reVault for Python

reVault is a fast, local toolkit for creating secure portable archives called Lockboxes. Each Lockbox is encrypted, compressed, and signed. It can store files and directory trees, variables such as API keys, and forms such as login details.

Lockboxes are easy to copy, share, and back up, and they do not require a hosted service. The engine is designed for speed and effective compression. Applications can read, write, and seek within stored files without extracting the archive, and recover data from partial corruption. reVault provides a command line tool for everyday work and APIs for application code.

Read the reVault manual for the quick start, core concepts, and security model.

Your Vault holds your profile and contacts. The CLI protects a new Lockbox for your profile by default, and you can grant access to contacts using their public keys. Use password access when you do not have a recipient's contact (public key) details.

Platform wheels include the reVault engine and expose Python classes for Lockboxes, Vaults, keys, and the session agent.

Installation and native runtime

python -m pip install revault-api

PyPI publishes a wheel for each supported operating system and architecture. The wheel stores the matching library inside revault_api/_native, and the package loads it through ctypes. Installing from a source archive does not supply a library unless the package is assembled with the matching native files.

The complete method example index is maintained in the source repository.

from revault_api import Revault, SecretString, Vault

runtime = Revault.load()                 # loading does not open a Vault
signing = runtime.generate_profile_signing_key_pair()
public_signing_key = signing.public_key()
with runtime.lockbox_create(bytes(32)) as box:  # Lockbox held by this process
    box.set_owner_signing_key(signing)  # Profile becomes this Lockbox's owner
    box.add_file("/hello.txt", b"hello\n", False)
    box.set_variable("owner", "alice")
    box.set_secret_variable("token", bytearray(b"secret"))
    size = box.with_secret_variable("token", lambda token: len(token))
    box.commit()
public_signing_key.close()
signing.close()

with SecretString("Vault passphrase") as vault_passphrase:
    persistent = Vault.open_or_create("/tmp/revault-vault", vault_passphrase)
    persistent.close()

Revault.load(native_library_path=...) can load a native library supplied by the application. Otherwise, reVault checks REVAULT_LIBRARY and then the library inside the installed wheel. A bare name uses the operating system search path.

The value passed to a secret callback is a temporary bytearray; it is cleared after the callback. Do not convert it to a retained str or bytes. SecretString and SecretBytes own mutable buffers and wipe them on close(). Ordinary Lockbox operations never contact the agent.

Core API concepts

  • Revault loads the runtime.
  • Vault owns persistent local state.
  • Lockbox owns an open archive.
  • AgentSession caches selected content keys.

Prefer context managers and close each object independently.

API documentation and support

The wheel ships typed public classes and method docstrings. Use help(revault_api) or an API documentation generator for the installed version. The method examples and Python conformance program cover the common operation inventory.

Create, open, and replace

Open methods require existing Vaults and Lockboxes; they never create missing state. Use open or create only when creation is acceptable and replacement methods only after an explicit destructive choice. commit() persists pending Lockbox changes. close() releases the handle and content key held by the current process but does not commit or delete the archive.

Open that archive using its Lockbox password, a profile key, or a credential resolved from the Vault. A profile signing key becomes a Lockbox owner key only after explicit assignment.

Secrets, exceptions, and ownership

A vault passphrase, Lockbox password, and 32-byte content key are different secrets. Use SecretString, SecretBytes, and mutable bytearray values; close or clear them promptly. Python str and bytes objects cannot be reliably wiped.

Use context managers for every Vault, Lockbox, key, secret, and agent value. Secret callbacks receive a temporary bytearray that is cleared after return and must not escape. Native failures raise typed exceptions with structured details and recovery guidance.

Optional session agent

Ordinary Lockbox opens never start or consult the agent. Use AgentSession when Lockbox keys need to be shared across processes or remain available after the process that opened the Lockbox exits. Closing an entry forgets the agent's cached key; it does not delete the Lockbox or a credential stored in the Vault.

