We are setting up a web application which requires users to submit sensitive data. Since entering all the required data may take a long amount of time, we want to give them the option to save their progress. Maintaining a database to store their information is risky for us, as it opens up our servers to potential attacks. We have a small team and would be hard pressed to maintain the level of security we would want.
Rather than maintaining such a database, we would like to encrypt the user's partial progress (a text string in JSON format) with a password that we provide and that is supplied to them only at the time they wish to save progress. They will be instructed in the UI to physically write the password down rather than save it on their computer. To resume progress, they would supply us the encrypted file and the password. On our end, no data is persisted. If they lose the password they just have to start again.
Is any portion of this method obviously insecure? What encryption algorithms and libraries (Java or Python) are best for performing encryption/decryption?