LockIn - Password Manager
A secure, zero-knowledge password manager web application with client-side encryption, designed to protect user privacy while providing seamless password management across any browser.
Role
Full Stack Developer & UI/UX Designer
Client
Academic Project - Digital Security Course
Team
5-person Team
Timeline
4 months • 2025
Skills & Tools
Skills Applied
Tools & Software
Final Results
Applications
Exploration Results
Challenges
The primary challenge was implementing a robust zero-knowledge architecture where the server never has access to user passwords or decrypted data. Ensuring proper key derivation, secure client-side encryption/decryption, and maintaining security while providing a seamless user experience across different browsers were critical technical hurdles.
Solutions
Implemented client-side key derivation using PBKDF2 with unique salts, utilized Web Crypto API for AES-256-GCM encryption/decryption, separated verification keys from encryption keys, and designed a secure authentication system that never transmits the master password to the server. All sensitive operations are performed locally in the browser.
Impact
Successfully demonstrated that secure password management can be achieved without compromising user privacy. The zero-knowledge architecture ensures that even if the server is compromised, user data remains completely secure. The project serves as a proof-of-concept for privacy-first web applications in the digital security domain.
Project Overview
LockIn is a web-based password manager built on a zero-knowledge architecture: all encryption and decryption happen in the browser, so the server never sees a user's master password or plaintext data. It was developed as a Digital Security course project by a 5-person team, where I led both full-stack development and visual design.
The Security Model
Traditional password managers require trusting the provider with server-stored secrets. LockIn removes that trust:
- Key derivation — the master password never leaves the browser; PBKDF2 with a unique per-user salt derives separate encryption and verification keys.
- Client-side encryption — all sensitive data is encrypted with AES-256-GCM (Web Crypto API) before transmission; keys exist only in memory during a session.
- Server storage — the backend stores only opaque encrypted blobs and authenticates via the verification key, so a server compromise leaks nothing readable.
Architecture
- Authentication — registration generates a salt and verification key; login authenticates with the verification key, never the master password. Logout clears all cryptographic material from memory.
- Data flow — master password to key derivation to local encryption to API call to encrypted blob storage. Retrieval decrypts entirely client-side.
- Frontend — vanilla JavaScript for full control over crypto, Web Crypto API primitives, plus CSP and input sanitization against XSS.
- Backend — Firebase (Firestore for encrypted data, Storage for uploads, Auth for token-based sessions) with no server-side decryption capability.
Key Features
- Encrypted vault — full CRUD on credentials, each encrypted client-side before storage.
- Password generator — cryptographically secure generation with entropy feedback and secure clipboard handling.
- Security dashboard — password strength analysis and a calculated security score.
- Emergency deletion — multi-step confirmed vault destruction and key invalidation.
- Profile management — master-password changes trigger key re-derivation and vault re-encryption.
My Role & Design Work
Beyond the client-side cryptography and Firebase integration, I designed the full interface and a custom set of 5+ security-focused icons in Adobe Illustrator, applying a trust-oriented color palette, high-contrast accessibility, and a responsive layout consistent across browsers.
Results
- 100% client-side encryption; zero server-side password exposure (verified in testing).
- AES-256-GCM with PBKDF2 key derivation (100,000+ iterations).
- Sub-second encryption/decryption for typical vaults; cross-browser support (Chrome, Firefox, Safari, Edge) without security compromise.
- Usability testing with 12 participants confirmed the zero-knowledge model stayed intuitive.
Key Takeaways
- Client-side cryptography is fully feasible for web apps without sacrificing UX.
- Separating encryption keys from verification keys is what enables true zero-knowledge authentication.
- Browser compatibility needs careful Web Crypto feature detection, and in-memory keys must be cleared deliberately.
- User education about the security model matters as much as the cryptography itself.
Live App: lock-in-vert.vercel.app · Source: GitHub
Project Metrics
Zero server-side password exposure
AES-256-GCM encryption implementation
100% client-side cryptography
Cross-browser compatibility achieved
Zero-knowledge architecture verified
Credits & Acknowledgments
Web Crypto API documentation by MDN
Firebase by Google
Security best practices by OWASP
Custom icons and illustrations designed in-house
Team collaboration and backend development
Academic supervision by Digital Security Course faculty
Project Tags
More Visuals
Related Projects
View all projects →
Urban Complaint Pattern Mining on NYC 311 Data (21M+ Records)
End-to-end data mining of 21.3M NYC 311 service requests, discovering a six-complaint 'interior maintenance syndrome' validated against 11M independent housing inspection records. Buildings with the full syndrome show 12-44x higher verified violation rates, holding across building-size strata and a prior time window designed to rule out administrative circularity.
Medical Anamnesis Chatbot with NLP (Chatbot PUSTU)
Production-ready medical chatbot achieving 92.61% intent classification accuracy using Multinomial Naive Bayes for Indonesian Puskesmas healthcare anamnesis workflow. Automated training data generation via Gemini Flash 2.0 API with custom NLP preprocessing pipeline built from scratch.
MyFriends - Emergency SOS & Contact Management App
Production-ready emergency SOS app with multi-layered persistent notification system (foreground + background + 60 scheduled alarms), real-time location sharing, and comprehensive contact management using Flutter and Firebase.