Temporarily store master password locally in online password management system

Question

I am creating an online password management system.

I store saved passwords using encryption with a master password.

In order to decrypt the password, the user needs to input the master password (as the master password is not stored on database for security reasons).

However, my issue is that let's say the user is already logged in, I don't want the user to enter his password 8 times, because he looked at 8 different passwords.

The alternative is to store the password locally, such as a cookie, for a short period of time after the user has logged in. That way he/she dosen't need to reinput their password every single time. This cookie should also be encrypted using a symmetric algorithm, where the key is only stored at the server.

Is this a good approach? Is there a better approach?

Answer 1

Take his password to decrypt a copy of the entire database; and re-encrypt that using a locally generated key, from some good seeds.

Store this 're-encryted' version locally only and use the time sensitive key to decrypt this as needed. If any changes are made then re-request the password (as you should anyway for changes) for when they are sent.