VaultLock
A password manager that has nowhere to send your data
Every cloud password manager asks you to trust an infrastructure you cannot inspect with the one secret that unlocks everything else. VaultLock takes the opposite position: there is no server, so there is nothing to breach.
Flutter · Dart · SQLite · AES-256-GCM · PBKDF2 · Next.js 14 · TypeScript · Framer Motion
VaultLock gives people full ownership of their credentials: no cloud dependency, no third-party servers holding passwords, just a private vault that is genuinely theirs.
The cryptography
Entries are encrypted with AES-256-GCM, which authenticates as well as encrypts — a tampered ciphertext fails to decrypt rather than silently producing garbage. The vault key is derived from the master password with PBKDF2-SHA256 over 10,000 iterations. There is no account, no sync endpoint and no recovery email, and that last point is a deliberate trade: lose the master password and the vault is gone, because any recovery path I could build would also be a path in.
One codebase, five platforms
VaultLock runs on Android, iOS, Windows, macOS and Linux from a single Flutter codebase, so the security guarantees are identical everywhere — which matters more for a security tool than for most apps, because it means there is one implementation to audit rather than five. Biometric authentication sits in front of the vault, alongside a password-security audit that scores strength in real time.
The companion site is a separate Next.js 14 project in TypeScript and Tailwind, with Framer Motion transitions, a security-focused feature breakdown, a walkthrough of how the encryption works, and a download centre. Building the product and building the case for the product are different skills, and I wanted both on the record.