Vault

v1.3

Command line password manager.

Install

You need python 3.9 to create executable and run vault password manager.

Manual installation

curl -L https://github.com/schwarzbox/Vault/archive/master.zip --output Vault.zip
unzip Vault.zip
rm Vault.zip

cd Vault-master
# create virtual environment to install shiv
python3 -m venv venv-shiv
. venv-shiv/bin/activate
pip3 install shiv
# create vault executable in the current dir
shiv -c vault -o vault --preamble preamble.py .
deactivate
# remove venv-shiv
rm -rf venv-shiv

You can move vault to /usr/local/bin for Mac and Linux OS.

mv vault /usr/local/bin

Use install.sh (bash only)

curl -L 'https://github.com/schwarzbox/Vault/archive/master.zip' --output Vault.zip
unzip Vault.zip
cd Vault-master

chmod 744 install.sh
# run in the same process
source ./install.sh

First run

vault -h

Info

vault --info

Version

vault --version

Create vault

# enter login and run sign-up process
vault [email protected] -up
# sign-in with login
vault [email protected] -in
# you can omit flag -in
vault [email protected]

Note: User can use same login with new password to create different vault.

Prepare JSON with your sensetive data. Try to use emojis in titles.

Use example below or use sample.json to test password manager.

{
    "💌 email": {
        "login": "[email protected]",
        "password": "1234"
    },
    "☁️ aws": {
        "login": "[email protected]",
        "password": "5678"
    },
    "🧰 database": {
        "django-local": "DATABASE_NAME=MYDB\nDATABASE_USER=postgres\nDATABASE_PASSWORD=''\nDATABASE_HOST=127.0.0.1\nDATABASE_PORT=5432\nDATABASE_CONN_MAX_AGE=600"
    },
    "🏠 personal": {
        "WIFI-HOME": "wifi-av"
    }
}

Load sample.json using command line or use TUI after sign-in.

vault [email protected] --load sample.json

Dump decrypted data from the source vault to JSON

vault [email protected] --dump

Remove vault from the local database

vault [email protected] -rm

Find local database dir

Iternally Vault use python package appdirs to determine where to save local encrypted database. For MacOS it is "~/Library/Application Support/VaultDB".

vault --find

Remote access

Vault creates default database and --source flag set to None. You can provide remote or local source for current session.

Upload encrypted database in GitHub or anywere else.

Load database in github repo. It is safe if you upload encrypted data.

vault [email protected] --source 'https://raw.githubusercontent.com/MYGIT/MYREPO/main/vault_data'

Load vault database in private github repo. You need to provide token. But this token expired and you need to generate new link.

vault [email protected] --source 'https://raw.githubusercontent.com/MYGIT/MYREPO/main/vault_data?token=TOKEN'

You can create secret gist and load encrypted database.

vault [email protected] --source 'https://gist.githubusercontent.com/MYGIT/1234/raw/1234/vault_data'

You can switch to remote source at runtime using TUI.

Use TUI to manage vault.

Add, update and clear data in the local vault

Use CL to manage vault.

Get data from the source vault

vault [email protected] -g aws login

vault [email protected] -g aws login | wc -c

List all groups and keys

vault [email protected] -l

Add data to the local vault

vault [email protected] -a aws login [email protected]

Update data in the local vault (default value for second argument is "vault")

vault [email protected] -u aws

You can update group name only

vault [email protected] -u group myaws

You can update key name only

vault [email protected] -u myaws myaws login username

You should use 5 arguments to update value

vault [email protected] -u myaws myaws username username [email protected]

Clear data in the local vault

vault [email protected] -c myaws username

Erase all data in the local vault

vault [email protected] -e

Encryption

Vault use SHA256 algorithm. Database is a simple JSON file.

1. When user sign-up app creates safe key using login and password.
2. App combine login and password in one credential string.
3. App uses safe key to encode credential string and get user token.
4. User token uses as unique key for the user vault.
5. All data in the user vault encrypted using safe key.
6. When user sign-in app creates new safe key from provided login and password.
7. App tries to decode each user token in database and compare with provided login and password.
8. User successfully sign-in when provided login and password matches with decoded data from user token.

Restore password and decode data

Vault never save your decrypted password. Still no way to restore it and decode ecrypted data without password.