Back to projects24 / 07

Secret Vault

Local-first encrypted vault for secrets, API keys, and credentials with client-side encryption, zero-knowledge architecture, and browser extension integration.

Security / Password manager

Experimental build

AES256

SEC / VAULTCASE / 24

VERIFIED SOURCE MATERIALReact / TypeScript / Vite

01 — OVERVIEW

The premise.

Secret Vault is a privacy-focused credential manager: AES-256-GCM encryption in the browser, master key derived via PBKDF2, zero server knowledge. Includes Chromium extension for autofill, export/import, and TOTP generation.

Cloud password managers are breach targets. Local-first with client-side encryption keeps secrets on your device — no sync, no cloud, no trust required.

02 — ARCHITECTURE

How it is structured.

The repository evidence points to these observable boundaries and technologies:

React + Vite frontend
Web Crypto API (AES-256-GCM, PBKDF2)
IndexedDB for encrypted storage
Manifest V3 extension for autofill
TOTP implementation (RFC 6238)

03 — IMPLEMENTATION

From idea to system.

Master password → PBKDF2 (100k iterations) → encryption key
Per-entry AES-256-GCM with unique IV
Encrypted blob stored in IndexedDB
Extension reads/writes via native messaging
TOTP codes generated client-side
Export/import encrypted backup files

ReactTypeScriptViteWeb Crypto APIIndexedDBChromium Extension APIsTailwind CSS

04 — CHALLENGES

The difficult parts.

Web Crypto API browser compatibility
IndexedDB quota limits for large vaults
Extension native messaging host setup
Secure clipboard handling for autofill

05 — VERIFIED RESULT

What can be said honestly.

Encryption/decryption working in Chrome/Firefox
Extension autofill on credential forms
TOTP generation matching Google Authenticator
Encrypted backup/restore cycle verified

Client-side crypto is viable with Web Crypto API. Extension native messaging adds complexity but enables secure autofill without DOM injection.

View repository