Build a CLI Password Manager with Python and AES Encryption (Step by Step)

mkdir password-manager
cd password-manager
python -m venv venv
source venv/bin/activate
pip install cryptography pyperclip

# master.py
import hashlib
import os
import json

MASTER_FILE = 'master.json'

def hash_master(password: str, salt: bytes = None) -> tuple[bytes, bytes]:
    """Hash the master password using PBKDF2-SHA256 with 600k iterations."""
    if salt is None:
        salt = os.urandom(32)
    key = hashlib.pbkdf2_hmac(
        'sha256',
        password.encode('utf-8'),
        salt,
        iterations=600000,
        dklen=32
    )
    return key, salt

def setup_master(password: str):
    """First-time setup: store salt + hash, return encryption key."""
    key, salt = hash_master(password)
    # Store only the salt and a verification hash
    verify_hash = hashlib.sha256(key).hexdigest()
    with open(MASTER_FILE, 'w') as f:
        json.dump({'salt': salt.hex(), 'verify': verify_hash}, f)
    return key

def verify_master(password: str) -> bytes | None:
    """Verify master password, return derived key if correct."""
    try:
        with open(MASTER_FILE) as f:
            data = json.load(f)
    except FileNotFoundError:
        print("No master password set. Run 'pwm init' first.")
        return None

    salt = bytes.fromhex(data['salt'])
    key, _ = hash_master(password, salt)
    verify_hash = hashlib.sha256(key).hexdigest()

    if verify_hash != data['verify']:
        print("Incorrect master password.")
        return None

    return key

# crypto_utils.py
from cryptography.hazmat.primitives.ciphers.aead import AESGCM
import os

def encrypt(plaintext: str, key: bytes) -> bytes:
    """Encrypt plaintext with AES-256-GCM. Returns nonce + ciphertext."""
    aesgcm = AESGCM(key)
    nonce = os.urandom(12)  # 96-bit nonce recommended for GCM
    ciphertext = aesgcm.encrypt(nonce, plaintext.encode('utf-8'), None)
    # Prepend nonce to ciphertext for storage
    return nonce + ciphertext

def decrypt(data: bytes, key: bytes) -> str:
    """Decrypt AES-256-GCM data. Expects first 12 bytes = nonce."""
    nonce = data[:12]
    ciphertext = data[12:]
    aesgcm = AESGCM(key)
    plaintext = aesgcm.decrypt(nonce, ciphertext, None)
    return plaintext.decode('utf-8')

key = b'secret_key_32_bytes_long_!!'
encrypted = encrypt("Hello World", key)  # bytes (12 + len)
decrypted = decrypt(encrypted, key)       # "Hello World"

# database.py
import sqlite3
import os

DB_PATH = 'passwords.db'

def get_db():
    conn = sqlite3.connect(DB_PATH)
    conn.row_factory = sqlite3.Row
    return conn

def init_db():
    conn = get_db()
    conn.execute('''
        CREATE TABLE IF NOT EXISTS entries (
            id INTEGER PRIMARY KEY AUTOINCREMENT,
            service TEXT NOT NULL,
            username TEXT NOT NULL,
            encrypted_password BLOB NOT NULL,
            notes TEXT DEFAULT '',
            created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
            updated_at DATETIME DEFAULT CURRENT_TIMESTAMP
        )
    ''')
    conn.execute('CREATE INDEX IF NOT EXISTS idx_service ON entries(service)')
    conn.commit()
    conn.close()

def add_entry(service: str, username: str, encrypted_password: bytes, notes: str = ''):
    conn = get_db()
    conn.execute(
        'INSERT INTO entries (service, username, encrypted_password, notes) VALUES (?, ?, ?, ?)',
        (service, username, encrypted_password, notes)
    )
    conn.commit()
    conn.close()

def get_entry(service: str):
    conn = get_db()
    cursor = conn.execute(
        'SELECT * FROM entries WHERE service = ? ORDER BY updated_at DESC',
        (service,)
    )
    results = cursor.fetchall()
    conn.close()
    return results

def list_services():
    conn = get_db()
    cursor = conn.execute('SELECT id, service, username, created_at FROM entries ORDER BY service')
    results = cursor.fetchall()
    conn.close()
    return results

def delete_entry(entry_id: int) -> bool:
    conn = get_db()
    cursor = conn.execute('DELETE FROM entries WHERE id = ?', (entry_id,))
    conn.commit()
    deleted = cursor.rowcount > 0
    conn.close()
    return deleted

def search_entries(query: str):
    conn = get_db()
    cursor = conn.execute(
        'SELECT * FROM entries WHERE service LIKE ? OR username LIKE ?',
        (f'%{query}%', f'%{query}%')
    )
    results = cursor.fetchall()
    conn.close()
    return results

# generator.py
import secrets
import string

def generate_password(length: int = 20, use_symbols: bool = True) -> str:
    """Generate a cryptographically secure random password."""
    chars = string.ascii_letters + string.digits
    if use_symbols:
        chars += string.punctuation

    if length < 8:
        raise ValueError("Minimum password length is 8 characters")

