Store, rotate, and retrieve secrets encrypted with Fernet (AES-128-CBC). Secrets are tied to the machine they were created on, preventing accidental leakage across environments.
Everything you need to store and manage secrets securely.
AES-128-CBC with HMAC-SHA256 for authenticated encryption.
Secrets tied to machine ID — cannot decrypt on other machines.
Persistent encrypted storage via wsqlite with Pydantic models.
Read secrets from /run/secrets when running in containers.
Rotate encryption keys with automatic re-encryption.
Auto-expire secrets with time-to-live settings.
Export/import encrypted vault snapshots.
Full async API: async_set, async_get, async_delete.