Vault

A zero-dependency secrets manager. Everything is built from the Python standard library — no requirements.txt, no pip packages. See STDLIB.md for exactly which stdlib modules replace which third-party packages, and THREAT_MODEL.md for what Vault does and does not protect against.

Installation

Nothing beyond Python 3.10+ is required — clone the repository, then run the installer for your OS:

macOS/Linux:

chmod +x install.sh && ./install.sh

Windows:

install.bat

After installing, vault works as a plain command from any directory — no need to cd into the repo or type python -m vault — for example:

vault init
vault set KEY value
vault run -- your-command
vault ui

macOS

install.sh creates a wrapper at /usr/local/bin/vault (using sudo only if that directory isn't already writable by you). The master key is stored in the macOS Keychain (service vault-cli, account master-key) via the built-in security command-line tool.

Windows

install.bat creates vault.bat in this project folder and, if the folder isn't already on your PATH, adds it there via setx — reopen your terminal afterward for that change to take effect. The master key is stored, DPAPI-encrypted, at %APPDATA%\vault-cli\master.key. DPAPI ties the encryption to your Windows user account, so only that account can decrypt it.

Running without installing

You can also run Vault directly from the repo without installing a global command — ./run.sh init (macOS/Linux) or python -m vault init (Windows), from inside the project directory.

CLI commands

All commands operate on the vault file at ~/.vault/secrets.json by default.

vault init

Generate a new 32-byte master key and store it in the OS keychain.

$ vault init
vault initialized — master key stored in the OS keychain

vault set KEY VALUE

Encrypt and store a secret.

$ vault set DB_PASSWORD hunter2
stored 'DB_PASSWORD'

vault get KEY

Decrypt and print a secret's value. A warning is printed to stderr first, since the value will appear in your terminal (and possibly shell history).

$ vault get DB_PASSWORD
warning: printing a secret to the terminal may be recorded in your shell history
hunter2

vault list

List secret names only — values are never shown.

$ vault list
DB_PASSWORD
TEST_KEY

vault delete KEY

Remove a secret.

$ vault delete DB_PASSWORD
deleted 'DB_PASSWORD'

vault run -- COMMAND...

Decrypt every secret, inject them into the environment alongside the rest of os.environ, and run COMMAND. Decrypted values live only in memory for the duration of the subprocess.

$ vault run -- python3 -c "import os; print(os.environ['TEST_KEY'])"
hello123

vault ui

Launch the local web UI (see below).

$ vault ui
vault UI running at http://127.0.0.1:52341/?token=<random-token>
press Ctrl+C to stop

The UI

vault ui starts a local HTTP server bound to 127.0.0.1 only (never 0.0.0.0), generates a random session token, and opens your browser to the vault page with that token pre-filled in the URL. Every API request must include the same token or it is rejected with 403.

From the page you can:

• see a table of secret names (values are hidden by default),
• add a new secret via the form,
• click Reveal to briefly show a secret's value (it re-hides itself after a few seconds),
• click Delete to remove a secret.

No frameworks, no build step, no external CDN — the whole UI is one static index.html with inline <style> and <script>, served by http.server from the stdlib.