PassBangla
A password manager for teams, built in Bengali and English. An encrypted vault with sharing, TOTP codes, history and breach monitoring — reached from a web app, an installable PWA, or a browser extension — with passkeys, server-enforced MFA and granular roles underneath it.
TL;DR
At a glance
AES-256-GCM
Vault storage
Authenticated and versioned at rest
Passkeys
Sign-in
WebAuthn, TOTP and enforced MFA
বাংলা + EN
Interface
Bilingual from the ground up
Web · PWA · ext
Reach
Chrome and Firefox extension
The Problem
The credentials are in the group chat
Ask a small team where the shared logins live and the honest answer is usually a chat thread, a spreadsheet, or one person's head. Everyone knows it is wrong. The tools that fix it are priced per seat in dollars, written for security departments that do not exist here, and presented entirely in English.
So the brief was narrower than "build a password manager". It was: build one a team in Bangladesh will actually adopt — one whose interface reads naturally in Bengali, which works on a phone without an app store, and which is still built to the standard a vault has to meet, because a password manager that is merely convenient is worse than none at all.
What We Built
A vault, and three ways to reach it
The core is an encrypted vault with the machinery a team needs around it: role-based access, secure sharing with expiry, password history, breach monitoring, scheduled rotation, alerts for weak and duplicated entries, and TOTP codes stored beside the credentials they protect.
That core is reached three ways — a full web app, an installable PWA with offline access for phones, and a browser extension for Chrome and Firefox built with WXT. Access control runs through granular permissions on five roles, enforced in the API rather than in the interface.
Engineering Notes
Eight decisions a vault has to get right
Versioned ciphertext, so crypto can be changed later
Every stored secret carries a scheme version in the ciphertext itself. New records are written with authenticated AES-256-GCM, while the decrypt path stays version-aware and can still read everything written before it. Cryptography always needs upgrading eventually; designing for that on day one is the difference between a migration and an outage.
Keys derived per owner, and kept apart by purpose
Vault keys are derived with PBKDF2-SHA256 at 100,000 iterations and scoped per owner, so one derived key never covers the whole table. Integration credentials — outbound mail settings, for example — are encrypted with an entirely separate key, so a compromise in one area does not cascade into the vault.
MFA enforced in the API, not the router
A client-side redirect to a verification screen is a suggestion, not a control — anyone can skip it by calling the API directly. Verification state is carried in the tRPC context instead, and the permission check itself refuses to run for a session that has not completed MFA. The enforcement lives where the data actually is.
Codes that resist guessing
A six-digit code is only a million guesses if you are allowed to make them. Verification caps failed attempts and compares codes in constant time, so neither brute force nor response-timing gives an attacker a way in.
Recovery without a back door
Account recovery is where password managers quietly betray their users. Answering security questions does not reset anything by itself — it mints a single-use, expiring token bound to that one account, and the reset consumes it. No client-supplied identity is trusted anywhere in the flow.
Passkeys alongside passwords
WebAuthn is wired in through SimpleWebAuthn, so a member can register a platform authenticator and sign in with a fingerprint or device PIN instead of typing the one password that guards all the others. TOTP secrets live in the same vault, encrypted like everything else.
Sharing that expires on its own
Temporary shares are 256-bit tokens from a cryptographic RNG, with expiry and a maximum use count enforced on access rather than merely displayed. A shared credential that stays live forever is just a slower leak.
Bilingual by construction, not by translation
The whole interface exists in Bengali and English, with the copy in resource files from the start rather than extracted from hard-coded strings later. For the market this is built for, that is not a nice-to-have — a security tool people cannot read in their own language is a security tool people work around.
Architecture
One typed core, three clients
Web app
- Next.js App Router
- tRPC, end-to-end typed
- TanStack Query & Virtual
- Radix primitives, theming
- i18next — Bengali & English
Security
- AES-256-GCM, versioned at rest
- PBKDF2-SHA256, per-owner keys
- WebAuthn passkeys, TOTP, MFA
- Granular RBAC over five roles
- Rate-limited, constant-time checks
Extension & PWA
- WXT — Chrome and Firefox
- Background + content scripts
- Scoped host permissions
- Installable PWA, offline access
- Autofill from the vault
Data & platform
- PostgreSQL via Prisma
- Redis for sessions and limits
- Multi-tenant isolation
- Email and SMS delivery
- Deployed on Vercel
Building something that holds secrets?
We build products where the security model is designed first and reviewed properly — encryption, access control, recovery flows and all the awkward parts in between.