ShieldPass is a premium, modern, and highly secure desktop password manager built with Python, CustomTkinter, SQLite, Cryptography (AES-256 & PBKDF2), and Have I Been Pwned k-Anonymity API.
It provides an all-in-one suite for generating high-entropy credentials, managing encrypted local vaults, generating live 2FA / TOTP authentication codes, auditing vault security health, and protecting against clipboard snooping.
- Random Password Mode: Configure length (6–64 characters) and combine uppercase, lowercase, numbers, and symbols. Includes a toggle to Exclude Ambiguous Characters (
1, l, I, 0, O, S, 5, Z, 2). - Passphrase Mode: Generates readable, high-entropy word-based credentials with custom separators (hyphens, dots, underscores, spaces), capitalization, and trailing numeric appends.
- Live Strength Meter & Crack Time: Calculates entropy in bits dynamically and estimates offline (GPU rig) and online crack times.
- AES-256 & PBKDF2 (100,000 Iterations): Encrypts passwords and 2FA secret keys at rest using Fernet AES-256 with keys derived dynamically in memory from your Master Password.
- Built-in 2FA / TOTP Authenticator: Generates RFC 6238 compliant 6-digit verification codes with real-time ticking 30-second countdown timers.
- Category Organization: Categorize entries into
General,Personal,Work,Finance,Social, and filter/search live across service names, usernames, URLs, and notes. - Direct Web Launcher: Store website URLs in vault entries and open login pages with one click.
- Encrypted Backup & CSV Import/Export: Export vault backups to encrypted
.spvaultfiles or standard CSV spreadsheets for seamless migration.
- Vault Health Score (0 - 100%): Evaluates overall security hygiene based on password strength, password reuse, and data breach history.
- Concurrent k-Anonymity Leak Scanner: Scans all saved vault passwords concurrently against the Have I Been Pwned API in background threads without freezing the UI.
- Password Reuse & Weak Password Alerts: Instantly flags accounts sharing duplicate passwords or low-entropy credentials with quick "Fix/Edit" shortcuts.
- Windows Clipboard History Exclusion: Implements enterprise OS flags (
CanIncludeInClipboardHistory = 0andCanUploadToCloudClipboard = 0) to prevent passwords from being recorded in Windows 10/11Win + VClipboard History or Cloud Sync. - Live Clipboard Auto-Clear: Automatically wipes active clipboard memory after 15 seconds with a live ticking countdown toast banner.
- Inactivity Auto-Lock: Automatically locks the vault and wipes encryption keys from memory after user inactivity (configurable: 30s, 1m, 2m, 5m, or Off).
- Integrates with the official "Have I Been Pwned" Pwned Passwords API.
- k-Anonymity Security: Calculates SHA-1 hashes locally, sending only the first 5 characters to the API. Your actual password never leaves your machine.
You can run the standalone binary directly without installing Python:
Double-click dist/ShieldPass.exe (or run ShieldPass.exe from the dist/ directory).
Ensure you have Python 3.10+ installed on your system.
-
Install dependencies:
py -m pip install -r requirements.txt
-
Run from source: Double-click
run.bator launch via terminal:py password.py
-
Build Standalone Executable (.exe): To package ShieldPass into a single standalone
.exeusing PyInstaller:py -m PyInstaller ShieldPass.spec
The generated executable will be placed in the
dist/directory (dist/ShieldPass.exe).
Warning
All credentials in the local vault are encrypted with a key derived from your Master Password. There is no password recovery or "Forgot Master Password" function. If you forget your Master Password, your vault data is lost forever.