Security
Emerald Vault
100% Offline Encrypted Credential Manager
PythonFlaskSQLiteAES-128
Overview
A locally-hosted Flask server that encrypts credentials using AES-128 (Fernet), accessible only on localhost. Zero internet exposure.
The Challenge
Cloud password managers are attack surfaces. A security-conscious engineer needs a vault that never touches the internet, stores everything locally, and uses military-grade encryption.
Our Solution
A Python Flask server bound exclusively to localhost. Master password unlocked via PBKDF2 key derivation. All credentials encrypted at rest using AES-128 (Fernet symmetric encryption) in a local SQLite database.
Technical Architecture
- Flask Server — localhost-only binding, zero external network access
- Encryption — cryptography.fernet (AES-128-CBC)
- Storage — SQLite with encrypted BLOB columns
- Deployment — Headless local daemon
Results & Status
Fully functional. Deployed locally as a secure background service.