KeyManagerApp: A Pure Local, Encrypted Key Manager

KeyManagerApp is a purely local key manager. You unlock it with a master key, it locks the moment you close it, and every entry lands in just three files on your own machine. No network, no sync, no third party. If you’re not comfortable handing your passwords to someone else’s cloud server, or you can’t see what the sync path is doing, this is what it’s for.

The GUI is built with PySide6, a real desktop window, so no more juggling browser tabs. Qt6 gives you the widgets, clipboard, and themes out of the box. The whole logic is stuffed into a single main.py: login, main view, settings, encryption and decryption all live in there. For a personal tool, being able to read it in one pass matters more than looking clean and layered.

Encryption is the core, and I didn’t roll my own. The master key first goes through Scrypt derivation (n=2^14, r=8, p=1, 16-byte random salt), and the derived key is then handed to the cryptography library’s Fernet for authenticated AES encryption. The salt is generated randomly with secrets on first run and written to salt.dat. Data is split across three files: salt.dat holds the salt, settings.dat holds the encrypted settings, and data.dat holds the entries themselves. All three go into .gitignore. If someone gets hold of data.dat without the master key and the salt, it’s just a pile of ciphertext.

Lose the master key and it’s gone for good. There’s no recovery path, that’s by design. To migrate, you move all three files together. Two paranoid settings I’m fond of: exceeding the max number of failed attempts triggers data destruction outright, and a toolbar button wipes all three files at once, irreversibly. The rest is stuff I added along the way: custom key-value pairs for storing 2FA backup codes and security questions, one-click copy, secondary verification, master-key rotation with re-encryption, a few themes and random background images.

It’s at 0.1.0 now, MIT. Mostly tested on Windows; the network features haven’t been verified on other platforms. CI only runs python -m compileall as a syntax check, and there are no automated tests yet.