reVault for Python

reVault is a fast, local toolkit for creating secure portable archives called Lockboxes. Each Lockbox is encrypted, compressed, and signed. It can store files and directory trees, variables such as API keys, and forms such as login details.

Lockboxes are easy to copy, share, and back up, and they do not require a hosted service. The engine is designed for speed and effective compression. Applications can read, write, and seek within stored files without extracting the archive, and recover data from partial corruption. reVault provides a command line tool for everyday work and APIs for application code.

Read the reVault manual for the quick start, core concepts, and security model.

Your Vault holds your profile and contacts. The CLI protects a new Lockbox for your profile by default, and you can grant access to contacts using their public keys. Use password access when you do not have a recipient's contact (public key) details.

Platform wheels include the reVault engine and expose Python classes for Lockboxes, Vaults, keys, and the session agent.

Installation and native runtime

python -m pip install revault-api

PyPI publishes a wheel for each supported operating system and architecture. The wheel stores the matching library inside revault_api/_native, and the package loads it through ctypes. Installing from a source archive does not supply a library unless the package is assembled with the matching native files.

The complete method example index is maintained in the source repository.

from revault_api import Revault, SecretString, Vault

runtime = Revault.load()                 # loading does not open a Vault
signing = runtime.generate_profile_signing_key_pair()
public_signing_key = signing.public_key()
with runtime.lockbox_create(bytes(32)) as box:  # Lockbox held by this process
    box.set_owner_signing_key(signing)  # Profile becomes this Lockbox's owner
    box.add_file("/hello.txt", b"hello\n", False)
    box.set_variable("owner", "alice")
    box.set_secret_variable("token", bytearray(b"secret"))
    size = box.with_secret_variable("token", lambda token: len(token))
    box.commit()
public_signing_key.close()
signing.close()

with SecretString("Vault passphrase") as vault_passphrase:
    persistent = Vault.open_or_create("/tmp/revault-vault", vault_passphrase)
    persistent.close()

Revault.load(native_library_path=...) can load a native library supplied by the application. Otherwise, reVault checks REVAULT_LIBRARY and then the library inside the installed wheel. A bare name uses the operating system search path.

The value passed to a secret callback is a temporary bytearray; it is cleared after the callback. Do not convert it to a retained str or bytes. SecretString and SecretBytes own mutable buffers and wipe them on close(). Ordinary Lockbox operations never contact the agent.

Core API concepts

  • Revault loads the runtime.
  • Vault owns persistent local state.
  • Lockbox owns an open archive.
  • AgentSession caches selected content keys.

Prefer context managers and close each object independently.

API documentation and support

The wheel ships typed public classes and method docstrings. Use help(revault_api) or an API documentation generator for the installed version. The method examples and Python conformance program cover the common operation inventory.

Create, open, and replace

Open methods require existing Vaults and Lockboxes; they never create missing state. Use open or create only when creation is acceptable and replacement methods only after an explicit destructive choice. commit() persists pending Lockbox changes. close() releases the handle and content key held by the current process but does not commit or delete the archive.

Open that archive using its Lockbox password, a profile key, or a credential resolved from the Vault. A profile signing key becomes a Lockbox owner key only after explicit assignment.

Secrets, exceptions, and ownership

A vault passphrase, Lockbox password, and 32-byte content key are different secrets. Use SecretString, SecretBytes, and mutable bytearray values; close or clear them promptly. Python str and bytes objects cannot be reliably wiped.

Use context managers for every Vault, Lockbox, key, secret, and agent value. Secret callbacks receive a temporary bytearray that is cleared after return and must not escape. Native failures raise typed exceptions with structured details and recovery guidance.

Optional session agent

Ordinary Lockbox opens never start or consult the agent. Use AgentSession when Lockbox keys need to be shared across processes or remain available after the process that opened the Lockbox exits. Closing an entry forgets the agent's cached key; it does not delete the Lockbox or a credential stored in the Vault.

