I made Keepr, a simple offline CLI password manager for developers who prefer keeping secrets local and working entirely in the terminal.
Everything is stored in an encrypted SQLCipher database, protected by a master password. A time-limited session keeps the vault unlocked while you work, so you don’t need to re-enter the password constantly. Keepr never touches the network.
It includes commands to add, view, search, update, and delete entries, plus a secure password generator and clipboard support.
Technical details:
- AES-256 via SQLCipher
- PBKDF2-HMAC-SHA256 (1.2M iterations) for deriving the KEK
- KEK decrypts a stored PEK, which encrypts the vault
- Session file holds the PEK until expiry
GitHub: https://github.com/bsamarji/Keepr
PyPI: https://pypi.org/project/Keepr/
I would love some feedback, criticism or any questions, especially on UX or security!
Thanks for looking!
Is there a way to change the password length? It seems PASSWORD_LENGTH is set to 20 in config.py, but if keepr is installed by the sysadmin, users won't be able to change this.
And about security: Even if the database is encrypted, it would be nice if keepr set the umask to at least 0027 (possibly even 0077) at startup so that everything is only readable by the user.
Cheers.