FrostVault — Password Manager by IceLegends

#Full Project Plan

#Context

A Windows desktop password manager built as a CV/portfolio cybersecurity project. Stack: Python 3.12 + PySide6 + AES-256-GCM + Argon2 + SQLite. Visual direction: cartoonish mascot + pastel ice/frost aesthetic. Three unique features that no mainstream password manager ships.

#Unique Features (3 Total)

##1. Honey Vault (Decoy Trap)

After 3 wrong master password attempts, instead of an error, the attacker is shown a convincing FAKE vault with dummy credentials. The real vault silently locks and logs the intrusion attempt (timestamp, attempt count). Concept: honey pot / canary trap — real offensive security technique.

##2. Freeze Mode (Panic Lock)

Global hotkey Ctrl+Shift+F instantly disguises the app. Window title changes to "Calculator" and shows a fake calculator UI overlay. The real vault encrypts and hides in memory. Press the hotkey again (or a PIN) to restore FrostVault. Based on duress-mode / steganographic concealment used by journalists and activists.

##3. Ice Crystal Fingerprint

Every saved password deterministically generates a unique snowflake SVG pattern from its character sequence. Identical passwords = identical crystal (making reuse visually obvious). The crystal forms in real time as you type. No color bar — a living, frozen artwork unique to each password.

#Visual Design

Palette (pastel + frost)

Mascot — "Flurry" A small cartoon snow-spirit/polar bear cub wearing a tiny ice crown. Reacts to vault state: idle (floating), happy (spin + sparkle), alert (shaking + red eyes), frozen (icy overlay, static). Lives in the bottom-right corner of the main dashboard.

#Project Structure

FrostVault/
├── main.py                    # App entry point
├── requirements.txt
├── assets/
│   ├── mascot/
│   │   ├── flurry_idle.png
│   │   ├── flurry_happy.png
│   │   ├── flurry_alert.png
│   │   └── flurry_frozen.png
│   ├── icons/
│   │   └── frostvault.ico
│   └── fonts/                 # Rounded/cartoonish font (Nunito)
├── core/
│   ├── crypto.py              # AES-256-GCM encryption + Argon2 hashing
│   ├── database.py            # SQLite schema + CRUD
│   ├── vault.py               # Real vault logic
│   └── honey_vault.py         # Decoy vault + intrusion logging
├── features/
│   ├── freeze_mode.py         # Panic lock + calculator disguise
│   ├── ice_crystal.py         # Snowflake SVG generator from password
│   └── auto_lock.py           # Idle timeout → lock
├── ui/
│   ├── theme.py               # QSS stylesheet + palette constants
│   ├── login_screen.py        # Master password entry screen
│   ├── vault_dashboard.py     # Main credential list view
│   ├── entry_dialog.py        # Add / Edit credential dialog
│   ├── generator_widget.py    # Password generator panel
│   ├── mascot_widget.py       # Flurry mascot + animations
│   └── crystal_widget.py      # Ice crystal fingerprint widget
└── utils/
    ├── password_strength.py   # Strength scoring (zxcvbn-style)
    └── clipboard.py           # Auto-clear clipboard after 30s

#Security Architecture

Master Password
      │
      ▼
Argon2id (memory-hard hash)
      │
      ▼
Derived 256-bit Key
      │
      ▼
AES-256-GCM encrypts each credential
      │
      ▼
SQLite (encrypted blobs, plaintext only in memory while unlocked)

• Master password is NEVER stored — only the Argon2 hash
• Each entry encrypted individually (breach of one ≠ breach of all)
• On lock/freeze: key wiped from memory
• Honey vault shares the same DB file but returns fake data

#Dependencies (requirements.txt)

PySide6>=6.7.0
cryptography>=42.0.0       # AES-256-GCM
argon2-cffi>=23.1.0        # Argon2id master password hashing
zxcvbn>=4.4.28             # Password strength estimation
Pillow>=10.0.0             # Mascot image handling
keyboard>=0.13.5           # Global hotkey for Freeze Mode

#Build Phases

##Phase 1 — Core Security Layer

• core/crypto.py: Argon2id key derivation + AES-256-GCM encrypt/decrypt
• core/database.py: SQLite schema (vaults, entries, intrusion_log)
• core/vault.py: unlock, lock, add, get, delete, list entries
• core/honey_vault.py: fake entries generator + intrusion logger

##Phase 2 — UI Foundation

• ui/theme.py: Full QSS stylesheet (frost palette, rounded corners, shadows)
• ui/login_screen.py: Master password screen with animated frost background
• ui/mascot_widget.py: Flurry widget with idle/happy/alert/frozen states
• main.py: App entry, window setup, screen routing

##Phase 3 — Vault Dashboard

• ui/vault_dashboard.py: Credential list with search, category filter
• ui/entry_dialog.py: Add/Edit dialog with crystal fingerprint preview
• ui/generator_widget.py: Password generator with strength meter
• features/ice_crystal.py: Real-time snowflake renderer (QPainter)

##Phase 4 — Unique Features

• features/freeze_mode.py: Global hotkey + calculator overlay
• features/ice_crystal.py: Deterministic snowflake from password hash
• features/auto_lock.py: Idle timer → lock + Flurry animation

##Phase 5 — Polish

• System tray icon (FrostVault logo)
• Auto-clear clipboard after 30s
• Intrusion log viewer (accessible after unlock)
• App packaging with PyInstaller → installer .exe via Inno Setup

#Screens Overview

1. Login Screen — frost glass panel, Flurry idle animation, master password input
2. Dashboard — credential cards in a grid/list, Flurry reacts to health, search bar
3. Entry Dialog — add/edit form with live crystal fingerprint + strength bar
4. Generator Panel — slider controls (length, symbols), crystal preview
5. Freeze Mode Overlay — fake calculator covers the window
6. Intrusion Log — timestamped failed attempts (hidden screen, only accessible after unlock)

#Verification Steps

1. Run python main.py — login screen appears with frost theme
2. Enter master password → vault dashboard with Flurry mascot
3. Add a credential → ice crystal generates in real time
4. Enter same password in two entries → identical crystals appear
5. Lock and enter wrong password 3 times → honey vault loads with fake data
6. Press Ctrl+Shift+F → app disguises as Calculator
7. Press Ctrl+Shift+F again → FrostVault restores with PIN prompt
8. Build .exe with PyInstaller — single executable runs on fresh Windows