Project overview
This project was undertaken as a final-year dissertation module in Cyber Security and Digital Forensics. The goal was to design and implement a password management solution that demonstrates how sensitive credentials can be protected without trusting a third-party cloud provider — while still giving users actionable feedback when a password has appeared in a public breach.
The deliverable includes a fully functional Chrome Manifest V3 extension, technical documentation, security analysis, and this public website hosted at securepasswordvault.site for distribution and project presentation.
Research & technical objectives
- Implement client-side encryption using the Web Cryptography API (PBKDF2 + AES-256-GCM).
- Evaluate threats relevant to browser extensions: storage exposure, clipboard leakage, and brute-force attacks.
- Integrate breach-awareness using industry-standard k-anonymity (Have I Been Pwned).
- Document forensic artefacts: where ciphertext resides and what an examiner would observe.
- Provide a usable interface for non-expert users without compromising security defaults.
Architecture summary
The extension uses a popup-based UI for vault management and a minimal
service worker for lifecycle events. Cryptographic routines live in
dedicated modules (lib/crypto.js, lib/hibp.js). Encrypted vault
blobs and the master-password verification token are persisted in
chrome.storage.local only.
No remote database stores user credentials. Network access is limited to the HIBP Pwned Passwords range API when the user adds, edits, or generates a password.
Scope & limitations
We document limitations transparently — an important part of professional security work:
- Chromium only — Manifest V3; Firefox port not included.
- No autofill yet — credentials are copied manually from the vault.
- No cloud sync — vault is device-bound unless export is added later.
- Master password loss = data loss — intentional, to prevent silent recovery attacks.
- Breach names — HIBP reports exposure count, not the name of each breach incident.
Future work
Planned enhancements discussed in our project report include autofill via content scripts, encrypted backup/export, audit logging for forensic review, and optional Argon2id key derivation via WebAssembly for even stronger master-password hashing.