basic-password-manager 0.1.0__tar.gz

basic_password_manager-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Darsh Thakur (Daisentaur)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

basic_password_manager-0.1.0/PKG-INFO

@@ -0,0 +1,183 @@
+Metadata-Version: 2.4
+Name: basic-password-manager
+Version: 0.1.0
+Summary: Local encrypted password manager that lives in your terminal
+License-Expression: MIT
+Project-URL: Repository, https://github.com/Daisentaur/password-manager
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: argon2-cffi
+Requires-Dist: cryptography
+Dynamic: license-file
+
+# pw-manager
+
+A local, encrypted password manager that lives in your terminal. No browser,
+no cloud, no daemon — one encrypted file on disk and a small Python CLI in
+front of it.
+
+```
+$ python pw.py get github
+master password:
+username: dt@example.com
+password copied to clipboard
+```
+
+## Install
+
+From PyPI (recommended — [pipx](https://pipx.pypa.io) keeps CLI tools isolated):
+
+```bash
+pipx install basic-password-manager    # or: pip install basic-password-manager
+pw init
+```
+
+From source:
+
+```bash
+git clone https://github.com/Daisentaur/password-manager && cd password-manager
+pipx install .
+```
+
+For development: `python3 -m venv venv && ./venv/bin/pip install -e .`
+
+## Usage
+
+| Command | What it does |
+|---|---|
+| `pw init` | create a new empty vault |
+| `pw add github` | store an entry (prompts for username/password/notes) |
+| `pw add github --gen` | same, but generates a strong random password |
+| `pw get github` | copy the password to the clipboard, show the username |
+| `pw ls` | list entry names |
+| `pw rm github` | delete an entry |
+| `pw find bank` | search entry names, usernames, and notes |
+| `pw gen -l 32` | just print a random password |
+| `pw import passwords.csv` | import a browser CSV export (see below) |
+
+The vault lives at `~/.local/share/pw-manager/vault`. Set the `PW_VAULT`
+environment variable to put it somewhere else.
+
+The `notes` field takes any text you want kept secret alongside the password —
+recovery codes, PINs, the answer to "what was your first pet".
+
+### Moving off browser password storage
+
+1. Export: Chrome → `chrome://password-manager/settings` → "Export passwords".
+   Firefox → `about:logins` → ⋯ menu → "Export passwords". Both produce a CSV.
+2. `pw import passwords.csv`
+3. **Delete the CSV** — it is every password you own in plaintext:
+   `shred -u passwords.csv`
+4. Turn off saving and delete saved passwords in the browser settings.
+
+## How it works
+
+Three layers, ~120 lines total. Read them in this order:
+
+### 1. `crypto.py` — password → key, key → ciphertext
+
+An AES key must be 32 unpredictable bytes; your master password is neither.
+**Argon2id** bridges the gap: `derive_key(password, salt)` always returns the
+same 32 bytes for the same inputs — that's what makes unlocking possible.
+It is deliberately slow and memory-hungry (64 MiB per guess), so an attacker
+who steals the vault file can't brute-force short passwords on a GPU the way
+they could against a plain hash.
+
+The **salt** is 16 random bytes stored *unencrypted* in the vault file. It's
+not a secret: its job is making your derived key unique so precomputed
+attack tables are useless.
+
+Encryption is **AES-256-GCM**, which is *authenticated*: decrypting with the
+wrong key, or decrypting data that was modified by even one bit, fails loudly
+instead of returning garbage. Each encryption uses a fresh random 12-byte
+**nonce** (also stored unencrypted — also not a secret). The one iron rule of
