I'm making a python application that will encrypt texts like login credentials to websites and likewise. But I have encountered some design issues as below:
1. I let user to enter a password (key) which will encrypt the source file.
2. But if I store the key as such in the file system, others can read it. So we generally gets the hash out of them and stores the hash. When user enters a pass, the hash is computed and matched.
3. But the problem is if I replace the hash that's stored in the filesystem with my own hash, it will still fail to decrypt. But what if some malicious person just delete the hash file that I saved. So how can I check the key the next time when I enter my pass? The hash is gone, and my whole files are encrypted.
So how to securely store the hash ?
Or is there any better method ?

1. You cannot protect against malicious software here, they can always just flip a few random bits in your encrypted storage to make it undecryptable

2. The "usual way" is to generate a good random encryption key that is used to encrypt the wallet contents and then using the user password to encrypt/decrypt said key. In fact I would skip the password hash alltogether since then there is no feedback for correct/incorrect password until retvieving something from the wallet (it's unlikely that your passwords contain unprintable characters and decrypting with wrong key wil with high probability give out "binary garbage")

3. Without having thought about this for more than two minutes (besides; I'm not Bruce Schneier, so even if I think this is good advice it might not be...) I would probably store everything in sqlite database, have a table for keys (the master and just in case you wish to go overkill and generate a session key for each item stored in the wallet, master as said in 2 is encrypted with the password, others with the master) and another for the items, items have plaintext name and encrypted value (encrypted either with the master or a session key [if using session keys add a column pointing to the correct key])

IIRC pwsafe is opesource. that might be a good place to start looking
https://launchpad.net/ubuntu/maveric...pwsafe/0.2.0-3
I think there is even a maemo version but last time I tried the maemo version
pwsafe --createdb
It wouldn't ask me for a passphrase and opened a gui instead

But what encryption algorithm is been used by pwsafe? I prefer AES256 and for hashing SHA-2 512bits.
Is there any OS specific store? How is this kind of application made in Mac OS X or in other OSs like Windows or Linux?

The encryption algo is that made by Bruce Schneier. I think it's twofish. I don't have the answer for your OS question I'm afraid but I think there are alternative apps that read the same db for windows like passwordsafe, not entirely sure.

Okay.
Thanks.