Platform credential store

The operating system credential store can hold the Vault passphrase. The user's operating system login normally unlocks that store. After login, another process running as that user may be able to retrieve the passphrase if the access policy applied to the saved Vault passphrase does not require approval for each retrieval. Exact access depends on the operating system, the credential store configuration, and that access policy.

A process that retrieves the Vault passphrase can open the Vault. The Vault can then provide access to Lockboxes through profile keys or remembered Lockbox passwords. Both remain encrypted inside the Vault; they are not copied to the operating system credential store.

Agent expiry improves memory hygiene. It is not an authentication boundary after login if the saved Vault passphrase can be retrieved without approval.

Missing or placeholder package docstrings are binding defects; the executable conformance program is the worked reference for each operation.

Project links

Data verified by PyPI on Aug 30, 2026
Data provided by the project maintainers, verified at the time the release was uploaded to PyPI.

Key dates

PyPI data
Data sourced directly from PyPI's database.
  • Released:
Newer release available (0.3.15)

1 maintainer

PyPI data
Data sourced directly from PyPI's database.
Avatar for bsutton from gravatar.com bsutton

Credits

Author: OnePub

GitHub Statistics

Data verified by PyPI on Aug 30, 2026
The GitHub source repository was provided by the project maintainers and verified by PyPI at the time of upload. Stars, forks, and open issues/PRs are derived from that repository and have not been independently verified.

License expression

LicenseRef-reVault-Source-Available-1.0
View SPDX License List

Requires

Python >=3.10

Tags

encryption credentials archive security vault

Classifiers

Report project as malware

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distributions

No source distribution files available for this release.See tutorial on generating distribution archives.

Built Distributions

If you're not sure about the file name format, learn more about wheel file names.

revault_api-0.3.13-py3-none-win_arm64.whl (3.0 MB view details)

Uploaded Python 3Windows ARM64

revault_api-0.3.13-py3-none-win_amd64.whl (3.3 MB view details)

Uploaded Python 3Windows x86-64

revault_api-0.3.13-py3-none-manylinux_2_39_x86_64.whl (5.5 MB view details)

Uploaded Python 3manylinux: glibc 2.39+ x86-64

revault_api-0.3.13-py3-none-manylinux_2_39_aarch64.whl (5.2 MB view details)

Uploaded Python 3manylinux: glibc 2.39+ ARM64

revault_api-0.3.13-py3-none-macosx_11_0_universal2.whl (2.2 MB view details)

Uploaded Python 3macOS 11.0+ universal2 (ARM64, x86-64)

revault_api-0.3.13-py3-none-macosx_10_13_universal2.whl (2.4 MB view details)

Uploaded Python 3macOS 10.13+ universal2 (ARM64, x86-64)

File details

Details for the file revault_api-0.3.13-py3-none-win_arm64.whl.

File metadata

  • Download URL: revault_api-0.3.13-py3-none-win_arm64.whl
  • Upload date:
  • Size: 3.0 MB
  • Tags: Python 3, Windows ARM64
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/7.0.0 CPython/3.13.14

File hashes

Hashes for revault_api-0.3.13-py3-none-win_arm64.whl
Algorithm Hash digest
SHA256 54e1287b9902fe15b5a5e7a5f89255737fd3453e9b12fada6f08969076108daa
MD5 dd3b703ed7cbdfd6584300c3266e2894
BLAKE2b-256 3223f73f85f0acfbee08b408f589e80db73cdc8d829614efb9693a0dd67a16e1

See more details on using hashes here.

Provenance

The following attestation bundles were made for revault_api-0.3.13-py3-none-win_arm64.whl:

Publisher: bindings-native-release.yml on onepub-dev/reVault

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file revault_api-0.3.13-py3-none-win_amd64.whl.

File metadata

  • Download URL: revault_api-0.3.13-py3-none-win_amd64.whl
  • Upload date:
  • Size: 3.3 MB
  • Tags: Python 3, Windows x86-64
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/7.0.0 CPython/3.13.14

File hashes

Hashes for revault_api-0.3.13-py3-none-win_amd64.whl
Algorithm Hash digest
SHA256 160f21b2e56e66c11e8f1fd7043e890dace219e28dc8f63bb379f5b39a2fdb42
MD5 7ee3f5e0c366ba1746d5445261fc8bd6
BLAKE2b-256 4665574cc5a953546c63348277bda8c7038c239eccacb51802e5e964c36fbae7

See more details on using hashes here.

