I want to build a simple password manager for desktop whose sole purpose is to store the passwords that can be read by the user as and when required.

I am not considering any fancy features such as autofill, cloud storage, password sharing etc.

Its purpose is to just store the passwords. What are the guidelines to build such secure password manager?

closed as too broad by Stephane, Jens Erat, Mark, Gilles, RoraΖ Dec 18 '14 at 12:07

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 6
    If you're actually planning to use this, then the best guideline is: don't. People who roll their own critical security software nearly always make mistakes that leave them vulnerable. Get yourself a reputable commercial or open-source password manager. If you're just doing it as a programming exercise to learn about writing secure software then by all means go ahead. – Mike Scott Dec 18 '14 at 8:21
  • 2
    @Curious: Because a password manager is never simple. – AviD Dec 18 '14 at 8:43
  • 1
    Download and read about the ones that already exists, like KeepPass or Password Safe – Jan Doggen Dec 18 '14 at 9:22
  • 1
    @Curious Keepass is also open source, maybe download the source code and have a read to get an idea of the work required to build a basic password manager – JMK Dec 18 '14 at 11:05
  • 1
    There is no such thing as a "simple" or "basic" password manager. Unless it is broken, and worthless... – AviD Dec 18 '14 at 11:27

I agree with Mike Scott's comment that it's best to use something which is already open-source which has gone through all the research and so on. If your doing the project for learning and personal usage then start off with basics such as:

  • If you support clipboard don't forget to clear it during application been closed or after a set time period.
  • Don't leave text in memory after it's usage
  • Do good amount of research into encryption for your database and enforce a good password policy
  • Support keyfiles for higher level of security
  • Don't store any confidential information as plain text on disk
  • Don't support any network related APIs or if you do make sure you validate all your buffers to avoid any remote buffer overflows.

You could go alot more into malware targeting your software using APIs such as FindWindow to read the strings out of your application and code injection using CreateRemoteThread but I'm not too sure of how complexity you want to secure the password from been stolen via malware.

I'd recommend you look into the code of an reputable password manager which is open-source as they will of done the above and more.

I know this list doesn't cover everything but I hope it's a good starting point for you.

  • 3
    Also required is in-memory protection, and don't forget about the component properties, and if this is in .NET or Java you have to worry about immutable strings, and and and... – AviD Dec 18 '14 at 11:29

Not the answer you're looking for? Browse other questions tagged or ask your own question.