    # Ensure at least one of each type
    password = [
        secrets.choice(string.ascii_lowercase),
        secrets.choice(string.ascii_uppercase),
        secrets.choice(string.digits),
    ]
    if use_symbols:
        password.append(secrets.choice(string.punctuation))

    # Fill remaining length with random chars
    password += [secrets.choice(chars) for _ in range(length - len(password))]

    # Shuffle to avoid predictable prefix pattern
    secrets.SystemRandom().shuffle(password)
    return ''.join(password)

#!/usr/bin/env python3
# pwm.py
import argparse
import sys
from getpass import getpass
from database import init_db, add_entry, get_entry, list_services, delete_entry, search_entries
from crypto_utils import encrypt, decrypt
from generator import generate_password
from master import setup_master, verify_master

def cmd_init(args):
    """Initialize the password manager (set master password)."""
    password = getpass("Create master password: ")
    confirm = getpass("Confirm master password: ")
    if password != confirm:
        print("Passwords do not match.")
        return
    if len(password) < 8:
        print("Master password must be at least 8 characters.")
        return
    init_db()
    setup_master(password)
    print("Password manager initialized.")

def cmd_add(args):
    """Add a new password entry."""
    key = verify_master(getpass("Master password: "))
    if not key:
        return

    username = input("Username: ").strip()
    if not username:
        print("Username is required.")
        return

    password = args.password
    if not password:
        use_generated = input("Generate a strong password? (y/n): ").lower() == 'y'
        if use_generated:
            password = generate_password()
            print(f"Generated password: {password}")
        else:
            password = getpass("Password: ")

    encrypted = encrypt(password, key)
    add_entry(args.service, username, encrypted, args.notes or '')
    print(f"Password saved for {args.service}.")

def cmd_get(args):
    """Retrieve and decrypt a password."""
    key = verify_master(getpass("Master password: "))
    if not key:
        return

    entries = get_entry(args.service)
    if not entries:
        print(f"No entries found for '{args.service}'.")
        return

    for entry in entries:
        decrypted = decrypt(entry['encrypted_password'], key)
        print(f"\nService: {entry['service']}")
        print(f"Username: {entry['username']}")
        print(f"Password: {decrypted}")
        if entry['notes']:
            print(f"Notes: {entry['notes']}")

def cmd_list(args):
    """List all saved services."""
    key = verify_master(getpass("Master password: "))
    if not key:
        return

    entries = list_services()
    if not entries:
        print("No passwords saved yet.")
        return

    print(f"\n{'ID':<4} {'Service':<20} {'Username':<20} {'Created':<20}")
    print('-' * 64)
    for e in entries:
        print(f"{e['id']:<4} {e['service']:<20} {e['username']:<20} {e['created_at']:<20}")

def cmd_delete(args):
    """Delete a password entry by ID."""
    key = verify_master(getpass("Master password: "))
    if not key:
        return

    if delete_entry(args.id):
        print("Entry deleted.")
    else:
        print(f"No entry with ID {args.id}.")

def cmd_generate(args):
    """Generate a strong password and optionally save it."""
    password = generate_password(args.length, not args.no_symbols)
    print(password)
    try:
        import pyperclip
        pyperclip.copy(password)
        print("(copied to clipboard)")
    except ImportError:
        pass

def main():
    parser = argparse.ArgumentParser(
        description='pwm — Secure CLI Password Manager',
        prog='pwm',
    )
    subparsers = parser.add_subparsers(dest='command', help='Available commands')

    # init
    p_init = subparsers.add_parser('init', help='Initialize password manager')

    # add
    p_add = subparsers.add_parser('add', help='Add a new password')
    p_add.add_argument('service', help='Service name (e.g., github.com)')
    p_add.add_argument('-p', '--password', help='Password (omit to generate or type)')
    p_add.add_argument('-n', '--notes', help='Optional notes')

    # get
    p_get = subparsers.add_parser('get', help='Get password for a service')
    p_get.add_argument('service', help='Service name')

    # list
    p_list = subparsers.add_parser('list', help='List all services')

    # delete
    p_delete = subparsers.add_parser('delete', help='Delete an entry')
    p_delete.add_argument('id', type=int, help='Entry ID to delete')

    # generate
    p_gen = subparsers.add_parser('gen', help='Generate a strong password')
    p_gen.add_argument('-l', '--length', type=int, default=20, help='Password length')
    p_gen.add_argument('--no-symbols', action='store_true', help='Exclude symbols')

    args = parser.parse_args()

    commands = {
        'init': cmd_init,
        'add': cmd_add,
        'get': cmd_get,
        'list': cmd_list,
        'delete': cmd_delete,
        'gen': cmd_generate,
    }

    if args.command in commands:
        commands[args.command](args)
    else:
        parser.print_help()

if __name__ == '__main__':
    main()

# Initialize
python pwm.py init

# Add a password
python pwm.py add github.com

# Generate and save a password
python pwm.py gen -l 30
python pwm.py add example.com -p "the-generated-password"

# Retrieve
python pwm.py get github.com

# List all services
python pwm.py list

# Delete
python pwm.py delete 1