I have a lot of logins. Like everyone else, I kept them in my head, then in a text file, then nowhere safe at all. Every password manager I looked at wanted a cloud account and a subscription. I did not want my secrets sitting on someone else's server. I wanted them on my own machine, encrypted properly, with nothing leaving the device.
So I built Secure Vault. An encrypted credential store that runs entirely locally. No cloud account, no server, nothing leaves the device.
How it keeps things safe
The encryption is real. Fernet, which is AES-128-CBC plus HMAC, through the cryptography package. No home-grown ciphers, no clever shortcuts. The key comes from your master password through PBKDF2-HMAC-SHA256 with 600,000 iterations and a random 16-byte salt per vault. That makes brute-force attacks expensive, and identical passwords produce different keys.
The master password is never stored anywhere. Not hashed, not anywhere. The encrypted data itself is the check. A wrong password simply fails decryption. The vault file is created with owner-only permissions, so other users on the machine cannot read it. And passwords are read with getpass, so they never show up in shell history or process arguments.
If you leave the password blank when adding an entry, the vault generates a strong 20-character password for you from the secrets module.
What it does
It is a command line tool with a full entry lifecycle. Create a vault, add entries, read one back, list entry names, delete an entry. Listing never shows secrets, only names.
How to run it
pip install -r requirements.txt
python vault.py init # create vault, set master password
python vault.py add github # store an entry (prompts for details)
python vault.py get github # show one entry
python vault.py list # list entry names (never secrets)
python vault.py delete github # remove an entry
The honest limits
It is a single machine, single user tool. There is no sync, no sharing, and no recovery. If you forget the master password, the vault cannot be opened, by design. There is no back door and no reset link. That is the trade you make for keeping everything offline.
I tested the full round trip before I trusted it. Create, add, read back, the exact entry comes back. A wrong master password is rejected. Delete removes the entry. An empty vault says so plainly.
If you want your passwords encrypted and nowhere else, this does the job.
Top comments (0)