+GCM is that a (key, nonce) pair must never repeat, which is why it's random
+every time.
+
+### 2. `vault.py` — the file format
+
+```
+[4 bytes "PWV1"][16-byte salt][12-byte nonce][ciphertext...]
+```
+
+The ciphertext is just your entries as JSON, encrypted. Load = read →
+derive key → decrypt → `json.loads`. Save = the reverse, with a fresh salt
+and nonce, written to a temp file and atomically renamed so a crash mid-write
+can't destroy the vault.
+
+Your master password is never stored anywhere, in any form. "Wrong password"
+is detected purely by GCM authentication failing.
+
+### 3. `cli.py` — the CLI
+
+argparse subcommands over the two modules above. Passwords are copied to the
+clipboard (`wl-copy`/`xclip`/`xsel`, whichever exists) rather than printed,
+so they don't sit in your terminal scrollback. `find` searches names,
+usernames, and notes — deliberately *not* passwords, so fragments of secrets
+never land in your shell history.
+
+## Backups
+
+Every save automatically keeps the previous version as `vault.bak` next to
+the vault — one-step undo if a save goes wrong or you delete the wrong entry.
+
+That protects against mistakes, not against the disk dying. For that, the
+vault is one file: copy it anywhere — another disk, a USB stick, even
+somewhere untrusted, since it's useless without the master password.
+
+```bash
+cp ~/.local/share/pw-manager/vault /some/backup/location/
+```
+
+## Troubleshooting
+
+**"I forgot the master password."** The data is gone. Not "gone until support
+resets it" — mathematically gone; that's the entire design. This is why you
+keep the master password memorable (a long passphrase beats `Tr0ub4dor&3`)
+and why backups protect you from file loss but not from forgetting.
+
+**"wrong master password (or the vault file is corrupted)"** — 99% of the
+time it's a typo'd password. If you're *certain* the password is right, the
+file was damaged; restore the automatic backup
+(`cp ~/.local/share/pw-manager/vault.bak ~/.local/share/pw-manager/vault`)
+or an off-machine copy.
+
+**Deleted or overwrote an entry by mistake** — the state before your last
+save is in `vault.bak`; restore it as above. Only one generation is kept, so
+do it before the next save.
+
+**"not a vault file (bad magic bytes)"** — the file at the vault path isn't
+one of ours (truncated, overwritten, or wrong path). Check `echo $PW_VAULT`
+and restore from a backup.
+
+**"no vault at ..."** — run `pw init`, or `PW_VAULT` points somewhere
+unexpected.
+
+**Password gets printed instead of copied** — no clipboard tool was found.
+Install one: `sudo apt install wl-clipboard` (Wayland) or `xclip` (X11).
+
+**Unlock feels slow (~1s)** — that's Argon2 doing its job; the delay is the
+brute-force resistance. It's per-command, not per-keystroke.
+
+**`MemoryError` from Argon2** — the KDF needs 64 MiB free; something is
+eating your RAM.
+
+**Import brought in junk entries** — browser CSVs include everything, even
+ancient accounts. `pw rm <name>` the ones you don't want, or edit the CSV
+before importing.
+
+## Honest limitations
+
+- No clipboard auto-clear: the password stays on the clipboard until you copy
+  over it. Copy something else when you're done.
+- While a command runs, decrypted data briefly exists in process memory.
+  Malware already on your machine could read it — true of every password
+  manager; the vault protects the file at rest, not a compromised machine.
+- Single file, no sync. Syncing is your problem (and `cp` is a fine answer).
+
+## Running the checks
+
+```bash
+./venv/bin/python test_vault.py
+```