Provenance

The following attestation bundles were made for revault_api-0.3.13-py3-none-win_amd64.whl:

Publisher: bindings-native-release.yml on onepub-dev/reVault

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file revault_api-0.3.13-py3-none-manylinux_2_39_x86_64.whl.

File metadata

File hashes

Hashes for revault_api-0.3.13-py3-none-manylinux_2_39_x86_64.whl
Algorithm Hash digest
SHA256 55cf6cba91e63c5d77ab235ea32004a8fd91722ecf42becc2bf3ab0d46a0ac15
MD5 7d3c70d48a0db5247490be93f4ef6d31
BLAKE2b-256 eea36cad1fc8d720633697104ac8ddab359bdbb3ffe2ab400396c71bdf15ad8a

See more details on using hashes here.

Provenance

The following attestation bundles were made for revault_api-0.3.13-py3-none-manylinux_2_39_x86_64.whl:

Publisher: bindings-native-release.yml on onepub-dev/reVault

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file revault_api-0.3.13-py3-none-manylinux_2_39_aarch64.whl.

File metadata

File hashes

Hashes for revault_api-0.3.13-py3-none-manylinux_2_39_aarch64.whl
Algorithm Hash digest
SHA256 a96182995edf074ef618b29c5ac752adaf10083187c9c82d7ff64a6fc10c10a0
MD5 3b91f09887f5957c65039780bff5dafe
BLAKE2b-256 89675b9063cac725b2e3c62760f69c43392ba2a03aeb1f8434c53824b411b50f

See more details on using hashes here.

Provenance

The following attestation bundles were made for revault_api-0.3.13-py3-none-manylinux_2_39_aarch64.whl:

Publisher: bindings-native-release.yml on onepub-dev/reVault

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file revault_api-0.3.13-py3-none-macosx_11_0_universal2.whl.

File metadata

File hashes

Hashes for revault_api-0.3.13-py3-none-macosx_11_0_universal2.whl
Algorithm Hash digest
SHA256 24f87a774569dacd3d116c1224650755e6c3e7ec34fb98473c06c52ef1bf370e
MD5 8c42b612e1749a0a9a299c530321b570
BLAKE2b-256 1ba43473dc473d0ebd7e31abd24703adbd11f5d6d936ee5982ce17e1be5fa195

See more details on using hashes here.

Provenance

The following attestation bundles were made for revault_api-0.3.13-py3-none-macosx_11_0_universal2.whl:

Publisher: bindings-native-release.yml on onepub-dev/reVault

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file revault_api-0.3.13-py3-none-macosx_10_13_universal2.whl.

File metadata

File hashes

Hashes for revault_api-0.3.13-py3-none-macosx_10_13_universal2.whl
Algorithm Hash digest
SHA256 5f6136640cc4201218d56654b2d9ef88e818944fd0ae8312f0c85baedb89aa9f
MD5 515bfb6342825a8cf3a6a877fd21f46d
BLAKE2b-256 59d8d59247bb07b9bf3717fc9ecbe94c0abcedeb96a7d7a2fef85978783d40fa

See more details on using hashes here.

Provenance

The following attestation bundles were made for revault_api-0.3.13-py3-none-macosx_10_13_universal2.whl:

Publisher: bindings-native-release.yml on onepub-dev/reVault

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Release history Release notifications | RSS feed

0.3.15

6 files

0.3.14

6 files

This release

0.3.13 This release

6 files

0.3.12

6 files

0.3.11

6 files

0.1.0

6 files

Anthropic, PBC Visionary sponsor Bloomberg Visionary sponsor Hudson River Trading Visionary sponsor Meta Visionary sponsor NVIDIA Visionary sponsor Microsoft Sustainability sponsor Depot Continuous Integration AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page