{"id":41258319,"url":"https://github.com/punitmishra/vaultic","last_synced_at":"2026-02-08T09:14:38.906Z","repository":{"id":330897997,"uuid":"1124353235","full_name":"punitmishra/vaultic","owner":"punitmishra","description":"🔐 Local-first, hardware-secured password manager with FIDO2/YubiKey support, AI-powered analysis, and beautiful CLI/TUI","archived":false,"fork":false,"pushed_at":"2025-12-29T00:24:56.000Z","size":103,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2025-12-31T15:13:45.401Z","etag":null,"topics":["cli","encryption","fido2","password-manager","rust","security"],"latest_commit_sha":null,"homepage":null,"language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/punitmishra.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":"ROADMAP.md","authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2025-12-28T21:39:39.000Z","updated_at":"2025-12-29T00:22:53.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/punitmishra/vaultic","commit_stats":null,"previous_names":["punitmishra/vaultic"],"tags_count":1,"template":false,"template_full_name":null,"purl":"pkg:github/punitmishra/vaultic","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/punitmishra%2Fvaultic","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/punitmishra%2Fvaultic/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/punitmishra%2Fvaultic/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/punitmishra%2Fvaultic/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/punitmishra","download_url":"https://codeload.github.com/punitmishra/vaultic/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/punitmishra%2Fvaultic/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":28677714,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-01-23T01:00:35.747Z","status":"ssl_error","status_checked_at":"2026-01-23T01:00:19.529Z","response_time":144,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cli","encryption","fido2","password-manager","rust","security"],"created_at":"2026-01-23T01:55:12.226Z","updated_at":"2026-02-08T09:14:38.883Z","avatar_url":"https://github.com/punitmishra.png","language":"Rust","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Vaultic\n\nA lightweight, security-focused password manager written in Rust with hardware authentication, end-to-end encryption, and AI-powered management.\n\n```\n ██╗   ██╗ █████╗ ██╗   ██╗██╗  ████████╗██╗ ██████╗\n ██║   ██║██╔══██╗██║   ██║██║  ╚══██╔══╝██║██╔════╝\n ██║   ██║███████║██║   ██║██║     ██║   ██║██║\n ╚██╗ ██╔╝██╔══██║██║   ██║██║     ██║   ██║██║\n  ╚████╔╝ ██║  ██║╚██████╔╝███████╗██║   ██║╚██████╗\n   ╚═══╝  ╚═╝  ╚═╝ ╚═════╝ ╚══════╝╚═╝   ╚═╝ ╚═════╝\n\n Local-first | Hardware Auth | AI-Powered | Zero Trust\n```\n\n## Features\n\n### Security\n- **XChaCha20-Poly1305** - Authenticated encryption with 256-bit keys\n- **Argon2id KDF** - Memory-hard key derivation (64MB default)\n- **Multi-Method Unlock** - Password, BIP39 recovery keys, or hardware keys\n- **X25519 Key Exchange** - Secure sharing with perfect forward secrecy\n- **Compressed Sessions** - DEFLATE-compressed, encrypted session files\n- **Zero Memory Leaks** - Sensitive data auto-zeroed with `zeroize`\n- **Local-Only** - No cloud, no servers, your data stays with you\n\n### What's Working\n\n| Feature | Status |\n|---------|--------|\n| Vault init/unlock/lock | ✅ Working |\n| Multi-method unlock (password, recovery key) | ✅ Working |\n| BIP39 recovery keys with QR display | ✅ Working |\n| Session management (15-min auto-expiry) | ✅ Working |\n| Add/List/Get/Edit/Delete/Search entries | ✅ Working |\n| Password generation with entropy analysis | ✅ Working |\n| Tag/folder filtering | ✅ Working |\n| Import (Bitwarden, LastPass, 1Password) | ✅ Working |\n| Export (JSON, CSV, Encrypted) | ✅ Working |\n| Interactive TUI mode (ratatui) | ✅ Working |\n| Shell completions (bash/zsh/fish/powershell) | ✅ Working |\n| Shell integration (exec, shell-init) | ✅ Working |\n| AI analysis (Ollama integration) | ✅ Working |\n| AI