reVault for Python

reVault is a fast, local toolkit for creating secure portable archives called Lockboxes. Each Lockbox is encrypted, compressed, and signed. It can store files and directory trees, variables such as API keys, and forms such as login details.

Lockboxes are easy to copy, share, and back up, and they do not require a hosted service. The engine is designed for speed and effective compression. Applications can read, write, and seek within stored files without extracting the archive, and recover data from partial corruption. reVault provides a command line tool for everyday work and APIs for application code.

Read the reVault manual for the quick start, core concepts, and security model.

Your Vault holds your profile and contacts. The CLI protects a new Lockbox for your profile by default, and you can grant access to contacts using their public keys. Use password access when you do not have a recipient's contact (public key) details.

Platform wheels include the reVault engine and expose Python classes for Lockboxes, Vaults, keys, and the session agent.

Installation and native runtime

python -m pip install revault-api

PyPI publishes a wheel for each supported operating system and architecture. The wheel stores the matching library inside revault_api/_native, and the package loads it through ctypes. Installing from a source archive does not supply a library unless the package is assembled with the matching native files.

The complete method example index is maintained in the source repository.

from revault_api import Revault, SecretString, Vault

runtime = Revault.load()                 # loading does not open a Vault
signing = runtime.generate_profile_signing_key_pair()
public_signing_key = signing.public_key()
with runtime.lockbox_create(bytes(32)) as box:  # Lockbox held by this process
    box.set_owner_signing_key(signing)  # Profile becomes this Lockbox's owner
    box.add_file("/hello.txt", b"hello\n", False)
    box.set_variable("owner", "alice")
    box.set_secret_variable("token", bytearray(b"secret"))
    size = box.with_secret_variable("token", lambda token: len(token))
    box.commit()
public_signing_key.close()
signing.close()

with SecretString("Vault passphrase") as vault_passphrase:
    persistent = Vault.open_or_create("/tmp/revault-vault", vault_passphrase)
    persistent.close()

Revault.load(native_library_path=...) can load a native library supplied by the application. Otherwise, reVault checks REVAULT_LIBRARY and then the library inside the installed wheel. A bare name uses the operating system search path.

The value passed to a secret callback is a temporary bytearray; it is cleared after the callback. Do not convert it to a retained str or bytes. SecretString and SecretBytes own mutable buffers and wipe them on close(). Ordinary Lockbox operations never contact the agent.

Core API concepts

  • Revault loads the runtime.
  • Vault owns persistent local state.
  • Lockbox owns an open archive.
  • AgentSession caches selected content keys.

Prefer context managers and close each object independently.

API documentation and support

The wheel ships typed public classes and method docstrings. Use help(revault_api) or an API documentation generator for the installed version. The method examples and Python conformance program cover the common operation inventory.

Create, open, and replace

Open methods require existing Vaults and Lockboxes; they never create missing state. Use open or create only when creation is acceptable and replacement methods only after an explicit destructive choice. commit() persists pending Lockbox changes. close() releases the handle and content key held by the current process but does not commit or delete the archive.

Open that archive using its Lockbox password, a profile key, or a credential resolved from the Vault. A profile signing key becomes a Lockbox owner key only after explicit assignment.

Secrets, exceptions, and ownership

A vault passphrase, Lockbox password, and 32-byte content key are different secrets. Use SecretString, SecretBytes, and mutable bytearray values; close or clear them promptly. Python str and bytes objects cannot be reliably wiped.

Use context managers for every Vault, Lockbox, key, secret, and agent value. Secret callbacks receive a temporary bytearray that is cleared after return and must not escape. Native failures raise typed exceptions with structured details and recovery guidance.

Optional session agent

Ordinary Lockbox opens never start or consult the agent. Use AgentSession when Lockbox keys need to be shared across processes or remain available after the process that opened the Lockbox exits. Closing an entry forgets the agent's cached key; it does not delete the Lockbox or a credential stored in the Vault.

