This question already has an answer here:
I would like to build an open source online password vault which allows users to securely store their passwords, like Keepass or roboform, but where a user can access their passwords through a website. The idea is that you can, Login to account Create a password vault Add passwords to the vault Can grant access to the vault to other users Authorised users can view their passwords and the passwords shared with them I will obviously encrypt my passwords but I am just curious as to how I manage/store my encryption keys. I am thinking of storing the the passwords on a restricted folder on a server which is unaccessible to the public, is this a good enough method? Should I store the encryption keys as plain text?