PassGram v1.00a

Secure Password Manager with PGP Encryption & Group Collaboration PassGram is a standalone PHP password manager featuring group-based credential sharing, PGP encryption using native PHP OpenSSL, encrypted JSON file storage, and an invite-only registration system. All styled with an authentic OS/2 Warp 3.0 interface with purple title bars.

Features

Core Functionality

• ✅ Encrypted Password Storage - AES-256-GCM encryption for all credentials
• ✅ Group Collaboration - Users belong to groups and can share credentials
• ✅ Complete Group Management - Create, edit, delete groups, add/remove members, transfer ownership
• ✅ Group-Level Credential Sharing - Share credentials with entire groups (read-only or read/write permissions)
• ✅ PGP Key Management - Generate RSA, DSA, or Elliptic Curve keys with configurable sizes
• ✅ Multiple Encryption Options - RSA (2048/3072/4096), DSA, EC (secp384r1/secp521r1/prime256v1)
• ✅ Credential Sharing - Share passwords with group members using PGP encryption
• ✅ Invite-Only Registration - Secure invite codes tied to specific groups
• ✅ Notes System - Add notes to users (group-visible) and credentials (private)
• ✅ Multi-Field Credentials - Store passwords, usernames, URLs, custom fields, tags
• ✅ Password Generator - Built-in secure random password generator
• ✅ Copy-to-Clipboard - One-click copying for credentials, invites, URLs, and PGP keys
• ✅ Persistent Navigation - Dashboard menu accessible on all pages when logged in

Security Features

• Master Application Key (MAK) - Encrypts all JSON database files
• User Master Password - Never stored, only hashed (bcrypt + Argon2id)
• Field-Level Encryption - Sensitive credential fields encrypted individually
• PGP Public Key Cryptography - For secure credential sharing between users
• CSRF Protection - All state-changing operations protected
• Rate Limiting - Brute force protection on authentication
• Session Security - Secure, httponly, samesite cookies
• Comprehensive Logging - Audit trail of all security events

User Interface

• OS/2 Warp 3.0 Theme - Authentic purple title bars (#5D009D), beveled borders, classic gray backgrounds
• Server-Side Rendered - Traditional PHP approach, works without JavaScript
• Enhanced User Experience - Copy buttons, show/hide passwords, dynamic forms
• Responsive Design - Works on desktop and mobile devices

System Requirements

• PHP 7.4+ (PHP 8.x recommended)
• OpenSSL Extension (standard on all servers)
• JSON Extension (standard on all servers)
• Writable data/ directory for encrypted storage
• HTTPS (required for production - configured in web server)

Installation

1. Upload Files

Transfer all PassGram files to your web server. The public/ directory should be your web root.

your-domain.com/
├── public/          ← Point your web server here
├── src/
├── data/
├── config/
├── autoload.php
└── install.php

2. Set Permissions

bash
chmod 700 data/
chmod 700 config/
chmod 644 public/.htaccess

3. Run Installation

Visit https://your-domain.com/install.php in your browser. The installer will:
• Generate a secure Master Application Key (MAK)
• Create the first admin user
• Create a default group
• Generate an invite code for additional users
• Initialize the encrypted database
IMPORTANT:
• Save the invite code displayed after installation
• Backup config/security.php to a secure location
• Delete install.php after successful installation

4. Configure Web Server

Apache (.htaccess already included): Point DocumentRoot to /public/ directory. Nginx:

nginx
server {
    listen 443 ssl;
    server_name your-domain.com;

    root /path/to/passgram/v1.00/public;
    index index.php;

    location / {
        tryfiles $uri $uri/ /index.php?$querystring;
    }

    location ~ \.php$ {
        fastcgi_pass unix:/var/run/php/php8.1-fpm.sock;
        fastcgi_index index.php;
        include fastcgi_params;
    }

    # Block access to sensitive directories
    location ~ ^/(config|data|src)/ {
        deny all;
    }
}

5. Update Configuration

Edit config/config.php:
• Set base_url to your domain
• Enable cookie_secure when using HTTPS
• Adjust security settings as needed

Directory Structure

v1.00/
├── autoload.php                 # Standalone PSR-4 autoloader
├── install.php                  # Installation script (delete after install)
├── public/                      # Web root
│   ├── index.php               # Main entry point
│   ├── login.php               # Login page
│   ├── logout.php              # Logout handler
│   ├── assets/
│   │   ├── css/style.css       # OS/2 Warp 3.0 theme
│   │   └── js/app.js           # Client-side interactions
│   └── .htaccess               # Apache security & rewrite rules
├── src/                         # Application code
│   ├── Core/                   # Core infrastructure
│   │   ├── Config.php          # Configuration loader
│   │   ├── Database.php        # Encrypted JSON file operations
│   │   └── Session.php         # Secure session management
│   ├── Security/               # Security components
│   │   ├── Encryption.php      # AES-256-GCM encryption
│   │   ├── PGP.php            # Native PHP OpenSSL RSA operations
│   │   ├── Auth.php           # Authentication
│   │   └── CSRF.php           # CSRF protection
│   ├── Models/                 # Data models
│   │   ├── User.php           # User management
│   │   ├── Group.php          # Group management
│   │   ├── Invite.php         # Invite code system
│   │   ├── Credential.php     # Password storage
│   │   ├── Share.php          # PGP-encrypted sharing
│   │   └── Note.php           # Notes system
│   └── Helpers/                # Utility classes
│       ├── Validator.php       # Input validation
│       ├── Sanitizer.php       # XSS prevention
│       └── Logger.php          # Activity logging
├── data/                        # Encrypted storage (outside web root)
│   ├── users.json.enc          # Encrypted user database
│   ├── groups.json.enc         # Encrypted groups
│   ├── invites.json.enc        # Encrypted invites
│   ├── credentials/            # Per-user credential files
│   ├── shares/                 # Shared credential metadata
│   ├── notes/                  # Notes storage
│   ├── pgp/                    # PGP keys
│   └── logs/                   # Activity logs
└── config/                      # Configuration files
    ├── config.php              # Main configuration
    ├── database.php            # Storage paths
    └── security.php            # Master key & crypto settings