basic_password_manager-0.1.0/README.md

@@ -0,0 +1,170 @@
+# pw-manager
+
+A local, encrypted password manager that lives in your terminal. No browser,
+no cloud, no daemon — one encrypted file on disk and a small Python CLI in
+front of it.
+
+```
+$ python pw.py get github
+master password:
+username: dt@example.com
+password copied to clipboard
+```
+
+## Install
+
+From PyPI (recommended — [pipx](https://pipx.pypa.io) keeps CLI tools isolated):
+
+```bash
+pipx install basic-password-manager    # or: pip install basic-password-manager
+pw init
+```
+
+From source:
+
+```bash
+git clone https://github.com/Daisentaur/password-manager && cd password-manager
+pipx install .
+```
+
+For development: `python3 -m venv venv && ./venv/bin/pip install -e .`
+
+## Usage
+
+| Command | What it does |
+|---|---|
+| `pw init` | create a new empty vault |
+| `pw add github` | store an entry (prompts for username/password/notes) |
+| `pw add github --gen` | same, but generates a strong random password |
+| `pw get github` | copy the password to the clipboard, show the username |
+| `pw ls` | list entry names |
+| `pw rm github` | delete an entry |
+| `pw find bank` | search entry names, usernames, and notes |
+| `pw gen -l 32` | just print a random password |
+| `pw import passwords.csv` | import a browser CSV export (see below) |
+
+The vault lives at `~/.local/share/pw-manager/vault`. Set the `PW_VAULT`
+environment variable to put it somewhere else.
+
+The `notes` field takes any text you want kept secret alongside the password —
+recovery codes, PINs, the answer to "what was your first pet".
+
+### Moving off browser password storage
+
+1. Export: Chrome → `chrome://password-manager/settings` → "Export passwords".
+   Firefox → `about:logins` → ⋯ menu → "Export passwords". Both produce a CSV.
+2. `pw import passwords.csv`
+3. **Delete the CSV** — it is every password you own in plaintext:
+   `shred -u passwords.csv`
+4. Turn off saving and delete saved passwords in the browser settings.
+
+## How it works
+
+Three layers, ~120 lines total. Read them in this order:
+
+### 1. `crypto.py` — password → key, key → ciphertext
+
+An AES key must be 32 unpredictable bytes; your master password is neither.
+**Argon2id** bridges the gap: `derive_key(password, salt)` always returns the
+same 32 bytes for the same inputs — that's what makes unlocking possible.
+It is deliberately slow and memory-hungry (64 MiB per guess), so an attacker
+who steals the vault file can't brute-force short passwords on a GPU the way
+they could against a plain hash.
+
+The **salt** is 16 random bytes stored *unencrypted* in the vault file. It's
+not a secret: its job is making your derived key unique so precomputed
+attack tables are useless.
+
+Encryption is **AES-256-GCM**, which is *authenticated*: decrypting with the
+wrong key, or decrypting data that was modified by even one bit, fails loudly
+instead of returning garbage. Each encryption uses a fresh random 12-byte
+**nonce** (also stored unencrypted — also not a secret). The one iron rule of
+GCM is that a (key, nonce) pair must never repeat, which is why it's random
+every time.
+
+### 2. `vault.py` — the file format
+
+```
+[4 bytes "PWV1"][16-byte salt][12-byte nonce][ciphertext...]
+```
+
+The ciphertext is just your entries as JSON, encrypted. Load = read →
+derive key → decrypt → `json.loads`. Save = the reverse, with a fresh salt
+and nonce, written to a temp file and atomically renamed so a crash mid-write
+can't destroy the vault.
+
+Your master password is never stored anywhere, in any form. "Wrong password"
+is detected purely by GCM authentication failing.
+
+### 3. `cli.py` — the CLI
+
+argparse subcommands over the two modules above. Passwords are copied to the
+clipboard (`wl-copy`/`xclip`/`xsel`, whichever exists) rather than printed,
+so they don't sit in your terminal scrollback. `find` searches names,
+usernames, and notes — deliberately *not* passwords, so fragments of secrets
+never land in your shell history.
+
+## Backups
+
+Every save automatically keeps the previous version as `vault.bak` next to
+the vault — one-step undo if a save goes wrong or you delete the wrong entry.
+
+That protects against mistakes, not against the disk dying. For that, the
+vault is one file: copy it anywhere — another disk, a USB stick, even
+somewhere untrusted, since it's useless without the master password.
+
+```bash
+cp ~/.local/share/pw-manager/vault /some/backup/location/
+```
+
+## Troubleshooting
+
+**"I forgot the master password."** The data is gone. Not "gone until support
+resets it" — mathematically gone; that's the entire design. This is why you
+keep the master password memorable (a long passphrase beats `Tr0ub4dor&3`)
+and why backups protect you from file loss but not from forgetting.
+
+**"wrong master password (or the vault file is corrupted)"** — 99% of the
+time it's a typo'd password. If you're *certain* the password is right, the
+file was damaged; restore the automatic backup
+(`cp ~/.local/share/pw-manager/vault.bak ~/.local/share/pw-manager/vault`)
+or an off-machine copy.
+
+**Deleted or overwrote an entry by mistake** — the state before your last
+save is in `vault.bak`; restore it as above. Only one generation is kept, so
+do it before the next save.
+
+**"not a vault file (bad magic bytes)"** — the file at the vault path isn't
+one of ours (truncated, overwritten, or wrong path). Check `echo $PW_VAULT`
+and restore from a backup.
+
+**"no vault at ..."** — run `pw init`, or `PW_VAULT` points somewhere
+unexpected.
+
+**Password gets printed instead of copied** — no clipboard tool was found.
+Install one: `sudo apt install wl-clipboard` (Wayland) or `xclip` (X11).
+
+**Unlock feels slow (~1s)** — that's Argon2 doing its job; the delay is the
+brute-force resistance. It's per-command, not per-keystroke.
+
+**`MemoryError` from Argon2** — the KDF needs 64 MiB free; something is
+eating your RAM.
+
+**Import brought in junk entries** — browser CSVs include everything, even
+ancient accounts. `pw rm <name>` the ones you don't want, or edit the CSV
+before importing.
+
+## Honest limitations
+
+- No clipboard auto-clear: the password stays on the clipboard until you copy
+  over it. Copy something else when you're done.
+- While a command runs, decrypted data briefly exists in process memory.
+  Malware already on your machine could read it — true of every password
+  manager; the vault protects the file at rest, not a compromised machine.
+- Single file, no sync. Syncing is your problem (and `cp` is a fine answer).
+
+## Running the checks
+
+```bash
+./venv/bin/python test_vault.py
+```

