<![CDATA[Most prior password manager studies rely on basic encryption without strong key derivation and have not consistently implemented a zero-knowledge architecture, leaving encrypted user data potentially accessible to service providers or third parties. This research contributes by designing and building a web-based password manager that integrates three security layers within a unified Django ecosystem: PBKDF2 key derivation with 100,000 SHA-256 iterations, hardware-based unique random salt per user (os.urandom), and authenticated Fernet encryption (AES-128-CBC + HMAC-SHA256). The novelty of this research lies in the strict enforcement of the zero-knowledge principle, where the master password is never stored in the database, making credentials inaccessible even to system administrators. The combination of personalized salt and PBKDF2 also ensures that two users sharing an identical master password always produce distinct encryption keys — a feature not found in existing Django-based implementations. Black Box Testing across ten functional and security scenarios yielded a 100% success rate, covering CRUD operations, unauthorized access rejection, ciphertext tampering detection, and cross-user salt uniqueness verification. The results demonstrate that integrating PBKDF2, unique salt, and Fernet within the Django framework produces a transparent, secure credential storage system resilient to brute force attacks, rainbow table attacks, and database-level data manipulation.]]>
