Show HN: Keepr – A Secure and Offline Open Source CLI Password Manager
17 points
7 days ago
| 4 comments
| HN
Hi HN,

I made Keepr, a simple offline CLI password manager for developers who prefer keeping secrets local and working entirely in the terminal.

Everything is stored in an encrypted SQLCipher database, protected by a master password. A time-limited session keeps the vault unlocked while you work, so you don’t need to re-enter the password constantly. Keepr never touches the network.

It includes commands to add, view, search, update, and delete entries, plus a secure password generator and clipboard support.

Technical details:

- AES-256 via SQLCipher

- PBKDF2-HMAC-SHA256 (1.2M iterations) for deriving the KEK

- KEK decrypts a stored PEK, which encrypts the vault

- Session file holds the PEK until expiry

GitHub: https://github.com/bsamarji/Keepr

PyPI: https://pypi.org/project/Keepr/

I would love some feedback, criticism or any questions, especially on UX or security!

Thanks for looking!

hcaz
6 days ago
[-]
Looks cool, but I think the name is very similar to Keeper (https://www.keepersecurity.com/en_GB/enterprise.html)
reply
bsamarji
5 days ago
[-]
Thanks for the feedback, I hope you check out the app! Yes I know it is similar, I actually went through several different names. I started with PassMaster and then PassMan. PassMan was already taken on PyPI, and PassMaster was also quite long to use for a cli command. I liked Keepr as it is short to type out and I like the connotations it has to keys, secrets and security!
reply
kseistrup
7 days ago
[-]
This looks neat.

Is there a way to change the password length? It seems PASSWORD_LENGTH is set to 20 in config.py, but if keepr is installed by the sysadmin, users won't be able to change this.

And about security: Even if the database is encrypted, it would be nice if keepr set the umask to at least 0027 (possibly even 0077) at startup so that everything is only readable by the user.

Cheers.

reply
bsamarji
7 days ago
[-]
You're correct, generated password length is fixed to 20 characters at the moment. I've got a priority task to make user config the next release which will enable the user to configure generated password length, colour scheme and session length. With regards to security, the way the database is encrypted is using your master password on intial setup. I'm not sure if there is a way to make the database readable, even setting it to readable to the user, since the database file itself is encrypted. This is for security purposes, and when I was desinging the app, I had trade-offs to make between security and user experience. Security was a top priority as I hadn't seen another password manager with this level of security before. I have a feature planned to enable export and import of data from the database to .csv/.json, so this might help with user experience. Thanks for the feedback, really appreciated. I hope you enjoy using the app!
reply
kseistrup
7 days ago
[-]
Great, thanks! :)
reply
bsamarji
4 days ago
[-]
I've just released v1.1.0 which now has user configuration for password generator settings, color scheme and session duration! I've updated the README on the main project page which now includes instructions for user configuration. Hope you enjoy the new feature!
reply
kseistrup
4 days ago
[-]
Thanks for the notification! :)
reply
bsamarji
4 days ago
[-]
No problem! :)
reply
johng
7 days ago
[-]
on MacOS at least I was able to use a password that was 9 characters in length. Installed via pipx, not sure if that makes a difference.
reply
kseistrup
7 days ago
[-]
Right, I should have been more explicit: Pre-existing passwords can have any length, but the "keepr add -g" command will always generate a password of length 20, and there is no obvious way to change that, save for editing the config.py file -- something that may not always be possible (or desirable).
reply
bsamarji
7 days ago
[-]
Hi, thanks for your feedback! Yes at the moment you can only change the password length via updating the config.py. This can only be done if you clone the repo and update the config.py yourself, not through installing off of PyPI. One of my first goals on the roadmap is to make configuration accessible to the user through the CLI, so they can change the generated password length, session time and colour scheme of the output. If you'd like I'd very much welcome a pull request if you want to help contribute to the project! Otherwise, I'll work on getting user configuration setup as a priority for the next release.
reply
adadu2
7 days ago
[-]
Does it work with python 3.12?
reply
bsamarji
7 days ago
[-]
It should do! There is nothing specific from Python 3.13 that I used, so it should work on Python 3.12
reply
adadu2
7 days ago
[-]
cool, thanks!
reply
bsamarji
7 days ago
[-]
No problem, I hope you like it! Let me know how you get on, I'm open to feedback to try and make the project as best as possible.
reply
johng
7 days ago
[-]
Looks neat, will give it a shot!
reply
bsamarji
7 days ago
[-]
Awesome, hope you like it! Let me know how you get on and if there is any feature you'd like adding! I'm always open to people contributing as well!
reply