PassMan

PassMan is a cross-platform password manager with both a JavaFX desktop client and an Android client built with Material Design 3. Vaults are encrypted at rest with AES-256-CBC, keys are derived with PBKDF2, and file attachments are stored alongside entries as encrypted blobs. The desktop client focuses on power-user workflows (bulk import, CSV export, custom fields), while the Android client focuses on quick unlock via biometric + master password fallback.

Highlights

• AES-256-CBC vault encryption with PBKDF2 key derivation and per-entry salts
• JavaFX desktop client with bulk import/export and custom fields
• Android client with Material Design 3 and biometric unlock
• Encrypted file vault: attachments are stored as encrypted blobs alongside entries

Challenges

• Keeping biometric unlock secure without ever exposing the master password to the Android Keystore fallback path
• Cross-platform UI parity without abstracting away the strengths of each platform

What I learned

• PBKDF2 with a sane iteration count is still a respectable default for password-derived keys
• Encrypted blobs are simpler than per-file key management and almost always good enough