Platform credential store

The operating system credential store can hold the Vault passphrase. The user's operating system login normally unlocks that store. After login, another process running as that user may be able to retrieve the passphrase if the access policy applied to the saved Vault passphrase does not require approval for each retrieval. Exact access depends on the operating system, the credential store configuration, and that access policy.

A process that retrieves the Vault passphrase can open the Vault. The Vault can then provide access to Lockboxes through profile keys or remembered Lockbox passwords. Both remain encrypted inside the Vault; they are not copied to the operating system credential store.

Agent expiry improves memory hygiene. It is not an authentication boundary after login if the saved Vault passphrase can be retrieved without approval.

Missing or placeholder package docstrings are binding defects; the executable conformance program is the worked reference for each operation.

Project links

Data verified by PyPI on Sep 9, 2026
Data provided by the project maintainers, verified at the time the release was uploaded to PyPI.

Key dates

PyPI data
Data sourced directly from PyPI's database.
  • Released:
Latest release

1 maintainer

PyPI data
Data sourced directly from PyPI's database.
Avatar for bsutton from gravatar.com bsutton

Credits

Author: OnePub

GitHub Statistics

Data verified by PyPI on Sep 9, 2026
The GitHub source repository was provided by the project maintainers and verified by PyPI at the time of upload. Stars, forks, and open issues/PRs are derived from that repository and have not been independently verified.

License expression

LicenseRef-reVault-Source-Available-1.0
View SPDX License List

Requires

Python >=3.10

Tags

encryption credentials archive security vault

Classifiers

Report project as malware

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distributions

No source distribution files available for this release.See tutorial on generating distribution archives.

Built Distributions

If you're not sure about the file name format, learn more about wheel file names.

revault_api-0.3.15-py3-none-win_arm64.whl (3.1 MB view details)

Uploaded Python 3Windows ARM64

revault_api-0.3.15-py3-none-win_amd64.whl (3.3 MB view details)

Uploaded Python 3Windows x86-64

revault_api-0.3.15-py3-none-manylinux_2_39_x86_64.whl (5.6 MB view details)

Uploaded Python 3manylinux: glibc 2.39+ x86-64

revault_api-0.3.15-py3-none-manylinux_2_39_aarch64.whl (5.4 MB view details)

Uploaded Python 3manylinux: glibc 2.39+ ARM64

revault_api-0.3.15-py3-none-macosx_11_0_universal2.whl (2.2 MB view details)

Uploaded Python 3macOS 11.0+ universal2 (ARM64, x86-64)

revault_api-0.3.15-py3-none-macosx_10_13_universal2.whl (2.5 MB view details)

Uploaded Python 3macOS 10.13+ universal2 (ARM64, x86-64)

File details

Details for the file revault_api-0.3.15-py3-none-win_arm64.whl.

File metadata

  • Download URL: revault_api-0.3.15-py3-none-win_arm64.whl
  • Upload date:
  • Size: 3.1 MB
  • Tags: Python 3, Windows ARM64
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/7.0.0 CPython/3.13.14

File hashes

Hashes for revault_api-0.3.15-py3-none-win_arm64.whl
Algorithm Hash digest
SHA256 1262fa81a540dc7ab5214f7e4c0c5060ea8d6beb406f646203a58a3407d2e301
MD5 154b687b4b77f04bf16d7fe3a9d31235
BLAKE2b-256 5cfdd1c0ac275bde760c99d56b1244b7287e49c080fad46b59d23977da62a39d

See more details on using hashes here.

Provenance

The following attestation bundles were made for revault_api-0.3.15-py3-none-win_arm64.whl:

Publisher: bindings-native-release.yml on onepub-dev/reVault

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file revault_api-0.3.15-py3-none-win_amd64.whl.

File metadata

  • Download URL: revault_api-0.3.15-py3-none-win_amd64.whl
  • Upload date:
  • Size: 3.3 MB
  • Tags: Python 3, Windows x86-64
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/7.0.0 CPython/3.13.14

File hashes

Hashes for revault_api-0.3.15-py3-none-win_amd64.whl
Algorithm Hash digest
SHA256 f7d4b914e021a709d4b91fe53d8a948bb231188cdf622fbecca415defa266deb
MD5 fb05027b7d6eb677b4d5e77052c1d7a4
BLAKE2b-256 93c8d2a8af5c58619dc1430fcf8889659ce71f13e0a13b70e27675644fbff9a7

See more details on using hashes here.