Usage

First Steps

• Login with admin credentials created during installation
• Generate PGP Keys (PGP Keys → Generate)
- Choose encryption algorithm (RSA recommended) - Select key size (4096 bits for maximum security) - Or choose Elliptic Curve for modern cryptography
• Add Credentials (Dashboard → New Credential)
• Create Groups (Groups → Create Group)
• Invite Users (Invites → Generate Invite Code)
• Share Credentials (Credential → Share with Group)

Credential Types

PassGram supports multiple credential types:
• Password - Standard login credentials
• Note - Secure notes
• Card - Credit card information
• Identity - Personal information

Sharing Credentials with Groups

• Navigate to the credential
• Scroll to "Group Sharing" section
• Select a group from the dropdown
• Choose permission level:
- Read Only - Members can view the credential - Read & Write - Members can view and edit the credential
• Click "Share with Group"
All group members will immediately have access to the credential based on their permission level.

Revoking Group Access

• View the credential
• Scroll to "Currently Shared With" section
• Click "Revoke" next to the group
Access is immediately revoked for all group members.

Managing Groups

As a group owner, you can:
• Add Members - Enter username to add existing users
• Remove Members - Click "Remove" next to member name
• Transfer Ownership - Select new owner from dropdown
• Edit Group - Change name and description
• Delete Group - Permanently remove group (with confirmation)

Group Notes

Add notes about users visible to all group members:
• Navigate to Groups
• Select group member
• Add note (encrypted and visible to group)

Credential Notes

Add private notes to any credential:
• Open credential
• Add note (encrypted, only visible to you)

PGP Key Options

When generating PGP keys, choose from multiple encryption algorithms: RSA (Recommended)
• Most widely compatible
• Key sizes: 2048, 3072, or 4096 bits
• Best for general use
DSA (Legacy)
• For compatibility with older systems
• Limited to signing operations
• Not recommended for new deployments
Elliptic Curve (Modern)
• Strong security with smaller keys
• Curves: secp384r1 (recommended), secp521r1 (maximum), prime256v1
• May have compatibility issues with older systems

Security Considerations

Master Application Key (MAK)

• Generated during installation
• Encrypts all JSON database files
• Never change it - all data becomes unrecoverable
• Backup config/security.php securely offline

User Master Password

• Used for authentication (bcrypt hash)
• Derives encryption key for PGP private key (Argon2id)
• Never stored - only hashes stored
• Cannot be recovered if forgotten

HTTPS

Always use HTTPS in production. Password managers should never run over HTTP.

Backups

Backup these regularly:
• config/security.php - Contains MAK
• data/ directory - All encrypted data

Development Status

✅ Version 1.00 - Fully Completed

Core Infrastructure
• Config, Database, Session, CSRF, Auth
• All security components (Encryption, PGP with native OpenSSL)
• All 6 data models (User, Group, Invite, Credential, Share, Note)
• Standalone autoloader (no Composer required)
Controllers
• AuthController - Login, registration, logout
• DashboardController - Main dashboard
• CredentialController - Full CRUD + group sharing
• GroupController - Complete group management
• InviteController - Invite code generation
• PGPController - Multi-algorithm key generation
• ShareController - PGP-encrypted sharing
• NoteController - User and credential notes
User Interface
• Complete OS/2 Warp 3.0 CSS theme
• All views implemented with responsive layouts
• JavaScript interactions (copy-to-clipboard, password visibility, dynamic forms)
• Persistent navigation menu
• Apache .htaccess security configuration
Features
• Group-level credential sharing with permissions
• Complete group management (CRUD, members, ownership transfer)
• Multiple PGP encryption algorithms (RSA/DSA/EC)
• Copy-to-clipboard throughout application
• Installation script with OS/2 styling

Technical Details

No Dependencies

PassGram is completely standalone:
• No Composer required
• No external libraries
• Uses native PHP OpenSSL for RSA/PGP operations
• Simple PSR-4 autoloader included

Encryption Architecture

Layer 1: Master Application Key
• Encrypts all JSON database files
• AES-256-GCM algorithm
Layer 2: User Master Password
• Hashed with bcrypt for authentication
• Hashed with Argon2id for key derivation
• Never stored in plain text
Layer 3: PGP Encryption
• Multiple algorithms: RSA (2048/3072/4096 bits), DSA, Elliptic Curve
• Used for credential sharing between users
• Private keys encrypted with user's master password (AES-256-GCM)
• Native PHP OpenSSL implementation
Layer 4: Field-Level Encryption
• Sensitive credential fields encrypted individually
• AES-256-GCM with random IV per field

Data Storage

All data stored in encrypted JSON files:
• No SQL database required
• Atomic write operations
• File locking for concurrent access
• Per-user credential files for scalability

License

PassGram v1.00 - Copyright 2025

Support

For issues, questions, or contributions, please contact the developer. --- PassGram v1.00 - Secure. Simple. Standalone.