basic_password_manager-0.1.0/basic_password_manager.egg-info/PKG-INFO

@@ -0,0 +1,183 @@
+Metadata-Version: 2.4
+Name: basic-password-manager
+Version: 0.1.0
+Summary: Local encrypted password manager that lives in your terminal
+License-Expression: MIT
+Project-URL: Repository, https://github.com/Daisentaur/password-manager
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: argon2-cffi
+Requires-Dist: cryptography
+Dynamic: license-file
+
+# pw-manager
+
+A local, encrypted password manager that lives in your terminal. No browser,
+no cloud, no daemon — one encrypted file on disk and a small Python CLI in
+front of it.
+
+```
+$ python pw.py get github
+master password:
+username: dt@example.com
+password copied to clipboard
+```
+
+## Install
+
+From PyPI (recommended — [pipx](https://pipx.pypa.io) keeps CLI tools isolated):
+
+```bash
+pipx install basic-password-manager    # or: pip install basic-password-manager
+pw init
+```
+
+From source:
+
+```bash
+git clone https://github.com/Daisentaur/password-manager && cd password-manager
+pipx install .
+```
+
+For development: `python3 -m venv venv && ./venv/bin/pip install -e .`
+
+## Usage
+
+| Command | What it does |
+|---|---|
+| `pw init` | create a new empty vault |
+| `pw add github` | store an entry (prompts for username/password/notes) |
+| `pw add github --gen` | same, but generates a strong random password |
+| `pw get github` | copy the password to the clipboard, show the username |
+| `pw ls` | list entry names |
+| `pw rm github` | delete an entry |
+| `pw find bank` | search entry names, usernames, and notes |
+| `pw gen -l 32` | just print a random password |
+| `pw import passwords.csv` | import a browser CSV export (see below) |
+
+The vault lives at `~/.local/share/pw-manager/vault`. Set the `PW_VAULT`
+environment variable to put it somewhere else.
+
+The `notes` field takes any text you want kept secret alongside the password —
+recovery codes, PINs, the answer to "what was your first pet".
+
+### Moving off browser password storage
+
+1. Export: Chrome → `chrome://password-manager/settings` → "Export passwords".
+   Firefox → `about:logins` → ⋯ menu → "Export passwords". Both produce a CSV.
+2. `pw import passwords.csv`
+3. **Delete the CSV** — it is every password you own in plaintext:
+   `shred -u passwords.csv`
+4. Turn off saving and delete saved passwords in the browser settings.
+
+## How it works
+
+Three layers, ~120 lines total. Read them in this order:
+
+### 1. `crypto.py` — password → key, key → ciphertext
+
+An AES key must be 32 unpredictable bytes; your master password is neither.
+**Argon2id** bridges the gap: `derive_key(password, salt)` always returns the
+same 32 bytes for the same inputs — that's what makes unlocking possible.
+It is deliberately slow and memory-hungry (64 MiB per guess), so an attacker
+who steals the vault file can't brute-force short passwords on a GPU the way
+they could against a plain hash.
+
+The **salt** is 16 random bytes stored *unencrypted* in the vault file. It's
+not a secret: its job is making your derived key unique so precomputed
+attack tables are useless.
+
+Encryption is **AES-256-GCM**, which is *authenticated*: decrypting with the
+wrong key, or decrypting data that was modified by even one bit, fails loudly
+instead of returning garbage. Each encryption uses a fresh random 12-byte
+**nonce** (also stored unencrypted — also not a secret). The one iron rule of
+GCM is that a (key, nonce) pair must never repeat, which is why it's random
