Smart Password Manager Web ^v4.0.0

• Zero-Storage Security — No passwords or secret phrases are ever stored or transmitted
• Decentralized Architecture — No central servers, no cloud dependency, no third-party trust required
• Deterministic Regeneration — Passwords are recreated identically from your secret phrase
• Metadata Only — Store only descriptions and verification keys
• Client-Side Generation — All cryptographic operations happen in your browser
• On-Demand Discovery — Passwords exist only when you generate them

• Decentralized & Serverless — No central database, no cloud lock-in, complete user sovereignty
• Smart Password Generation — Deterministic from secret phrase
• Client-Side Processing — Secret phrase never leaves your browser
• Cross-Platform Compatible — Same passwords as desktop, CLI, and mobile apps
• Public Key Verification — Verify secret knowledge without exposure
• Dynamic Iteration Counts — 15-30 for private key, 45-60 for public key
• Web-Based Interface — Access from any device with a browser
• QR Code Export — Transfer password metadata to Android app via QR code
• Export/Import — Backup and restore your password metadata
• User Authentication — Secure login with Django
• PostgreSQL Backend — Reliable data storage

⚠️ This version uses smartpasslib-js v4.0.0, which is NOT backward compatible with v1.x.x or v2.x.x

Smart passwords created with older versions cannot be regenerated using v4.0.0.

What changed:

• Dynamic iterations: private key 15-30 steps (was fixed 30), public key 45-60 steps (was fixed 60)
• Expanded Google-compatible character set (26 special chars + A-Z + a-z + 0-9)
• Secret phrases now require minimum 12 characters (was 4)
• Password length now limited to 100 characters (was 1000)
• Key derivation with salt separation ("private"/"public")

📖 Full migration instructions → see MIGRATION.md

• Proof of Knowledge — Public keys verify secrets without exposing them
• Decentralized Trust — No third party needed — you control your secrets completely
• Deterministic Security — Same secret + length = same password, always
• Metadata Separation — Non-sensitive data stored on server
• Local Processing — Secret and password never leave your browser
• No Recovery Backdoors — Lost secret = permanently lost access (by design)

Powered by smartpasslib-js — JavaScript implementation of deterministic password generation.

Character Set (Google-compatible):

!@#$%^&*()_+-=[]{};:,.<>?/ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789abcdefghijklmnopqrstuvwxyz

Validation Rules:

• Secret phrase: minimum 12 characters
• Password length: 12-100 characters

• Pointer-Based Security Paradigm — 10.5281/zenodo.17204738
  Architectural Shift from Data Protection to Data Non-Existence
• Local Data Regeneration Paradigm — 10.5281/zenodo.17264327
  Ontological Shift from Data Transmission to Synchronous State Discovery

Prerequisites: Python 3.8+, PostgreSQL

1. Install PostgreSQL:

# Arch Linux
sudo pacman -S postgresql

# Ubuntu/Debian
sudo apt-get install postgresql postgresql-contrib

2. Project Setup:

git clone https://github.com/smartlegionlab/smart-password-manager-web.git
cd smart-password-manager-web

python -m venv venv
source venv/bin/activate

pip install --upgrade pip
pip install -r requirements.txt
pip install psycopg2-binary

3. Database Configuration:

sudo -u postgres psql
CREATE DATABASE smart_password_manager_db
    OWNER postgres
    ENCODING 'UTF-8'
    LC_COLLATE 'en_US.UTF-8'
    LC_CTYPE 'en_US.UTF-8'
    TEMPLATE template0;

4. Environment Configuration (.env):

DJANGO_ENV=development
SECRET_KEY=your-generated-secret-key-here
DEBUG=True

DB_NAME=smart_password_manager_db
DB_USER=postgres
DB_PASSWORD=postgres
DB_HOST=localhost
DB_PORT=5432

5. Run:

python manage.py migrate
python manage.py createsuperuser
python manage.py collectstatic
python manage.py runserver

Access at: http://localhost:8000 | Admin: http://localhost:8000/admin

The web application allows you to export password metadata to the Smart Password Manager Android app via QR code:

How to use:

1. In the password list, click the QR button next to any password
2. A modal dialog with QR code will appear containing the password metadata
3. Open the Android app and scan the QR code
4. The password entry will be automatically added to your mobile device

What's included in QR:

• Password length
• Public verification key

What's NOT included:

• Password description (shown in dialog for reference, but not embedded in QR)
• Your secret phrase (never leaves your device)
• The actual password
• Any sensitive information

Security Note: QR codes contain only metadata that is already stored on the server. Your secret phrase and actual passwords are never embedded in QR codes.

Smart Password Manager Web produces identical passwords to:

Data transfer: Use QR codes or Export/Import to sync metadata across all platforms.

Core Libraries:

• smartpasslib — Python
• smartpasslib-js — JavaScript
• smartpasslib-kotlin — Kotlin
• smartpasslib-go — Go
• smartpasslib-csharp — C#

CLI Applications:

• CLI Smart Password Manager (Python)
• CLI Smart Password Generator (Python)
• CLI Smart Password Manager (C#)
• CLI Smart Password Generator (C#)

Desktop Applications:

• Desktop Smart Password Manager (Python)
• Desktop Smart Password Manager (C#)

Other:

• Web Smart Password Manager (this)
• Android Smart Password Manager

By using this software, you agree to the full disclaimer terms.

Software provided "AS IS" without warranty. You assume all risks.

Full legal disclaimer: See DISCLAIMER.md

License: BSD 3-Clause License