æ:// væult #opensourceware MIT
æ

væult

A password-secured local vault · scrypt → AES-256-GCM · QR air-gap transport

◈ INSTALLsingle file
# the only hard dependency
pip install cryptography
# optional — QR transport only
pip install qrcode pillow pyzbar

# fetch the vault (single file)
curl -O https://myaelmendez.github.io/vaeult/vaeult.py
◈ USE>_æ|
python væult.py init              # passphrase ×2, min 8 chars
python væult.py set STRIPE_KEY    # value read hidden
python væult.py get STRIPE_KEY    # print to stdout
python væult.py list              # names only — never values
python væult.py verify            # round-trip · tamper · name-binding

# QR air-gap — carries the SEALED blob, never plaintext
python væult.py qr STRIPE_KEY     # → QR PNG
python væult.py qr-open qr.png    # decode + import
◈ DESIGNAEAD

Encrypted at rest

AES-256-GCM, fresh 96-bit nonce per entry.

Tamper detection

GCM auth tag — a flipped byte fails closed.

Name binding

Entry name is AEAD associated data — a renamed entry won't open.

Wrong passphrase

Sealed sentinel → clear refusal, not a crypto error.

Atomic writes

Write .tmp then os.replace.

No network

Never makes a request. Cannot exfiltrate by design.

◈ BOUNDARYcustody
ElementShips?
væult.py (the tool)✓ open, MIT
*.væult (your encrypted secrets)✗ never
passphrase✗ never stored, logged, or sent
QR payloadsealed envelope — inert without the passphrase

The tool is open. The secrets are not.

◈ RELEASEv0.1.0
væult.py   15023 B   sha256 816a0b7e36bc30f7e815893d951cbfe200e0fceb1257ad437371a4c32ee4f84c
kdf        scrypt n=32768 r=8 p=1
cipher     AES-256-GCM · AEAD · 96-bit nonce
runtime    Python ≥3.10 · no network

væult.py · README · boundary · manifest · LICENSE

æ:// home · skill-guide · æ:// language is compute
#HERMIPHICATIONISINEVITABLE
QR Verify