+every time.
+
+### 2. `vault.py` — the file format
+
+```
+[4 bytes "PWV1"][16-byte salt][12-byte nonce][ciphertext...]
+```
+
+The ciphertext is just your entries as JSON, encrypted. Load = read →
+derive key → decrypt → `json.loads`. Save = the reverse, with a fresh salt
+and nonce, written to a temp file and atomically renamed so a crash mid-write
+can't destroy the vault.
+
+Your master password is never stored anywhere, in any form. "Wrong password"
+is detected purely by GCM authentication failing.
+
+### 3. `cli.py` — the CLI
+
+argparse subcommands over the two modules above. Passwords are copied to the
+clipboard (`wl-copy`/`xclip`/`xsel`, whichever exists) rather than printed,
+so they don't sit in your terminal scrollback. `find` searches names,
+usernames, and notes — deliberately *not* passwords, so fragments of secrets
+never land in your shell history.
+
+## Backups
+
+Every save automatically keeps the previous version as `vault.bak` next to
+the vault — one-step undo if a save goes wrong or you delete the wrong entry.
+
+That protects against mistakes, not against the disk dying. For that, the
+vault is one file: copy it anywhere — another disk, a USB stick, even
+somewhere untrusted, since it's useless without the master password.
+
+```bash
+cp ~/.local/share/pw-manager/vault /some/backup/location/
+```
+
+## Troubleshooting
+
+**"I forgot the master password."** The data is gone. Not "gone until support
+resets it" — mathematically gone; that's the entire design. This is why you
+keep the master password memorable (a long passphrase beats `Tr0ub4dor&3`)
+and why backups protect you from file loss but not from forgetting.
+
+**"wrong master password (or the vault file is corrupted)"** — 99% of the
+time it's a typo'd password. If you're *certain* the password is right, the
+file was damaged; restore the automatic backup
+(`cp ~/.local/share/pw-manager/vault.bak ~/.local/share/pw-manager/vault`)
+or an off-machine copy.
+
+**Deleted or overwrote an entry by mistake** — the state before your last
+save is in `vault.bak`; restore it as above. Only one generation is kept, so
+do it before the next save.
+
+**"not a vault file (bad magic bytes)"** — the file at the vault path isn't
+one of ours (truncated, overwritten, or wrong path). Check `echo $PW_VAULT`
+and restore from a backup.
+
+**"no vault at ..."** — run `pw init`, or `PW_VAULT` points somewhere
+unexpected.
+
+**Password gets printed instead of copied** — no clipboard tool was found.
+Install one: `sudo apt install wl-clipboard` (Wayland) or `xclip` (X11).
+
+**Unlock feels slow (~1s)** — that's Argon2 doing its job; the delay is the
+brute-force resistance. It's per-command, not per-keystroke.
+
+**`MemoryError` from Argon2** — the KDF needs 64 MiB free; something is
+eating your RAM.
+
+**Import brought in junk entries** — browser CSVs include everything, even
+ancient accounts. `pw rm <name>` the ones you don't want, or edit the CSV
+before importing.
+
+## Honest limitations
+
+- No clipboard auto-clear: the password stays on the clipboard until you copy
+  over it. Copy something else when you're done.
+- While a command runs, decrypted data briefly exists in process memory.
+  Malware already on your machine could read it — true of every password
+  manager; the vault protects the file at rest, not a compromised machine.
+- Single file, no sync. Syncing is your problem (and `cp` is a fine answer).
+
+## Running the checks
+
+```bash
+./venv/bin/python test_vault.py
+```