Platform credential store

The operating system credential store can hold the Vault passphrase. The user's operating system login normally unlocks that store. After login, another process running as that user may be able to retrieve the passphrase if the access policy applied to the saved Vault passphrase does not require approval for each retrieval. Exact access depends on the operating system, the credential store configuration, and that access policy.

A process that retrieves the Vault passphrase can open the Vault. The Vault can then provide access to Lockboxes through profile keys or remembered Lockbox passwords. Both remain encrypted inside the Vault; they are not copied to the operating system credential store.

Agent expiry improves memory hygiene. It is not an authentication boundary after login if the saved Vault passphrase can be retrieved without approval.

Missing or placeholder package docstrings are binding defects; the executable conformance program is the worked reference for each operation.

Project links

Data verified by PyPI on Sep 7, 2026
Data provided by the project maintainers, verified at the time the release was uploaded to PyPI.

Key dates

PyPI data
Data sourced directly from PyPI's database.
  • Released:
Newer release available (0.3.15)

1 maintainer

PyPI data
Data sourced directly from PyPI's database.
Avatar for bsutton from gravatar.com bsutton

Credits

Author: OnePub

GitHub Statistics

Data verified by PyPI on Sep 7, 2026
The GitHub source repository was provided by the project maintainers and verified by PyPI at the time of upload. Stars, forks, and open issues/PRs are derived from that repository and have not been independently verified.

License expression

LicenseRef-reVault-Source-Available-1.0
View SPDX License List

Requires

Python >=3.10

Tags

encryption credentials archive security vault

Classifiers

Report project as malware

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distributions

No source distribution files available for this release.See tutorial on generating distribution archives.

Built Distributions

If you're not sure about the file name format, learn more about wheel file names.

revault_api-0.3.14-py3-none-win_arm64.whl (3.1 MB view details)

Uploaded Python 3Windows ARM64

revault_api-0.3.14-py3-none-win_amd64.whl (3.3 MB view details)

Uploaded Python 3Windows x86-64

revault_api-0.3.14-py3-none-manylinux_2_39_x86_64.whl (5.5 MB view details)

Uploaded Python 3manylinux: glibc 2.39+ x86-64

revault_api-0.3.14-py3-none-manylinux_2_39_aarch64.whl (5.3 MB view details)

Uploaded Python 3manylinux: glibc 2.39+ ARM64

revault_api-0.3.14-py3-none-macosx_11_0_universal2.whl (2.2 MB view details)

Uploaded Python 3macOS 11.0+ universal2 (ARM64, x86-64)

revault_api-0.3.14-py3-none-macosx_10_13_universal2.whl (2.4 MB view details)

Uploaded Python 3macOS 10.13+ universal2 (ARM64, x86-64)

File details

Details for the file revault_api-0.3.14-py3-none-win_arm64.whl.

File metadata

  • Download URL: revault_api-0.3.14-py3-none-win_arm64.whl
  • Upload date:
  • Size: 3.1 MB
  • Tags: Python 3, Windows ARM64
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/7.0.0 CPython/3.13.14

File hashes

Hashes for revault_api-0.3.14-py3-none-win_arm64.whl
Algorithm Hash digest
SHA256 7a42f734c7be7705221dc7cf1866901d7b53689dceb0bf02f74dcffa31871e95
MD5 f11cf5f85080edf645350283d1af9e43
BLAKE2b-256 5a62e3e7493f89cf0e3f2b87bba2d2f31cc5b7a8f976a0251a25d9d8b4e298c5

See more details on using hashes here.

Provenance

The following attestation bundles were made for revault_api-0.3.14-py3-none-win_arm64.whl:

Publisher: bindings-native-release.yml on onepub-dev/reVault

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file revault_api-0.3.14-py3-none-win_amd64.whl.

File metadata

  • Download URL: revault_api-0.3.14-py3-none-win_amd64.whl
  • Upload date:
  • Size: 3.3 MB
  • Tags: Python 3, Windows x86-64
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/7.0.0 CPython/3.13.14

File hashes

Hashes for revault_api-0.3.14-py3-none-win_amd64.whl
Algorithm Hash digest
SHA256 1fc58daed31a459c21902e899f1a80d5982595592d27a478b45e75ab399cd9d7
MD5 9bc44cc036e0042390848db4c60eef1c
BLAKE2b-256 0948c8f741b47a87135c70588ca7c6e5ed9254c3cb630e18895dad3b920572f6

See more details on using hashes here.

