LockIn - Password Manager

Project Overview

LockIn is a web-based password manager built on a zero-knowledge architecture: all encryption and decryption happen in the browser, so the server never sees a user's master password or plaintext data. It was developed as a Digital Security course project by a 5-person team, where I led both full-stack development and visual design.

The Security Model

Traditional password managers require trusting the provider with server-stored secrets. LockIn removes that trust:

• Key derivation — the master password never leaves the browser; PBKDF2 with a unique per-user salt derives separate encryption and verification keys.
• Client-side encryption — all sensitive data is encrypted with AES-256-GCM (Web Crypto API) before transmission; keys exist only in memory during a session.
• Server storage — the backend stores only opaque encrypted blobs and authenticates via the verification key, so a server compromise leaks nothing readable.

Architecture

• Authentication — registration generates a salt and verification key; login authenticates with the verification key, never the master password. Logout clears all cryptographic material from memory.
• Data flow — master password to key derivation to local encryption to API call to encrypted blob storage. Retrieval decrypts entirely client-side.
• Frontend — vanilla JavaScript for full control over crypto, Web Crypto API primitives, plus CSP and input sanitization against XSS.
• Backend — Firebase (Firestore for encrypted data, Storage for uploads, Auth for token-based sessions) with no server-side decryption capability.

Key Features

• Encrypted vault — full CRUD on credentials, each encrypted client-side before storage.
• Password generator — cryptographically secure generation with entropy feedback and secure clipboard handling.
• Security dashboard — password strength analysis and a calculated security score.
• Emergency deletion — multi-step confirmed vault destruction and key invalidation.
• Profile management — master-password changes trigger key re-derivation and vault re-encryption.

My Role & Design Work

Beyond the client-side cryptography and Firebase integration, I designed the full interface and a custom set of 5+ security-focused icons in Adobe Illustrator, applying a trust-oriented color palette, high-contrast accessibility, and a responsive layout consistent across browsers.

Results

• 100% client-side encryption; zero server-side password exposure (verified in testing).
• AES-256-GCM with PBKDF2 key derivation (100,000+ iterations).
• Sub-second encryption/decryption for typical vaults; cross-browser support (Chrome, Firefox, Safari, Edge) without security compromise.
• Usability testing with 12 participants confirmed the zero-knowledge model stayed intuitive.

Key Takeaways

• Client-side cryptography is fully feasible for web apps without sacrificing UX.
• Separating encryption keys from verification keys is what enables true zero-knowledge authentication.
• Browser compatibility needs careful Web Crypto feature detection, and in-memory keys must be cleared deliberately.
• User education about the security model matters as much as the cryptography itself.

Live App: lock-in-vert.vercel.app · Source: GitHub