basic_password_manager-0.1.0/basic_password_manager.egg-info/SOURCES.txt

@@ -0,0 +1,13 @@
+LICENSE
+README.md
+pyproject.toml
+basic_password_manager.egg-info/PKG-INFO
+basic_password_manager.egg-info/SOURCES.txt
+basic_password_manager.egg-info/dependency_links.txt
+basic_password_manager.egg-info/entry_points.txt
+basic_password_manager.egg-info/requires.txt
+basic_password_manager.egg-info/top_level.txt
+pw_manager/__init__.py
+pw_manager/cli.py
+pw_manager/crypto.py
+pw_manager/vault.py

basic_password_manager-0.1.0/basic_password_manager.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

basic_password_manager-0.1.0/basic_password_manager.egg-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+pw = pw_manager.cli:main

basic_password_manager-0.1.0/basic_password_manager.egg-info/requires.txt

@@ -0,0 +1,2 @@
+argon2-cffi
+cryptography

basic_password_manager-0.1.0/basic_password_manager.egg-info/top_level.txt

@@ -0,0 +1 @@
+pw_manager

basic_password_manager-0.1.0/pw_manager/cli.py

@@ -0,0 +1,174 @@
+"""CLI for the vault. Installed as the `pw` command."""
+
+import argparse
+import csv
+import getpass
+import os
+import secrets
+import shutil
+import string
+import subprocess
+import sys
+from urllib.parse import urlparse
+
+from . import vault
+
+VAULT_PATH = os.environ.get(
+    "PW_VAULT", os.path.expanduser("~/.local/share/pw-manager/vault")
+)
+
+
+def generate(length: int = 20) -> str:
+    alphabet = string.ascii_letters + string.digits + "!@#$%^&*-_=+"
+    return "".join(secrets.choice(alphabet) for _ in range(length))
+
+
+def to_clipboard(text: str) -> bool:
+    # ponytail: no auto-clear timer; clear manually or copy something else over it
+    for cmd in (["wl-copy"], ["xclip", "-selection", "clipboard"], ["xsel", "-b"]):
+        if shutil.which(cmd[0]):
+            subprocess.run(cmd, input=text.encode(), check=True)
+            return True
+    return False
+
+
+def ask_master(confirm: bool = False) -> str:
+    pw = getpass.getpass("master password: ")
+    if confirm:
+        if getpass.getpass("confirm master password: ") != pw:
+            sys.exit("passwords do not match")
+        if len(pw) < 8:
+            sys.exit("master password must be at least 8 characters")
+    return pw
+
+
+def cmd_init(args):
+    if os.path.exists(VAULT_PATH):
+        sys.exit(f"vault already exists at {VAULT_PATH}")
+    os.makedirs(os.path.dirname(VAULT_PATH), exist_ok=True)
+    vault.save(VAULT_PATH, ask_master(confirm=True), {})
+    print(f"empty vault created at {VAULT_PATH}")
+
+
+def cmd_add(args):
+    master = ask_master()
+    entries = vault.load(VAULT_PATH, master)
+    if args.name in entries and input(f"'{args.name}' exists, overwrite? [y/N] ").lower() != "y":
+        sys.exit("aborted")
+    user = input("username: ")
+    if args.gen:
+        pw = generate()
+        print("generated a 20-character password")
+    else:
+        pw = getpass.getpass("password: ")
+    notes = input("notes (optional): ")
+    entries[args.name] = {"user": user, "pw": pw, "notes": notes}
+    vault.save(VAULT_PATH, master, entries)
+    print(f"stored '{args.name}'")
+    if args.gen and to_clipboard(pw):
+        print("password copied to clipboard")
+
+
+def cmd_get(args):
+    entries = vault.load(VAULT_PATH, ask_master())
+    if args.name not in entries:
+        sys.exit(f"no entry '{args.name}' — try 'ls'")
