real-world formats

For Advanced Developers

Project 4: KDF Explorer - Deep cryptographic understanding
Project 5: Secure Memory Library - Systems security
Project 9: Browser Extension - Real-world integration
Project 13: Secure Clipboard - Platform-specific security

For Experts

Project 8: Sync Protocol - Distributed systems + crypto
Project 10: Hardware Key Integration - Hardware security
Project 11: Shamir Secret Sharing - Advanced crypto

Capstone

Project 15: Full Password Manager - Everything combined

Essential Resources

Primary Books

“Serious Cryptography, 2nd Edition” by Jean-Philippe Aumasson - The best practical cryptography book
“The Linux Programming Interface” by Michael Kerrisk - Systems programming fundamentals
“Designing Data-Intensive Applications” by Martin Kleppmann - For sync and distributed aspects

Specifications & Standards

Industry Whitepapers

Articles & Blogs

Summary

#	Project	Main Language
1	Password Strength Analyzer	Python
2	Cryptographically Secure Password Generator	C
3	Simple Encrypted Password Vault (CLI)	C
4	Key Derivation Function Explorer	C
5	Secure Memory Handler Library	C
6	TOTP Authenticator (2FA Companion)	C
7	Password Breach Checker (k-Anonymity)	Python
8	Encrypted Vault Sync Protocol	Rust
9	Browser Extension Password Manager	JavaScript/TypeScript
10	Hardware Key Integration (FIDO2/WebAuthn)	Rust
11	Secret Sharing Recovery System (Shamir’s)	Rust
12	Vault Format Parser & Migration Tool	Python
13	Secure Clipboard Manager	Rust
14	Password Manager Audit Tool	Python
15	Full-Featured Password Manager (Capstone)	Rust

Why This Path Works

By the end of this journey, you won’t just know that password managers are secure—you’ll understand exactly why:

Master password → KDF → encryption key: You’ll have implemented this yourself
Zero-knowledge: You’ll have built a sync server that can’t read your data
Defense in depth: You’ll understand why memory locking, hardware keys, and Shamir backup all add layers
Threat modeling: You’ll know what attackers can and can’t do with an encrypted vault
Usability tradeoffs: You’ll appreciate why certain “insecure” features exist (like clipboard)

Most importantly, you’ll be able to evaluate ANY password manager’s security claims critically. When a vendor says “military-grade encryption,” you’ll know whether that means anything. When a breach happens, you’ll understand exactly what was exposed and whether your passwords are at risk.

Build these projects, and you won’t just use password managers—you’ll truly understand them.

Password Manager Deep Dive: From Zero to Building Your Own Secure Vault

Why This Matters

Core Concept Breakdown

Pillar 1: The Master Password Problem

Pillar 2: Zero-Knowledge Architecture

Pillar 3: Defense in Depth

Pillar 4: The Trust Model

Project 1: Password Strength Analyzer & Entropy Calculator

Project 2: Cryptographically Secure Password Generator

Project 3: Simple Encrypted Password Vault (CLI)

Project 4: Key Derivation Function Explorer

Project 5: Secure Memory Handler Library

Project 6: TOTP Authenticator (2FA Companion)

Project 7: Password Breach Checker (k-Anonymity)

Project 8: Encrypted Vault Sync Protocol

Project 9: Browser Extension Password Manager

Project 10: Hardware Key Integration (FIDO2/WebAuthn)

Project 11: Secret Sharing Recovery System (Shamir’s Secret Sharing)

Project 12: Vault Format Parser & Migration Tool

Project 13: Secure Clipboard Manager

Project 14: Password Manager Audit Tool

Project 15: Full-Featured Password Manager (Capstone)

Project Comparison Table

Recommended Learning Path

For Beginners (Start Here)

For Intermediate Developers

For Advanced Developers

For Experts

Capstone

Essential Resources

Primary Books

Specifications & Standards

Industry Whitepapers

Articles & Blogs

Summary

Why This Path Works