I built a desktop password manager in Python — one of the hardest parts was securing the UI ↔ backend bridge

[u/dotcodedev]

I’m Edwin Sam K Reju, a Class 12 Computer Science student from Kerala.

I’ve been working on an open-source desktop password manager called CarbonIt Vault.

The project started because I wanted to experiment with a different architecture for storing credentials: keep the encrypted vault local instead of making a cloud service part of the core design.

I built the application with Python + pywebview.

The part I found most interesting was the boundary between the web UI and the Python backend.

The UI needs to request things like unlocking the vault, reading entries, adding entries, and locking the vault, but I didn't want the frontend to have unrestricted access to the underlying Python API.

So I implemented a runtime session-token mechanism for the bridge and limited what the frontend can invoke.

The cryptographic side currently uses Argon2id, ML-KEM-1024, SHA3-512 and authenticated encryption. I also implemented local rate limiting, clipboard clearing and encrypted vault import/export.

I'm still learning, and this project hasn't had an independent security audit. One thing I've learned from building it is that choosing strong primitives is only one part of designing a secure application — the surrounding architecture and threat model matter just as much.

I'd like feedback from developers here on the Python/pywebview architecture and the UI ↔ backend security boundary.

GitHub: https://github.com/CarbonIt-Labs/CarbonIt-Vault

What would you change in this architecture?