+    e = entries[args.name]
+    print(f"username: {e['user']}")
+    if e.get("notes"):
+        print(f"notes:    {e['notes']}")
+    if to_clipboard(e["pw"]):
+        print("password copied to clipboard")
+    else:
+        # no clipboard tool found; showing it is the only option left
+        print(f"password: {e['pw']}")
+
+
+def cmd_ls(args):
+    entries = vault.load(VAULT_PATH, ask_master())
+    for name in sorted(entries):
+        print(name)
+    if not entries:
+        print("(vault is empty)")
+
+
+def cmd_rm(args):
+    master = ask_master()
+    entries = vault.load(VAULT_PATH, master)
+    if args.name not in entries:
+        sys.exit(f"no entry '{args.name}'")
+    del entries[args.name]
+    vault.save(VAULT_PATH, master, entries)
+    print(f"removed '{args.name}'")
+
+
+def cmd_gen(args):
+    print(generate(args.length))
+
+
+def cmd_find(args):
+    """Substring search over names, usernames, notes — deliberately not over
+    passwords: a password fragment typed as an argument lands in shell history."""
+    entries = vault.load(VAULT_PATH, ask_master())
+    term = args.term.lower()
+    hits = {
+        name: e
+        for name, e in sorted(entries.items())
+        if term in name.lower()
+        or term in e["user"].lower()
+        or term in e.get("notes", "").lower()
+    }
+    for name, e in hits.items():
+        print(f"{name}  ({e['user']})")
+    if not hits:
+        sys.exit(f"nothing matches '{args.term}'")
+
+
+def cmd_import(args):
+    """Browser CSV export (Chrome: name,url,username,password / Firefox: url,...)."""
+    master = ask_master()
+    entries = vault.load(VAULT_PATH, master)
+    added = 0
+    with open(args.csv_file, newline="") as f:
+        for row in csv.DictReader(f):
+            name = row.get("name") or urlparse(row.get("url", "")).netloc
+            pw = row.get("password")
+            if not name or not pw:
+                continue
+            entries[name] = {"user": row.get("username", ""), "pw": pw, "notes": ""}
+            added += 1
+    vault.save(VAULT_PATH, master, entries)
+    print(f"imported {added} entries — now delete {args.csv_file} securely")
+
+
+def main():
+    p = argparse.ArgumentParser(description="local encrypted password manager")
+    sub = p.add_subparsers(dest="command", required=True)
+
+    sub.add_parser("init", help="create a new empty vault")
+    a = sub.add_parser("add", help="add or update an entry")
+    a.add_argument("name")
+    a.add_argument("--gen", action="store_true", help="generate the password")
+    g = sub.add_parser("get", help="copy an entry's password to clipboard")
+    g.add_argument("name")
+    sub.add_parser("ls", help="list entry names")
+    r = sub.add_parser("rm", help="delete an entry")
+    r.add_argument("name")
+    n = sub.add_parser("gen", help="print a random password")
+    n.add_argument("-l", "--length", type=int, default=20)
+    f = sub.add_parser("find", help="search entry names, usernames, notes")
+    f.add_argument("term")
+    i = sub.add_parser("import", help="import a browser CSV export")
+    i.add_argument("csv_file")
+
+    args = p.parse_args()
+    try:
+        globals()[f"cmd_{args.command}"](args)
+    except vault.VaultError as e:
+        sys.exit(str(e))
+    except KeyboardInterrupt:
+        sys.exit("\naborted")
+
+
+if __name__ == "__main__":
+    main()

