Build a CQRS Architecture with Python

tags: python, architecture, tutorial, advanced

tags: python, networking, async, tutorial

tags: python, networking, devops, tutorial

tags: python, data, etl, tutorial

tags: python, async, architecture, tutorial

tags: python, tools, programming, tutorial

tags: python, database, oop, advanced

tags: python, monitoring, devops, tutorial

tags: python, architecture, tutorial, advanced

tags: python, git, devops, tools

tags: python, devops, architecture, tutorial

tags: python, redis, architecture, tutorial

tags: python, bot, automation, tutorial

tags: python, security, tutorial, tools

Imagine typing your master key once and instantly unlocking passwords for every site you visit, all stored in a file that looks like gibberish to anyone who tries to peek. That’s the power of building your own password manager in Python: you get total control over your data, learn critical security concepts, and end up with a tool you can actually use today.

Security experts constantly warn against saving passwords in plain text, yet many developers still rely on browser storage or insecure notes. By building a custom manager, you enforce encryption by default and create a CLI tool that fits your workflow perfectly. Let’s dive into creating a secure, command-line password manager that encrypts your credentials using the industry-standard cryptography library.

Why Build Your Own Password Manager?

Before we write code, it’s worth understanding the security mindset behind this project. Most "password manager" tutorials skip the most critical part: encryption. Storing passwords in a .txt file is a security nightmare. If that file gets stolen, every account is compromised.

We’re going to use Fernet, a symmetric encryption scheme provided by the cryptography library. Fernet ensures that your data is authenticated and encrypted, meaning even if someone modifies the file, the system will detect the tampering and refuse to decrypt it. This approach gives you:

Confidentiality: Passwords are unreadable without the key.
Integrity: Any modification to the file breaks decryption.
Simplicity: A single Python script handles everything without complex databases.

Step 1: Install the Necessary Libraries

You’ll need Python 3.11 or later. If you haven’t installed it yet, download it from python.org. Once you’re set up, install the required libraries via pip:

pip install cryptography pyperclip

cryptography: Provides the Fernet encryption module.
pyperclip: Allows your manager to automatically copy passwords to your clipboard (a handy feature for daily use).

Step 2: Design the Core Class Structure

We’ll build a PasswordManager class that handles key generation, file creation, encryption, and decryption. This keeps our code organized and reusable.

The class will have these main methods:

generate_key(): Creates a secure master key.
create_password_file(): Initializes an empty encrypted file.
add_password(site, password): Encrypts and saves a new password.
get_password(site): Decrypts and retrieves a password for a given site.
list_passwords(): Shows all stored site names.

Step 3: Write the Working Code

Here’s the complete, runnable script. Save this as password_manager.py and run it in your terminal.

import os
from cryptography.fernet import Fernet
from pyperclip import copy

MASTER_KEY_FILE = "master.key"
PASSWORD_FILE = "passwords.encrypted"

class PasswordManager:
    def __init__(self):
        self.key = self._load_or_generate_key()
        self.cipher = Fernet(self.key)

    def _load_or_generate_key(self):
        if os.path.exists(MASTER_KEY_FILE):
            with open(MASTER_KEY_FILE, "rb") as f:
                return f.read()
        else:
            key = Fernet.generate_key()
            with open(MASTER_KEY_FILE, "wb") as f:
                f.write(key)
            print("Master key generated and saved to master.key")
            return key

    def create_password_file(self):
        if not os.path.exists(PASSWORD_FILE):
            with open(PASSWORD_FILE, "wb") as f:
                f.write(self.cipher.encrypt(b""))
            print("Password file created.")

    def add_password(self, site, password):
        if not os.path.exists(PASSWORD_FILE):
            self.create_password_file()

        with open(PASSWORD_FILE, "rb") as f:
            encrypted_data = f.read()

        decrypted_data = self.cipher.decrypt(encrypted_data).decode()
        entries = {}
        if decrypted_data:
            for line in decrypted_data.splitlines():
                if ":" in line:
                    s, p = line.split(":", 1)
                    entries[s] = p

        entries[site] = password
        new_data = "\n".join(f"{s}:{p}" for s, p in entries.items())

        with open(PASSWORD_FILE, "wb") as f:
            f.write(self.cipher.encrypt(new_data.encode()))

        print(f"Password for {site} added successfully.")

