Aegis is a robust, end-to-end encrypted application that securely stores user credentials. Built in C++ with Qt6 for its graphical user interface and libsodium for cryptography, it ensures that all sensitive information such as passwords, usernames, and notes remain fully protected.
Every piece of data is encrypted locally on the user’s system — nothing is ever transmitted or stored in plaintext. The vault can only be unlocked using the master password, which never leaves memory in its raw form. The system is designed with emphasis on encryption, portability, scalability, and safety.
The password manager works through a multi-stage process that guarantees both security and usability. Below is an in-depth breakdown of each step and the corresponding components involved:
When a user opens the application, they are prompted to either create a new vault or unlock an existing one. The vault file (vault.vault) is encrypted with a master key derived from the user’s master password.
The entered master password never serves directly as an encryption key. Instead, it is processed using libsodium’s Argon2id key derivation function with a unique, random salt stored in the vault header. The derived 256-bit key is then used for all encryption and decryption operations. The memory-hard nature of Argon2id ensures resistance against brute-force and GPU attacks.
Once the key is derived, the vault file is parsed and each entry (credential record) is decrypted using XChaCha20-Poly1305 AEAD (Authenticated Encryption with Associated Data). This ensures that not only is the data kept confidential, but any tampering with ciphertext is immediately detected during decryption.
After successful decryption, entries are loaded into the Qt6 GUI and displayed within the main window. Users can search, add, edit, or delete credentials. All operations are handled in memory, and the decrypted data never touches disk.
When the user copies a password, it is temporarily stored in the system clipboard. The application monitors the clipboard and automatically clears it after a short timeout (default: 10 seconds), preventing residual exposure.
Upon saving, all entries are serialized into JSON and re-encrypted. The application employs an atomic save mechanism:
- Writes the new vault data to a temporary file (
vault.tmp). - Verifies the integrity of the new data.
- Renames it to replace the original vault file atomically.
- Optionally creates a backup (
vault.bak) for recovery.
This process guarantees that the vault is never corrupted even if the system crashes during saving.
Sensitive buffers such as derived keys and plaintext passwords are stored in secure memory using sodium_malloc() and wiped using sodium_memzero() immediately after use.
Below is a step-by-step representation of how data moves through the system, ensuring confidentiality and integrity at every layer:
+----------------------------+
| User enters Master Password|
+-------------+--------------+
|
v
+------------------------------+
| Argon2id KDF (libsodium) |
| Salt + Password → 256-bit Key|
+-------------+----------------+
|
v
+----------------------------+
| Decrypt Vault Header |
| Verify AEAD Authentication |
+-------------+--------------+
|
v
+------------------------------------------+
| Decrypt Entry Blobs (XChaCha20-Poly1305) |
| Deserialize JSON Entries |
+-------------+----------------------------+
|
v
+----------------------------+
| Display Entries in Qt UI |
+-------------+--------------+
|
v
+----------------------------+
| Edit / Add / Delete / Save |
| Serialize → AEAD Encrypt |
| Atomic Write to Disk |
+----------------------------+
Each encryption operation includes an authentication tag, preventing data corruption or tampering.
| Module | Description |
|---|---|
| App/Application | Initializes UI, sets up configuration, and starts the main loop. |
| UI/ | Qt‑based GUI (MainWindow, Dialogs, ListView). Handles user interaction. |
| Crypto/ | Provides secure encryption/decryption and key derivation utilities. |
| Storage/ | Handles vault serialization and atomic saving to disk. |
| Models/ | Represents data structures such as entries and vaults. |
| Utils/ | Provides clipboard, logger, and helper utilities. |
| Tests/ | Contains basic unit and functional tests. |
brew install cmake pkg-config qt libsodium nlohmann-json
export Qt6_DIR=$(brew --prefix qt)/lib/cmake/Qt6
mkdir build && cd build
cmake -DCMAKE_BUILD_TYPE=Release -DQt6_DIR="$Qt6_DIR" ..
cmake --build . -- -j$(sysctl -n hw.ncpu)
open src/PasswordManager.app✅ This builds and launches the macOS .app bundle automatically after compilation.
sudo apt update && sudo apt install -y cmake build-essential qt6-base-dev pkg-config libsodium-dev nlohmann-json3-dev
mkdir build && cd build
cmake -DCMAKE_BUILD_TYPE=Release ..
make -j$(nproc)
./src/PasswordManager✅ This produces an ELF binary executable. You can run it directly or package it using scripts/package_linux.sh.
choco install cmake qt libsodium
mkdir build; cd build
cmake -G "Visual Studio 17 2022" -A x64 -DCMAKE_BUILD_TYPE=Release ..
cmake --build . --config Release
start .\src\Release\PasswordManager.exe✅ This generates a .exe file along with required Qt runtime dependencies. Use scripts/package_windows.ps1 for packaging.
- macOS:
make installcreates a signed.appbundle. - Linux: Run
scripts/package_linux.sh→ creates a.tar.gzarchive. - Windows: Run
scripts/package_windows.ps1→ creates a.ziparchive.
The Password Manager represents a modern, secure, and modular C++ application that brings together GUI development, cryptographic primitives, and OS-level integration under one system. It demonstrates the following key software engineering principles:
- Security-first architecture: Implements layered security across memory, disk, and runtime.
- Portability: Cross-platform compatibility with a single unified codebase using CMake.
- Performance: Minimal overhead from encryption due to libsodium’s optimized primitives.
- Reliability: Atomic file operations and backup vaults prevent data loss.
- Extensibility: Each module is self-contained, allowing easy integration of new features (e.g., biometrics, sync, compression).
This project is a practical showcase of secure application design, merging low-level cryptography with high-level UI. It’s ready for real-world deployment, research demonstration, or inclusion in professional portfolios.
The Password Manager project combines robust cryptographic techniques, secure coding practices, and polished UI design to deliver an end-to-end encrypted solution for local credential management. Its modularity ensures it can scale from a simple vault to a cloud-synced, enterprise-grade security application.
“Security isn’t an afterthought , it’s the architecture.”