VeraVault — Zero-Knowledge Credential Vault
High-security credential management system engineered so that user passwords and sensitive blobs are encrypted client-side before touching the server.
Why this was built
Centralized password managers that handle plaintext or weakly encrypted user data present a devastating single point of failure if backend databases are breached.
Technical Approach
Architecting a Zero-Knowledge credential management system in a Melos monorepo. Uses client-side AES-256-GCM for data encryption and PBKDF2 with 600,000 iterations for master key derivation, pairing cross-platform Flutter clients with a lightweight FastAPI encrypted-blob storage backend.
// VeraVault: Client-side key derivation and AES-GCM encryption
Future<EncryptedVaultBlob> encryptVaultItem({
required String plainTextData,
required String userMasterPassword,
required Uint8List salt,
}) async {
// 1. Derive encryption key client-side using PBKDF2 (600k iterations)
final derivedKey = await pbkdf2DeriveKey(
passphrase: userMasterPassword,
salt: salt,
iterations: 600000,
keyLengthBits: 256,
);
// 2. Encrypt plaintext client-side with AES-256-GCM
final nonce = generateSecureRandomBytes(12);
final encryptedCipher = await aesGcmEncrypt(
data: utf8.encode(plainTextData),
key: derivedKey,
nonce: nonce,
);
// 3. Only the ciphertext and nonce are transmitted to the backend
return EncryptedVaultBlob(ciphertext: encryptedCipher, nonce: nonce);
}Key Architectural Features & Outcomes
Zero-Knowledge architecture: encryption occurs strictly client-side
AES-256-GCM authenticated encryption for all vault items
PBKDF2 key derivation with 600,000 iterations against brute-force attacks
Melos monorepo supporting Flutter (Android, iOS, Windows, Linux) and browser extension
Lightweight FastAPI backend storing encrypted blobs with zero access to keys