    def get_password(self, site):
        if not os.path.exists(PASSWORD_FILE):
            print("No password file found. Add a password first.")
            return None

        with open(PASSWORD_FILE, "rb") as f:
            encrypted_data = f.read()

        try:
            decrypted_data = self.cipher.decrypt(encrypted_data).decode()
        except Exception:
            print("Error: Password file is corrupted or key is invalid.")
            return None

        if not decrypted_data:
            print("No passwords stored yet.")
            return None

        for line in decrypted_data.splitlines():
            if ":" in line:
                s, p = line.split(":", 1)
                if s == site:
                    print(f"Password for {site}: {p}")
                    copy(p)
                    print("Password copied to clipboard!")
                    return p

        print(f"No password found for {site}.")
        return None

    def list_passwords(self):
        if not os.path.exists(PASSWORD_FILE):
            print("No password file found.")
            return

        with open(PASSWORD_FILE, "rb") as f:
            encrypted_data = f.read()

        try:
            decrypted_data = self.cipher.decrypt(encrypted_data).decode()
        except Exception:
            print("Error: Password file is corrupted.")
            return

        if not decrypted_data:
            print("No passwords stored yet.")
            return

        print("Stored sites:")
        for line in decrypted_data.splitlines():
            if ":" in line:
                site = line.split(":")[0]
                print(f" - {site}")

if __name__ == "__main__":
    pm = PasswordManager()
    pm.create_password_file()

    while True:
        print("\n1. Add Password\n2. Get Password\n3. List Passwords\n4. Exit")
        choice = input("Choose an option: ")

        if choice == "1":
            site = input("Site name: ")
            password = input("Password: ")
            pm.add_password(site, password)
        elif choice == "2":
            site = input("Site name: ")
            pm.get_password(site)
        elif choice == "3":
            pm.list_passwords()
        elif choice == "4":
            print("Exiting...")
            break
        else:
            print("Invalid option.")

How to Use It TODAY

Run the script: python password_manager.py
Add a password: Choose option 1, enter a site name (e.g., github.com) and your password.
Retrieve a password: Choose option 2, enter the site name. The password will be printed and automatically copied to your clipboard.
List all sites: Choose option 3 to see what’s stored.

Your master key is saved in master.key. Never share this file. If you lose it, you lose access to all your passwords. Consider backing it up to an encrypted drive or a secure cloud storage.

Security Best Practices

Building the tool is step one; using it securely is step two. Here are critical tips:

Backup your key: Store master.key in a separate, secure location.
Use strong passwords: Since you’re managing passwords, ensure each one is unique and long (12+ characters).
Limit file access: Ensure passwords.encrypted and master.key have restricted permissions (chmod 600 on Linux/Mac).
Test integrity: Try editing passwords.encrypted manually. The script should refuse to decrypt it, confirming integrity protection.

What’s Next?

You now have a fully functional, encrypted password manager. But you can go further:

Add a GUI: Use Streamlit or Tkinter for a visual interface.
Integrate with browsers: Create a script that auto-fills passwords using browser automation.
Cloud sync: Store the encrypted file in a private cloud bucket (e.g., AWS S3) for access across devices.

The beauty of this project is that it’s modular. You can expand it without rewriting the core encryption logic.

Start Protecting Your Data Now

Don’t wait for a security breach to take your password management seriously. This script gives you immediate, practical control over your credentials while teaching you real encryption techniques.

Run the code, add your first password, and experience the confidence of having your data encrypted by default. If you found this helpful, share it with a fellow developer, and drop a comment below with

If you found this helpful, consider buying me a coffee ☕ — it keeps these articles coming!

Also check out my AI tools collection: AI 次元世界 — free AI tools for developers.