Brankas — Personal Password & Link Manager

A single-file, client-side password and bookmark manager. Everything is encrypted in the browser before it's ever written to storage — there's no backend, no server, and no plaintext secrets leaving your device.

🎯 Quick Demo

Live Demo: adiapandi.github.io/brankas

How it works in 30 seconds:

1. Set your master password → Never stored, used only to derive encryption keys
2. Add passwords or links → They're encrypted immediately in your browser
3. Lock/Unlock → Your vault auto-locks after 5 minutes of inactivity
4. Backup anytime → Export encrypted data (stays encrypted), import on another device

┌─────────────────────────────────────────┐
│         BRANKAS Password Vault           │
├─────────────────────────────────────────┤
│ 🔐 Unlock Vault                         │
│                                         │
│ Master Password: [••••••••]    🔓       │
│                                         │
│              [ UNLOCK ]                 │
└─────────────────────────────────────────┘
                    ↓
┌─────────────────────────────────────────┐
│         Your Encrypted Vault (OPEN)     │
├─────────────────────────────────────────┤
│ 🔑 Passwords (3)     🔗 Links (2)      │
│                                         │
│ ├─ GitHub                              │
│ ├─ Gmail                               │
│ └─ Bank Portal                         │
│                                         │
│ 🔍 Search... |+Add| ⚙️ Settings        │
└─────────────────────────────────────────┘

✨ Features

• 🔑 Unified vault — store both password entries (site, username, password, notes) and link/bookmark entries (title, URL, tags, notes) in one place
• 🔒 Client-side encryption — master password → PBKDF2 (250,000 iterations, SHA-256) → AES-GCM 256-bit key, derived fresh on every unlock and never persisted
• 🎲 Built-in password generator — configurable length and character sets
• 🔍 Search & filter — by title, username, tag, or entry type
• ⏱️ Auto-lock — vault re-locks after 5 minutes of inactivity
• 💾 Backup / restore — export the encrypted vault blob as text (still encrypted, safe to store anywhere) and re-import it on another device
• 🎨 No dependencies — plain HTML/CSS/JS, no build step, no framework
• 🚀 Works anywhere — GitHub Pages, Netlify, your own server, or as a local file

🔐 Security model

Concern	Approach
Master password storage	Never stored, anywhere, in any form
Key derivation	PBKDF2-SHA256, 250,000 iterations, random 16-byte salt per vault
Encryption	AES-GCM 256-bit (authenticated — tampering or a wrong password fails decryption rather than silently corrupting data)
Data at rest	Stored only as ciphertext + IV + salt; the app never has plaintext on disk
Wrong password	Decryption throws (auth tag mismatch), so there's no separate "password check" that could leak timing information
Backup file	Contains only ciphertext/IV/salt — safe to store in cloud storage, email to yourself, etc. Still requires the master password to be useful

Threat model note: this protects data at rest against anyone who gets the storage/backup file without the master password. It does not protect against a compromised browser/device while the vault is unlocked.

🛠️ Tech stack

• Vanilla JavaScript (no framework, no bundler)
• Web Crypto API for PBKDF2 + AES-GCM
• No external runtime dependencies

🚀 Running it

This is a single HTML file — no install, no build step.

git clone https://github.com/adiapandi/brankas.git
cd brankas
# just open index.html in a browser, or serve it:
python3 -m http.server 8000

Then visit http://localhost:8000.

Note: browser storage APIs used for persistence are origin-scoped, so serve the file over http://localhost (or your own domain) rather than opening it as a bare file:// path if you want data to persist.

Hosting on GitHub Pages (or any static host)

This app stores everything locally in your browser (localStorage) — nothing is embedded in the page or sent anywhere. That means it's safe to host the static files publicly (GitHub Pages, Netlify, etc).

1. Fork or clone this repo
2. Enable GitHub Pages in Settings → Pages → Source: main branch
3. Visit https://yourusername.github.io/brankas/

📖 Usage Examples

Example 1: Adding a Password Entry

1. Click [+Add]
2. Select "Password Entry"
3. Fill in: Site (GitHub), Username, Password
4. Optional: Add notes (API token, backup codes, etc.)
5. Click [Save] → encrypted immediately

Example 2: Backup Your Vault

1. Click ⚙️ Settings
2. Click [Export Vault]
3. Save the `.txt` file to cloud storage, email, USB drive
4. On another device: Click [Import Vault] and paste the file content

Example 3: Search for a Password

1. Use the search bar at the top
2. Type "git" → filters to "GitHub", "GitLab"
3. Click an entry to view/copy username & password

🗂️ Project Structure

brankas/
├── index.html          # Everything (HTML + CSS + JS)
├── README.md           # This file
└── assets/             # (Optional) For screenshots/docs

📋 Roadmap

• Optional passphrase strength meter on setup
• Per-item "copy and auto-clear clipboard after N seconds"
• Dark/light theme toggle
• PWA support for offline install
• Two-factor unlock option (TOTP)
• Multi-vault support

⚠️ Important: Data Persistence

This app stores everything in the browser's localStorage, scoped to the browser and device you're using. That means:

• Clearing browser cache/site data will make your vault inaccessible (encrypted data is in localStorage)
• Different browser or device = separate, independent vault
• No cloud sync — each browser/device has its own vault

Best practice: Use the built-in Export feature (Settings → Export) regularly and store backups somewhere safe. The exported file stays encrypted, so it's fine to email or cloud-store it.

🤝 Contributing

Found a bug or have a feature idea? Open an issue or submit a PR!

📄 License

MIT — do whatever you'd like with it.

---

Made with 🔐 for security-conscious folks | Visit live demo