🔐 Python Password Manager

A modular, secure, and easy-to-use password manager featuring a professional CLI interface, an interactive menu (TUI) with arrow-key navigation, full test coverage, and CI/CD.

---

🚀 Key Features

• Modular Architecture: Full separation between the cryptographic logic (core) and the CLI/storage interface.
• Interactive Menu (TUI): Running passmgr with no arguments opens an arrow-key navigation menu built with questionary and rich, offering List / Get / Add / Delete / Generate options directly from the menu.
• Strong Security: Key derivation via PBKDF2-HMAC-SHA256 (390,000 iterations by default) and Fernet symmetric encryption (AES-128-CBC + HMAC-SHA256).
• Local Encrypted Storage: The vault is stored in a single encrypted file (vault.json).
• Dedicated CLI Shortcut: Run the passmgr command directly from the terminal, with or without subcommands.
• Clipboard Integration: Quick password copying with a single keypress or a CLI flag (using pyperclip).
• Testing & CI/CD: Unit test coverage with pytest and automated PyPI deployment via GitHub Actions.

---

Project Structure 📂

PASSWORD_MANAGER/
├── .github/
│ └── workflows/
│ ├── publish.yml
│ └── test.yml
├── src/
│ └── password_manager/
│ ├── cli/
│ │ ├── __init__.py
│ │ └── main.py
│ ├── core/
│ │ ├── __init__.py
│ │ ├── crypto.py
│ │ └── vault.py
│ ├── __init__.py
│ └── interactive.py
├── tests/
│ ├── test_crypto.py
│ └── test_vault.py
├── .gitignore
├── LICENSE
├── pyproject.toml
├── README.md
└── requirements.txt

---

📦 Installation & Running

Option 1: Install from PyPI (Recommended)

pip install razeini-password-manager

Option 2: Install for Development

1. Clone the repository:

git clone https://github.com/RazEini/Password_Manager.git
cd Password_Manager

2. Install the package in editable mode:

pip install -e .

3. Run unit tests:

pip install pytest
pytest

---

🖥️ Interactive Mode (TUI)

Running the passmgr command without a subcommand opens a full interactive menu (requires rich and questionary):

passmgr
# or with a specific vault file:
passmgr --vault myvault.json

The menu automatically detects whether the vault exists:

• If it doesn't exist — it will offer to create a new vault with a master password.
• If it exists — it will prompt for the master password to unlock it.

Once unlocked, an arrow-key navigation menu is displayed with the following options:

Menu Option	Description
List All Services	Display all services saved in the vault
Get Entry	View entry details, including an option to copy the password to the clipboard
Add / Update Entry	Add a new entry or update an existing one, with an option to generate a random password
Delete Entry	Delete an entry from the vault after confirmation
Generate Random Password	Generate a random password only, without saving it to the vault
Lock & Exit	Lock the vault and exit the menu

---

💻 CLI – Main Commands (`passmgr`)

Command	Description	Example
(no command)	Open the interactive menu (TUI)	passmgr
init	Create a new encrypted Vault	passmgr init
add	Add or update a password for a service	passmgr add --service github --user myusername
get	Retrieve a password (with an option to copy to clipboard)	passmgr get --service github --copy
list	List all existing services in the vault	passmgr list
delete	Delete an entry from the vault	passmgr delete --service github
change-master	Change the master password and re-encrypt	passmgr change-master
generate	Generate a strong random password	passmgr generate --length 20
export-csv	Export passwords to a CSV file	passmgr export-csv --path backup.csv
import-csv	Import passwords from a CSV file	passmgr import-csv --path backup.csv

💡 Note on Custom Vault Names:
By default, passmgr uses vault.json in the current working directory. If you want to use a custom file name (e.g., myvault.json), append --vault <filename> to any command:

passmgr --vault myvault.json init
passmgr --vault myvault.json add --service github --user myusername

---

🛡️ Security & Key Derivation

The application never stores the master password on disk at any stage. The cryptographic key is derived in real time from the master password and the dynamic Salt stored in the Vault file. Even in interactive mode, password entry is handled via questionary.password, which masks the characters as they're typed, just like getpass does in the standard CLI mode.

---

📄 License

This project is distributed under the MIT license – free to use, modify, and distribute. For more information, see the LICENSE file.

---

👨‍💻 Raz Eini (2026)