Feature Highlights

Currently supporting three types of data items: A Logon site (including Url, Logon and Password information), credit card and a Generic type for just about anything.
All items can be Tagged. Tags can be added and removed at will.
Sort items according to Name, Last access data, and total access count.
Group by type (Logon site, credit card, other), by Tag or don’t group at all.
Run in system tray or as regular window.
Export a list of all items, in their unencrypted form, to a text file.
Automatic file backup.
Automatic logout after a time span set by the user. Alternatively, option to automatically log off after accessing any secured data item.
Option to show web site “favicons” in list display, when available.
Drag and drop web site url from browser to initiate creating a new entry.
Simple skinning feature.
Option to encrypt the data file in addition to sensitive values within the file, for added security.
Double click on an item and it opens the specified Url in the default browser (optional.)
Option to automatically fill logon and password fields of web site (Internet Explorer only.)
A “Send Keys” feature, where the password key strokes are sent directly to active window, eliminating any need for copy and paste on the clipboard, which can be a security concern.
Ability to change the Master Password at any time.
Option to set the number of iterations employed by the encryption algorithm when generating the master key. High values result in more securely encrypted values, but impact the amount of time it takes to logon. Users can experiment with this value and find the highest number of iterations while keeping the time it takes to logon acceptable.
Tool to automatically generate random passwords with the option to include or exclude numbers, punctuation and special characters.
Detailed Help covering every aspect and feature of the application. Just hit F1 from anywhere in the program.
Serious attention to security. See below for a detailed look at the method employed for value encryption and other security measures.

Screen Shots

View to enter the master password. Nothing can be done until the correct password is entered.

View to set the master password. Follows the standard practice of requiring the same value to be input twice, for error checking. This is where the number of iterations can be set for the encryption algorithm. (Changing this value requires coverting all existing encrypted values, the same as if the password itself were changed.)

This is the View options "dialog" view. In addition to View options, there are Security options and following that Browser options. The views are navigated to sequentially, similar to a wizard style interface.

Here is the list view, grouping by Tag. Clicking on the small arrow which is visible at the right of the selected item will navigate to that item's details page, for viewing and/or editing. (Right arrow will also navigate to details page of the active item.) New items can be created through the context menu of using the button at the bottom right corner of the window.

This shot is showing the credit card details view. Notice the Tag combo box, which allows you to select multiple values. New tags are created right here.

This is the Logon tab of the web site details view, showing the password generating tool.

Security Overview

Encryption Algorithm

Encryption is implemented in two basic parts, first, generating a 256 bit key from the supplied master password, and second, using that key to encrypt the values contained in the data file. Both the master key generation and the encryption steps are performed using built-in .Net utilities.

Key generation takes three parameters: the user entered password, a random value called a SALT, and a value which specifies the number of iterations used in the method internally when generating the key. The larger the number of iterations, the more secure - harder to crack - is the key that is generated and, it follows, more securely encrypted values.

When a new file is created the user is prompted to enter a password to serve as the master password for the file. At this point the master key is generated for the first time; the random value SALT that is generated and used in the key generation is stored in the file along with the number of iterations. These values along with the password serve as the data for regenerating the key each time the user logs in. Along with the SALT and number of iterations, a value called a HASH is generated from the key. Creating a hash is a one-way operation - given the same input the output is always the same, but the input cannot be arrived at from the output. Because of this property, a hash can be used to validate the password that the user enters.

The key itself is not stored in the data file, of course, as that would be giving away the means to decrypt all the encrypted values in the file. The Key is generated when the user enters the password. It is stored in a single location of memory within the running program, where it remains until either the program is terminated or is wiped from memory in response to the user setting for invalidating the password. Additionally, the memory used for storing the secret key is protected using the ProtectedMemory class in the .Net cryptographic library, making it secure against memory scanning, memory dumping and other potential points of attack.

The master password (and the master key) is required for both encrypting and decrypting values. Both operations use the Rijndael symmetric encryption algorithm as provide by Microsoft as part of the .Net framework. The main parameter to the encryption algorithm is a 256 bit key. Instead of using the master key directly, an intermediate key value is generated with the master key as input along with a separate, unique SALT value that is then stored with the encrypted value in the data file. This maneuver adds another layer of obfuscation to the final encrypted value.

For more detailed information about the algorithms used for encrypting values, start with Microsoft documentation on the cryptography library:

Internal Security Measures

Significant measures have been taken to ensure that the executing program is safe from external attacks such as memory snooping. These measures include:

Never passing unencrypted values between methods and never storing unencrypted values in memory. Encrypted values are only exposed within the method body of the decryption method itself. They are immediately inserted into what Microsoft calls a Secure String - part of the .Net library. A secure string is itself an encrypted value which stores its data in unmanaged memory which is totally separate from the .Net runtime. The secure string does not release its data until absolutely necessary for the activities of the program user, such as to send key strokes to the active window or to enter the password programmatically into a web site.
The master key that is generated from the master password is at no point stored in persistent memory (it is not written to the hard disk.) It resides in a single location of memory, and that memory is protected by a special .Net cryptography utility class, which masks the memory value from snooping programs such as Crack.Net. When the password is invalidated (meaning the user logs off, or is automatically logged off) the key data is immediately wiped from memory by being overwritten with zeros.
An option to encrypt the entire data file before writing to disk. The encryption method used for encrypting the file is the same as for encrypting values; the encryption is dependent on a secret key generated from the user's password.
A double-blind method for encrypting values - a separate SALT and Key is used for each encrypted value, this in addition to the master key that is generated from the master password.
The send password keys feature is a security enhancement since it prevents the need to use the system clipboard, which is very vulnerable.