I am creating an online password management system.
I store saved passwords using encryption with a master password.
In order to decrypt the password, the user needs to input the master password (as the master password is not stored on database for security reasons).
However, my issue is that let's say the user is already logged in, I don't want the user to enter his password 8 times, because he looked at 8 different passwords.
The alternative is to store the password locally, such as a cookie, for a short period of time after the user has logged in. That way he/she dosen't need to reinput their password every single time. This cookie should also be encrypted using a symmetric algorithm, where the key is only stored at the server.
Is this a good approach? Is there a better approach?