basic_password_manager-0.1.0/pw_manager/crypto.py

@@ -0,0 +1,34 @@
+"""Key derivation and authenticated encryption. No vault knowledge here."""
+
+import os
+
+from argon2.low_level import Type, hash_secret_raw
+from cryptography.hazmat.primitives.ciphers.aead import AESGCM
+
+SALT_LEN = 16
+NONCE_LEN = 12  # AES-GCM standard nonce size
+KEY_LEN = 32  # AES-256
+
+
+def derive_key(password: str, salt: bytes) -> bytes:
+    """Stretch a master password into a 32-byte key. Same inputs -> same key."""
+    return hash_secret_raw(
+        secret=password.encode(),
+        salt=salt,
+        time_cost=3,
+        memory_cost=64 * 1024,  # 64 MiB — what makes GPU brute-force expensive
+        parallelism=4,
+        hash_len=KEY_LEN,
+        type=Type.ID,  # Argon2id
+    )
+
+
+def encrypt(key: bytes, plaintext: bytes) -> bytes:
+    """Returns nonce + ciphertext. Fresh random nonce every call — reuse breaks GCM."""
+    nonce = os.urandom(NONCE_LEN)
+    return nonce + AESGCM(key).encrypt(nonce, plaintext, None)
+
+
+def decrypt(key: bytes, blob: bytes) -> bytes:
+    """Raises cryptography.exceptions.InvalidTag on wrong key or tampered data."""
+    return AESGCM(key).decrypt(blob[:NONCE_LEN], blob[NONCE_LEN:], None)

basic_password_manager-0.1.0/pw_manager/vault.py

@@ -0,0 +1,51 @@
+"""Vault file: [4-byte magic "PWV1"][16-byte salt][12-byte nonce + ciphertext].
+
+The ciphertext is JSON: {"entry name": {"user": ..., "pw": ..., "notes": ...}}.
+Salt and nonce are not secrets; everything sensitive is inside the ciphertext.
+"""
+
+import json
+import os
+import shutil
+
+from cryptography.exceptions import InvalidTag
+
+from . import crypto
+
+MAGIC = b"PWV1"
+
+
+class VaultError(Exception):
+    """Anything wrong with opening or reading a vault, with a human message."""
+
+
+def load(path: str, password: str) -> dict:
+    try:
+        with open(path, "rb") as f:
+            raw = f.read()
+    except FileNotFoundError:
+        raise VaultError(f"no vault at {path} — run 'init' first")
+    if raw[:4] != MAGIC:
+        raise VaultError(f"{path} is not a vault file (bad magic bytes)")
+    salt = raw[4 : 4 + crypto.SALT_LEN]
+    key = crypto.derive_key(password, salt)
+    try:
+        plaintext = crypto.decrypt(key, raw[4 + crypto.SALT_LEN :])
+    except InvalidTag:
+        raise VaultError("wrong master password (or the vault file is corrupted)")
+    return json.loads(plaintext)
+
+
+def save(path: str, password: str, entries: dict) -> None:
+    salt = os.urandom(crypto.SALT_LEN)
+    key = crypto.derive_key(password, salt)
+    blob = MAGIC + salt + crypto.encrypt(key, json.dumps(entries).encode())
+    # Keep the previous version as .bak: one-step undo for corruption or mistakes.
+    if os.path.exists(path):
+        shutil.copy2(path, path + ".bak")
+    # Write to a temp file then rename: a crash mid-write can't destroy the vault.
+    tmp = path + ".tmp"
+    fd = os.open(tmp, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
+    with os.fdopen(fd, "wb") as f:
+        f.write(blob)
+    os.replace(tmp, path)

basic_password_manager-0.1.0/pyproject.toml

@@ -0,0 +1,21 @@
+[build-system]
+requires = ["setuptools>=61"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "basic-password-manager"
+version = "0.1.0"
+description = "Local encrypted password manager that lives in your terminal"
+readme = "README.md"
+license = "MIT"
+requires-python = ">=3.10"
+dependencies = [
+    "argon2-cffi",
+    "cryptography",
+]
+
+[project.scripts]
+pw = "pw_manager.cli:main"
+
+[project.urls]
+Repository = "https://github.com/Daisentaur/password-manager"

basic_password_manager-0.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+