Şifre Kasam
A multi-user local password manager in Flutter. It has a known security limitation, and I am not hiding it.
Most password managers are cloud-based. I wanted a vault that stays on one device, needs no internet connection and supports several people sharing the same phone.
- A mobile app from a single Flutter and Dart codebase.
- Records live in an on-device SQLite (sqflite) database; nothing leaves the phone.
- A multi-user structure where each user’s records belong to their own account.
A solo project, entirely mine.
Adding, searching, editing records and multi-user access all work. The app is fully offline.
This version stores passwords in plain text in the SQLite database. Anyone with physical or root access to the device can read every record, so the app is not fit for real use today. The planned fix: derive a key from the user’s master password with Argon2id and encrypt records with AES-GCM.
A password manager has exactly one job — protecting passwords — and my version does not do it. Realising that taught me to read my own code as an attacker would: "the database stays on the device" does not mean someone with the device cannot read it. You cannot make a security decision without first writing down the threat model.
Flutter · Dart · SQLite · sqflite