This is how real password managers actually work

[MyrinNew]

Most people use password managers every day.


Very few understand how they actually keep passwords secure.


In this article, I break down how real, production-grade password managers work — the same core ideas used by tools like 1Password or Bitwarden — by walking through a project I built called Passwuts.


🎥 Full video walkthrough:


👉 https://youtu.be/G1m7K7ZG1M0





Why I Built Passwuts

Password reuse is one of the biggest security risks today.


When a single website is breached, reused passwords expose users across every service they use.


Passwuts solves this by:

• Enforcing strong, unique passwords
• Using client-side encryption
• Ensuring the server never sees plaintext credentials

This is the same security philosophy used by serious password managers.





High-Level Architecture (Zero-Knowledge Model)

Passwuts follows a zero-knowledge, client-first encryption model:

• 🔐 Master password never leaves the client
• 🔑 Encryption keys are derived locally using PBKDF2
• 🔒 Passwords are encrypted using AES-GCM
• 🗄️ Server stores only ciphertext + IV

Even if the backend is compromised, passwords remain safe.





How Encryption Works (Step-by-Step)

1. User creates a master password
2. A strong encryption key is derived using PBKDF2
   • Inputs: master password + user UID (as salt)
3. Passwords are encrypted using AES-GCM
   • Each encryption uses a random IV
4. Only encrypted data is stored in Firestore

At no point does plaintext leave the browser.





Vault Verification (Without Storing Passwords)

A common problem:

How do you verify the master password without storing it?

Passwuts uses a verifier pattern:

• A known string ("vault-check") is encrypted
• Stored in Firestore as vault metadata
• On unlock:
  • Client decrypts it locally
  • If it decrypts correctly → password is valid

✅ Secure


✅ Zero-knowledge


✅ No password storage





Browser Extension Architecture

The browser extension reuses the exact same crypto layer as the web app:

• Firebase authentication
• Shared internal crypto package (@pm/crypto)
• Client-side encryption only
• No secret logic in the backend

This keeps behavior consistent across platforms.





What This Project Taught Me

Building a password manager taught me some hard lessons:

• 🔍 Crypto failures usually come from misuse, not math
• 🔄 IV / nonce management is critical
• 🧠 Security UX matters as much as cryptography
• 🔐 Zero-knowledge systems require discipline everywhere

Final Thoughts

Password managers are not magic.


They are carefully engineered systems built on:

• Key derivation
• Authenticated encryption
• Secure client-side architecture

Understanding how they work makes you:

• A better engineer
• A safer user

If you enjoyed this breakdown, watch the full video walkthrough 👇


🎥 https://youtu.be/G1m7K7ZG1M0







More...