Smart Password Manager Web

• Zero-Storage Security — no passwords or secret phrases are ever stored or transmitted
• Decentralized Architecture — no central servers, no cloud dependency
• Deterministic Regeneration — passwords are recreated identically from your secret phrase
• Metadata Only — store only descriptions and verification keys
• Client-Side Generation — all cryptographic operations happen in your browser
• On-Demand Discovery — passwords exist only when you generate them

• Decentralized & Serverless — no central database, no cloud lock-in
• Smart Password Generation — deterministic from secret phrase
• Client-Side Processing — secret phrase never leaves your browser
• Cross-Platform Compatible — same passwords as desktop, CLI, and mobile apps
• Web-Based Interface — access from any device with a browser
• Secure Input — hidden secret phrase entry with show/hide toggle
• Export/Import — backup and restore your password metadata
• QR Code Export — transfer password metadata to Android app via QR code
• User Authentication — secure login with Django
• PostgreSQL Backend — reliable data storage

Prerequisites: Python 3.8+, PostgreSQL

# Clone repository
git clone https://github.com/smartlegionlab/smart-password-manager-web.git
cd smart-password-manager-web

# Create virtual environment
python -m venv venv
source venv/bin/activate

# Install dependencies
pip install --upgrade pip
pip install -r requirements.txt
pip install psycopg2-binary

# Create .env file with your settings

# Apply migrations
python manage.py migrate

# Create superuser
python manage.py createsuperuser

# Collect static files
python manage.py collectstatic

# Run development server
python manage.py runserver

Access the application at: http://localhost:8000

Powered by smartpasslib-js — JavaScript implementation of deterministic password generation.

Key derivation (same as Python/Go/Kotlin/C# versions v4.0.0):

Character Set:

!@#$%^&*()_+-=[]{};:,.<>?/ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789abcdefghijklmnopqrstuvwxyz

Validation Rules: Secret phrase: min 12 chars · Password length: 12-100 chars

Architecture:

• Backend: Django 5.2+ (auth, metadata storage, session management)
• Database: PostgreSQL
• Frontend: HTML5, CSS3, JavaScript
• Client Crypto: smartpasslib-js v4.0.0 (Web Crypto API)

Export password metadata to the Smart Password Manager Android app via QR code:

1. In the password list, click the QR button next to any password
2. A modal dialog with QR code will appear containing the password metadata
3. Open the Android app and scan the QR code
4. The password entry will be automatically added to your mobile device

What's included in QR:

• Password length
• Public verification key

What's NOT included:

• Password description (shown for reference, not embedded)
• Your secret phrase (never leaves your device)
• The actual password

Security Note: QR codes contain only metadata that is already stored on the server. Your secret phrase and actual passwords are never embedded in QR codes.

Security Model:

• Proof of Knowledge — public keys verify secrets without exposing them
• Decentralized Trust — no third party needed
• Deterministic Security — same secret + length = same password, always
• Metadata Separation — non-sensitive data stored on server
• Local Processing — secret and password never leave your browser
• No Recovery Backdoors — lost secret = permanently lost access

Secret Phrase Requirements:

• Minimum 12 characters (enforced)
• Case-sensitive
• Use mix of: uppercase, lowercase, numbers, symbols
• Never store digitally
• NEVER use your password description as secret phrase

Strong Secret Examples:

✅ "MyStrongSecretPhrase2026!"   — mixed case + numbers + symbols
✅ "P@ssw0rd!LongSecret"         — special chars + numbers + length
✅ "КотБегемот2026НаДиете"       — Cyrillic + numbers

Weak Secret Examples (avoid):

❌ "short"                       — too short, rejected
❌ "GitHub Account"              — using description as secret (weak!)
❌ "password"                    — dictionary word, too short
❌ "1234567890"                  — only digits, too short

• Pointer-Based Security Paradigm — 10.5281/zenodo.17204738
  Architectural Shift from Data Protection to Data Non-Existence
• Local Data Regeneration Paradigm — 10.5281/zenodo.17264327
  Ontological Shift from Data Transmission to Synchronous State Discovery

Smart Password Manager Web produces identical passwords to:

• Desktop Manager
• CLI PassMan / CLI PassGen
• Android Manager
• smartpasslib (Python)
• smartpasslib-go (Go)
• smartpasslib-kotlin (Kotlin)
• smartpasslib-csharp (C#)

Data transfer: Use QR codes or Export/Import to sync metadata across all platforms.

By using this software, you agree to the full disclaimer terms.

Software provided "AS IS" without warranty. You assume all risks.

Full legal disclaimer: See DISCLAIMER.md

License: BSD 3-Clause License