Skip to content

SaugatEDITH/passman

BranchesTags

Repository files navigation

PasswordMan

Ultra-Secure Offline Flutter Password Manager with Steganography

Overview

PasswordMan is a 100% offline, zero-backend password manager that hides your passwords inside regular PNG images using steganography. One image holds exactly one password entry.

Feature Details
Backend None — completely offline
Database SQLite (local only)
Encryption AES-256-GCM + Argon2id KDF
Auth Methods Fingerprint, PIN, Master Password
Special Feature Hide passwords in PNG images

Security Architecture

Encryption Stack

  • Key Derivation: Argon2id (3 iterations, 64MB memory, parallelism 4)
  • Encryption: AES-256-GCM with unique IV per entry
  • Key Storage: Android Keystore / iOS Secure Enclave
  • Memory: Keys never touch disk, zeroed after use

Defense Layers

Layer Implementation
Screenshot Block FLAG_SECURE (Android), UIScreen.isCaptured (iOS)
Root/Jailbreak Detection flutter_jailbreak_detection
Brute-Force Protection 5 fails → 30s lockout, 10 → optional wipe
Clipboard Protection Auto-clear after 30 seconds
Screen Recording Blocked on both platforms

Steganography System

Core Rule: One Image = One Password Entry

Export a vault entry to any PNG image. The password is encrypted with AES-256-GCM and hidden in the least significant bits (LSB) of pixel colors.

Why PNG only? JPEG is lossy — compression destroys the hidden data. PNG preserves every bit exactly.

Export Flow:

  1. Open any vault entry → Tap "Embed in Image 🖼"
  2. Pick a PNG photo from gallery
  3. Entry is encrypted and hidden inside the image
  4. Saved to Downloads as pman_<title>_<timestamp>.png

Import Flow:

  1. Vault screen → Tap "Load from Image" button
  2. Pick a PasswordMan PNG image
  3. See preview: "Contains: Gmail"
  4. Enter credential → Entry imported

Project Structure

passwordman/
├── lib/
│   ├── main.dart
│   ├── app.dart                    # MaterialApp, theme, routing
│   ├── core/
│   │   ├── constants/              # App constants, DB constants
│   │   └── utils/                  # Secure logger, clipboard utils
│   ├── security/
│   │   ├── crypto/                 # AES-256-GCM, Argon2id KDF
│   │   ├── auth/                   # Biometric, PIN, password auth
│   │   └── integrity/              # Screenshot block, root detection
│   ├── steganography/
│   │   ├── lsb_embedder.dart       # LSB steganography encoder
│   │   └── lsb_extractor.dart      # LSB steganography decoder
│   ├── data/
│   │   ├── database/               # SQLite management
│   │   ├── models/                 # VaultEntry, StegoManifest
│   │   └── repositories/           # Data access layer
│   └── features/
│       ├── onboarding/             # First-run setup
│       ├── auth/                   # Lock/unlock screens
│       ├── vault/                  # Main vault UI
│       └── settings/               # App settings
├── android/                        # Android platform code
├── ios/                            # iOS platform code
└── test/                           # Unit tests

Prerequisites

Required Software

  • Flutter SDK >=3.0.0
  • Dart SDK >=3.0.0
  • Android Studio (for Android builds)
  • Xcode (for iOS builds, macOS only)
  • CMake (for native Argon2 library compilation)

Install Flutter

# Windows
git clone https://github.com/flutter/flutter.git -b stable
set PATH=%PATH%;C:\path\to\flutter\bin

# macOS/Linux
git clone https://github.com/flutter/flutter.git -b stable
export PATH="$PATH:`pwd`/flutter/bin"

Verify Installation

flutter doctor

Installation

1. Clone Repository

git clone <repository-url>
cd passwordman

2. Install Dependencies

flutter pub get

3. Native Configuration

Android

The Argon2 native library requires CMake build configuration. The setup is already configured in:

  • android/app/src/main/cpp/CMakeLists.txt
  • android/app/build.gradle.kts

iOS

No additional configuration required.