Provenance

The following attestation bundles were made for revault_api-0.3.14-py3-none-win_amd64.whl:

Publisher: bindings-native-release.yml on onepub-dev/reVault

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file revault_api-0.3.14-py3-none-manylinux_2_39_x86_64.whl.

File metadata

File hashes

Hashes for revault_api-0.3.14-py3-none-manylinux_2_39_x86_64.whl
Algorithm Hash digest
SHA256 2e060e72e20dce1c0817e155068fb49277bafca382e113494fa64cc896fc1f0b
MD5 ae92093730f9d13646cab6c8062618f8
BLAKE2b-256 e6089b43a966f28cbabd9bf1c02337ae23e1d7b0084ec7261d2b6490b32ce5f6

See more details on using hashes here.

Provenance

The following attestation bundles were made for revault_api-0.3.14-py3-none-manylinux_2_39_x86_64.whl:

Publisher: bindings-native-release.yml on onepub-dev/reVault

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file revault_api-0.3.14-py3-none-manylinux_2_39_aarch64.whl.

File metadata

File hashes

Hashes for revault_api-0.3.14-py3-none-manylinux_2_39_aarch64.whl
Algorithm Hash digest
SHA256 b0a717c95cbf6c9637715a629800f89ac9ce4b7f4ff2123d64ebfdfefc166dea
MD5 0544a7691e51f4b0bfa016b570cdbefa
BLAKE2b-256 5e0d9411dd929eacb97c357177a93fe0e9020113ff18e8f938045f11819224b4

See more details on using hashes here.

Provenance

The following attestation bundles were made for revault_api-0.3.14-py3-none-manylinux_2_39_aarch64.whl:

Publisher: bindings-native-release.yml on onepub-dev/reVault

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file revault_api-0.3.14-py3-none-macosx_11_0_universal2.whl.

File metadata

File hashes

Hashes for revault_api-0.3.14-py3-none-macosx_11_0_universal2.whl
Algorithm Hash digest
SHA256 debe2eb6a312fecbe4fbaccd670f19c50b1833330f4a70903e4b3bba3b7cac82
MD5 9941c957dfcb3f9ae8e16f59f0bb2492
BLAKE2b-256 94a34150e6d566d82e8b96a62893ed87e4830ce75903d7a2b5a648e7a1430920

See more details on using hashes here.

Provenance

The following attestation bundles were made for revault_api-0.3.14-py3-none-macosx_11_0_universal2.whl:

Publisher: bindings-native-release.yml on onepub-dev/reVault

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file revault_api-0.3.14-py3-none-macosx_10_13_universal2.whl.

File metadata

File hashes

Hashes for revault_api-0.3.14-py3-none-macosx_10_13_universal2.whl
Algorithm Hash digest
SHA256 c8cfb65b5d19d73d6d533b9d4be8dc88b53e11336ec743da960524c803ca6812
MD5 4861054f11e12dacce206209a1425b9d
BLAKE2b-256 cbac2a2b9a6aae4938060c860b0b390e5f6fa4f7e0f576e17c5df6355b82a69e

See more details on using hashes here.

Provenance

The following attestation bundles were made for revault_api-0.3.14-py3-none-macosx_10_13_universal2.whl:

Publisher: bindings-native-release.yml on onepub-dev/reVault

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Release history Release notifications | RSS feed

0.3.15

6 files

This release

0.3.14 This release

6 files

0.3.13

6 files

0.3.12

6 files

0.3.11

6 files

0.1.0

6 files

Anthropic, PBC Visionary sponsor Bloomberg Visionary sponsor Hudson River Trading Visionary sponsor Meta Visionary sponsor NVIDIA Visionary sponsor Microsoft Sustainability sponsor Depot Continuous Integration AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page