Smart Password Manager Web ^v4.0.0

Web-based smart password manager with deterministic password generation

Generate, manage, and retrieve passwords without storing them. Your secret phrase never leaves your browser.

Python Django PostgreSQL JavaScript Password Manager Zero-Storage

GitHub

Smart Password Manager Web — web-based smart password manager with deterministic password generation. Generate, manage, and retrieve passwords without storing them. Your secret phrase never leaves your browser.

Decentralized by Design: Unlike traditional password managers that store encrypted vaults on central servers, smartpasslib stores nothing. Your secrets never leave your device. Passwords are regenerated on-demand — no cloud, no database, no trust required. The server stores only metadata (description, length, public key) for verification — never your secret phrase or actual password.

⚠️ Breaking Change (v4.0.0)

This version uses smartpasslib-js v4.0.0, which is NOT backward compatible with v1.x.x or v2.x.x. Smart passwords created with older versions cannot be regenerated using v4.0.0.

What changed: Dynamic iterations (15-30/45-60), expanded character set, min 12 chars secret, password length limited to 100, salt separation.

📖 Full migration instructions → see MIGRATION.md

Zero-Storage Security — no passwords or secret phrases are ever stored or transmitted
Decentralized Architecture — no central servers, no cloud dependency
Deterministic Regeneration — passwords are recreated identically from your secret phrase
Metadata Only — store only descriptions and verification keys
Client-Side Generation — all cryptographic operations happen in your browser
On-Demand Discovery — passwords exist only when you generate them

Decentralized & Serverless — no central database, no cloud lock-in
Smart Password Generation — deterministic from secret phrase
Client-Side Processing — secret phrase never leaves your browser
Cross-Platform Compatible — same passwords as desktop, CLI, and mobile apps
Web-Based Interface — access from any device with a browser
Secure Input — hidden secret phrase entry with show/hide toggle
Export/Import — backup and restore your password metadata
QR Code Export — transfer password metadata to Android app via QR code
User Authentication — secure login with Django
PostgreSQL Backend — reliable data storage

Prerequisites: Python 3.8+, PostgreSQL

# Clone repository
git clone https://github.com/smartlegionlab/smart-password-manager-web.git
cd smart-password-manager-web

# Create virtual environment
python -m venv venv
source venv/bin/activate

# Install dependencies
pip install --upgrade pip
pip install -r requirements.txt
pip install psycopg2-binary

# Create .env file with your settings

# Apply migrations
python manage.py migrate

# Create superuser
python manage.py createsuperuser

# Collect static files
python manage.py collectstatic

# Run development server
python manage.py runserver

Access the application at: http://localhost:8000

Key derivation (same as Python/Go/Kotlin/C# versions v4.0.0):

Key Type	Iterations	Purpose
Private Key	15-30 (dynamic)	Password generation (never stored, never transmitted)
Public Key	45-60 (dynamic)	Verification (stored on server)

Character Set:

!@#$%^&*()_+-=[]{};:,.<>?/ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789abcdefghijklmnopqrstuvwxyz

Validation Rules: Secret phrase: min 12 chars · Password length: 12-100 chars

Architecture:

Backend: Django 5.2+ (auth, metadata storage, session management)
Database: PostgreSQL
Frontend: HTML5, CSS3, JavaScript
Client Crypto: smartpasslib-js v4.0.0 (Web Crypto API)

Export password metadata to the Smart Password Manager Android app via QR code:

In the password list, click the QR button next to any password
A modal dialog with QR code will appear containing the password metadata
Open the Android app and scan the QR code
The password entry will be automatically added to your mobile device

What's included in QR:

Password length
Public verification key

What's NOT included:

Password description (shown for reference, not embedded)
Your secret phrase (never leaves your device)
The actual password

Security Note: QR codes contain only metadata that is already stored on the server. Your secret phrase and actual passwords are never embedded in QR codes.

Security Model:

Proof of Knowledge — public keys verify secrets without exposing them
Decentralized Trust — no third party needed
Deterministic Security — same secret + length = same password, always
Metadata Separation — non-sensitive data stored on server
Local Processing — secret and password never leave your browser
No Recovery Backdoors — lost secret = permanently lost access

Secret Phrase Requirements:

Minimum 12 characters (enforced)
Case-sensitive
Use mix of: uppercase, lowercase, numbers, symbols
Never store digitally
NEVER use your password description as secret phrase

Strong Secret Examples:

✅ "MyStrongSecretPhrase2026!"   — mixed case + numbers + symbols
✅ "P@ssw0rd!LongSecret"         — special chars + numbers + length
✅ "КотБегемот2026НаДиете"       — Cyrillic + numbers

Weak Secret Examples (avoid):

❌ "short"                       — too short, rejected
❌ "GitHub Account"              — using description as secret (weak!)
❌ "password"                    — dictionary word, too short
❌ "1234567890"                  — only digits, too short

Pointer-Based Security Paradigm — 10.5281/zenodo.17204738
Architectural Shift from Data Protection to Data Non-Existence
Local Data Regeneration Paradigm — 10.5281/zenodo.17264327
Ontological Shift from Data Transmission to Synchronous State Discovery