🔧 Build Commands

Code Analysis

# Static analysis
flutter analyze

# Format code
flutter format lib/

# Check for issues
flutter pub outdated

Debug Build

# Android debug APK
flutter build apk --debug

# iOS debug (macOS only)
flutter build ios --debug

# Run on connected device
flutter run

Release Build (Optimized)

# Android App Bundle (for Play Store)
flutter build appbundle --release

# Android APK (all ABIs)
flutter build apk --release

# iOS (macOS only)
flutter build ios --release

Tree Shake & Minify

# Release build with tree shaking (removes unused code)
flutter build apk --release --tree-shake-icons

# Obfuscate for security (makes reverse engineering harder)
flutter build apk --release --obfuscate --split-debug-info=symbols/

ABI-Specific Builds

Build for Specific Architectures

# ARM 32-bit (older devices)
flutter build apk --release --target-platform android-arm

# ARM 64-bit (modern devices)
flutter build apk --release --target-platform android-arm64

# x86_64 (emulators, some tablets)
flutter build apk --release --target-platform android-x64

# Split APK per ABI (smaller downloads)
flutter build apk --release --split-per-abi

ABI Output Files

After flutter build apk --split-per-abi:

build/app/outputs/flutter-apk/
├── app-arm64-v8a-release.apk    # Modern Android devices
├── app-armeabi-v7a-release.apk  # Older Android devices
└── app-x86_64-release.apk       # Emulators/x86 devices

Install Specific ABI

# Install to connected device
flutter install --release

# Or manually install APK
adb install build/app/outputs/flutter-apk/app-arm64-v8a-release.apk

Testing

# Run all tests
flutter test

# Run with coverage
flutter test --coverage

# Run specific test file
flutter test test/crypto_engine_test.dart

Installation on Device

Android (APK)

# Enable developer options and USB debugging on device
# Connect via USB, then:
flutter devices          # Verify device is listed
flutter run --release    # Install and run

# Or install APK directly
adb install build/app/outputs/flutter-apk/app-release.apk

iOS (macOS only)

# Requires Apple Developer account or free provisioning profile
flutter run --release

# Or build for distribution
flutter build ios --release
# Then archive in Xcode and distribute

Dependencies

Core Dependencies

Package Purpose
sqflite SQLite database
pointycastle AES-256-GCM encryption
dargon2_flutter Argon2id key derivation
flutter_secure_storage Secure key storage
local_auth Biometric authentication
image PNG processing for steganography
file_picker Image selection
flutter_bloc State management
uuid UUID generation

Dev Dependencies

Package Purpose
flutter_launcher_icons App icon generation
flutter_test Testing framework
build_runner Code generation

Security Notes

  1. No Network Calls: The app has zero network permissions. It cannot and will not transmit data.
  2. Memory Security: Encryption keys exist only in memory, never written to disk.
  3. Zero-Knowledge: The app developer cannot access your passwords even with physical device access.
  4. Self-Destruct: Emergency wipe option clears all data and resets the app.

Troubleshooting

Argon2 Library Not Found

If you see libargon2-arm.so dlopen failed:

flutter clean
flutter pub get
cd android
./gradlew clean
./gradlew assembleDebug

Build Errors

# Clean everything
flutter clean
flutter pub get
cd android && ./gradlew clean && cd ..

# Rebuild
flutter build apk --debug

iOS Build Issues

cd ios
pod install --repo-update
cd ..
flutter run

License

This project is proprietary software. All rights reserved.

Contributing

This is a personal security project.Only Critical fixes are accepted .

Support

For issues or questions, please file an issue on the repository.

Built with ❤️ and 🔒

About

No description, website, or topics provided.

Resources

Readme

License

MIT license
Activity

Stars

0 stars

Watchers

0 watching

Forks

0 forks
Report repository

Releases 1

v1.0 Latest
Jun 7, 2026

Packages

 
 
 

Contributors

Languages