A powerful Java-side password system for your Kodular apps!
What is it?
Password Manager is a professional-grade Kodular extension that helps you securely manage passwords inside your app — no extra component required!
Keep your users’ credentials safe with industry-standard one-way hashing.
No AES, no reversible encryption — just strong, secure, and irreversible protection.
Features at a Glance
Feature
Description
SetPassword()
Save a new password securely using SHA-256 hash and unique salt
VerifyPassword()
Check if user input matches stored password
ChangePassword()
Safely change password using old one
ClearPassword()
Wipe stored hash and salt
SetPasswordHint()
Save a helpful password hint
GetPasswordHint()
Retrieve the saved hint
IsPasswordStrong()
Prevent weak passwords (digit + uppercase + special char)
IsPasswordSet()
Check if any password is stored
Blocks Overview
You don’t need TinyDB — everything is handled inside the extension!
Set Password
PasswordManager.SetPassword("MySecure@123")
Verify Password
PasswordManager.VerifyPassword("MySecure@123")
Change Password
PasswordManager.ChangePassword("old", "new")
Set Hint
PasswordManager.SetPasswordHint("Try your pet’s name")
Events
Event
Triggered When…
PasswordChanged
Password changed successfully
OldPasswordIncorrect
Wrong password during change/verify
PasswordVerified
User input password matched current password
PasswordCleared
Password data was wiped
PasswordTooWeak
New password doesn’t meet strength requirements
Storage
Uses SharedPreferences
Generates a random 128-bit salt per password
Only the hash and salt are stored — no plain text, no encrypted values
Works across sessions, phones, and restarts — fully persistent
Usually storing password hashes instead of encrypted passwords (or even worse, plaintext passwords) is a fundamental security practice. The core reason lies in the irreversibility of hashing, which provides a crucial layer of protection in case of a data breach.
Here’s a breakdown of why hashing is preferred:
Hashing is a One-Way Process (Irreversible)
What it is: A hash function takes an input (your password) and transforms it into a fixed-length string of characters (the hash value). This process is designed to be one-way. You can easily generate a hash from a password, but it’s computationally extremely difficult, practically impossible, to reverse the process and get the original password back from the hash.
Security benefit: If a database storing hashed passwords is breached, the attackers only get the hashes, not the actual passwords. Since they can’t reverse the hash, they don’t immediately know your password. This significantly reduces the risk of your password being compromised and used on other services (especially if you reuse passwords).
Encryption is a Two-Way Process (Reversible)
What it is: Encryption takes plaintext data and transforms it into ciphertext using an algorithm and a key. The key allows the ciphertext to be decrypted back into the original plaintext.
Security drawback for passwords: If an attacker gains access to encrypted passwords AND the decryption key, they can easily decrypt all the passwords and gain full access. Storing the key securely alongside the encrypted passwords is a major challenge, and if the system is compromised, both could be exposed.
The goal of password storage is not to be able to retrieve the original password, but only to verify that the user knows it. Hashing achieves this by providing a one-way, irreversible transformation that protects user credentials even if the database storing the hashes is compromised. Encryption, while vital for data in transit, is not suitable for storing passwords because of its inherent reversibility.
Thank you for the valuable feedback! You’re absolutely right — for best practice in credential storage, hashing is the ideal approach due to its irreversibility and security.
My extension uses AES encryption mainly because it supports use cases where the password needs to be retrieved (such as offline app locks or private notes). However, I’m planning to release an ** hash-based version** soon for users who want irreversible and safer storage.
Appreciate your input — stay tuned for the secure-hash edition!
In the secure hash-based version, the GetCurrentPassword() method has been removed — because hashed passwords are irreversible and cannot be retrieved.
In the older AES version, it returned the decrypted password
In this updated version, no such method exists — for security reasons
What is it?
Features at a Glance
Feature
Description
Blocks Overview
Set Password
Verify Password
Change Password
Set Hint
EventsStorage
Uses
Generates a random 128-bit salt per password
Only the hash and salt are stored — no plain text, no encrypted values
Download
No blocks needed for saving — it handles everything internally
No internet needed — works 100% offline
Perfect for login screens, app lockers, or secure gate features
Feedback Welcome!
New Update! (July 1, 2025)
In this updated version, no such method exists — for security reasons
.