Provenance

The following attestation bundles were made for revault_api-0.3.15-py3-none-win_amd64.whl:

Publisher: bindings-native-release.yml on onepub-dev/reVault

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file revault_api-0.3.15-py3-none-manylinux_2_39_x86_64.whl.

File metadata

File hashes

Hashes for revault_api-0.3.15-py3-none-manylinux_2_39_x86_64.whl
Algorithm Hash digest
SHA256 b16d7362944af5dbb46d6464a0aee4c1c5f261f7232e02ffcdb55a51f190dec4
MD5 a96870a504bd45c4e14f1b0651927ced
BLAKE2b-256 79bfdf9bd75b7ff98d7c500eb55cdc6857e588b9040bbd4a370e2a5b07604bdb

See more details on using hashes here.

Provenance

The following attestation bundles were made for revault_api-0.3.15-py3-none-manylinux_2_39_x86_64.whl:

Publisher: bindings-native-release.yml on onepub-dev/reVault

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file revault_api-0.3.15-py3-none-manylinux_2_39_aarch64.whl.

File metadata

File hashes

Hashes for revault_api-0.3.15-py3-none-manylinux_2_39_aarch64.whl
Algorithm Hash digest
SHA256 ddc95be6ded3ad81bcee9846827f8544c6997048f3d78e5d9c20dd2a50f76f62
MD5 63dd068b8cb6a09175fa4c59e8477ee0
BLAKE2b-256 91c58d7d62c4f85df9cd6c7479d198a24590f7a1a3cc5777cb1dd1855c3a61dc

See more details on using hashes here.

Provenance

The following attestation bundles were made for revault_api-0.3.15-py3-none-manylinux_2_39_aarch64.whl:

Publisher: bindings-native-release.yml on onepub-dev/reVault

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file revault_api-0.3.15-py3-none-macosx_11_0_universal2.whl.

File metadata

File hashes

Hashes for revault_api-0.3.15-py3-none-macosx_11_0_universal2.whl
Algorithm Hash digest
SHA256 27f2278552ae777a5f93cb366f02b69a7a7e6718d9c003f3e92f518553949a3d
MD5 be8d712e73693dcdf4d733570b9e287e
BLAKE2b-256 ff51de7b431948890610b011bfee99c61dfead57aded6fb3eef833bf65676293

See more details on using hashes here.

Provenance

The following attestation bundles were made for revault_api-0.3.15-py3-none-macosx_11_0_universal2.whl:

Publisher: bindings-native-release.yml on onepub-dev/reVault

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file revault_api-0.3.15-py3-none-macosx_10_13_universal2.whl.

File metadata

File hashes

Hashes for revault_api-0.3.15-py3-none-macosx_10_13_universal2.whl
Algorithm Hash digest
SHA256 da71c6f26f848de5d17d5930740390154858d9e711153159a7cf65f0527fb605
MD5 b09ca85796afa4cf0229738dc8831c45
BLAKE2b-256 fe2c9ce22e373fb906e61f26970eb00abafc067b89f8d3e9214600fe0f86ee72

See more details on using hashes here.

Provenance

The following attestation bundles were made for revault_api-0.3.15-py3-none-macosx_10_13_universal2.whl:

Publisher: bindings-native-release.yml on onepub-dev/reVault

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Release history Release notifications | RSS feed

This release

0.3.15 This release

6 files

0.3.14

6 files

0.3.13

6 files

0.3.12

6 files

0.3.11

6 files

0.1.0

6 files

Anthropic, PBC Visionary sponsor Bloomberg Visionary sponsor Hudson River Trading Visionary sponsor Meta Visionary sponsor NVIDIA Visionary sponsor Microsoft Sustainability sponsor Depot Continuous Integration AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page