auto-tagging | ✅ Working |\n| HIBP breach checking | ✅ Working |\n| TOTP/2FA support | ✅ Working |\n| Identity management \u0026 secure sharing | ✅ Working |\n| X25519 key exchange | ✅ Working |\n| QR code generation | ✅ Working |\n| Simple web client | ✅ Working |\n| Password history (tracking + restore) | ✅ Working |\n| Batch operations (tag, delete, move) | ✅ Working |\n| Git credential helper | ✅ Working |\n| Health audit with scoring | ✅ Working |\n| FIDO2/YubiKey | 🔧 Structure ready (needs hardware) |\n\n---\n\n## Installation\n\n### Homebrew (macOS/Linux)\n\n```bash\nbrew tap punitmishra/vaultic\nbrew install vaultic\n```\n\n### From Source\n\n```bash\n# Clone repository\ngit clone https://github.com/punitmishra/vaultic.git\ncd vaultic\n\n# Build release binary\ncargo build --release\n\n# Install to PATH (optional)\ncp target/release/vaultic /usr/local/bin/\n\n# Verify installation\nvaultic --version\n```\n\n### Direct Download\n\nDownload pre-built binaries from the [releases page](https://github.com/punitmishra/vaultic/releases):\n- macOS (Intel): `vaultic-macos-x86_64.tar.gz`\n- macOS (Apple Silicon): `vaultic-macos-aarch64.tar.gz`\n- Linux (x86_64): `vaultic-linux-x86_64.tar.gz`\n- Linux (ARM64): `vaultic-linux-aarch64.tar.gz`\n- Linux (musl): `vaultic-linux-x86_64-musl.tar.gz`\n\n### Shell Completions\n\n```bash\n# Bash\nvaultic completions bash \u003e ~/.local/share/bash-completion/completions/vaultic\n\n# Zsh\nvaultic completions zsh \u003e ~/.zfunc/_vaultic\n\n# Fish\nvaultic completions fish \u003e ~/.config/fish/completions/vaultic.fish\n```\n\n---\n\n## Quick Start\n\n```bash\n# Initialize vault\nvaultic init --name \"My Vault\"\n\n# Unlock (creates 15-min session)\nvaultic unlock\n\n# Add entries\nvaultic add \"GitHub\" -u \"user@example.com\" -p \"secret\" --tags \"dev\"\nvaultic add \"AWS\" -u \"admin\" --generate --url \"https://aws.amazon.com\"\n\n# List entries\nvaultic list\n\n# Search entries\nvaultic search \"git\"\n\n# Generate password\nvaultic generate --length 24\n\n# Check vault health\nvaultic health\n\n# Lock when done\nvaultic lock\n```\n\n---\n\n## Usage\n\n### Vault Management\n\n```bash\n# Create a new vault\nvaultic init --name \"Personal\"\n\n# Create with high-security KDF (256MB memory)\nvaultic init --name \"Work\" --high-security\n\n# Unlock vault (default: 15 minute session)\nvaultic unlock\n\n# Unlock with custom timeout\nvaultic unlock --timeout 60\n\n# Check status\nvaultic status\n\n# Lock vault\nvaultic lock\n```\n\n### Multi-Method Unlock (v2.0)\n\n```bash\n# Migrate existing vault to v2 format\nvaultic migrate\n\n# Generate BIP39 recovery key\nvaultic recovery generate --qr\n\n# Unlock with recovery phrase\nvaultic recovery unlock\n\n# List configured unlock methods\nvaultic unlock-method list\n```\n\n### Password Entries\n\n```bash\n# Add entry interactively\nvaultic add \"Service Name\"\n\n# Add with all options\nvaultic add \"GitHub\" \\\n  --username \"user@example.com\" \\\n  --password \"your-password\" \\\n  --url \"https://github.com\" \\\n  --tags \"dev,work\" \\\n  --folder \"Development\"\n\n# Add with generated password\nvaultic add \"New Service\" -u \"user\" --generate --length 24\n\n# Get entry details\nvaultic get \"GitHub\"\n\n# Edit an entry\nvaultic edit \"GitHub\"\n\n# Delete an entry\nvaultic delete \"GitHub\"\n\n# Search entries\nvaultic search \"git\"\n\n# List all entries\nvaultic list\n\n# Filter by tags\nvaultic list --tags \"work\"\n```\n\n### Identity \u0026 Sharing\n\n```bash\n# View/create your identity\nvaultic identity show\n\n# Export your identity (share with others)\nvaultic identity export\n\n# Add someone's identity\nvaultic identity add \"Alice\" \"\u003cexported_identity_string\u003e\"\n\n# List trusted identities\nvaultic identity list\n\n# Share an entry securely\nvaultic share \"GitHub\" --to \"Alice\"\n\n# Share with expiration (24 hours)\nvaultic share \"AWS\" --to \"Bob\" --expires 24 --one-time\n```\n\n### Shell Integration\n\n```bash\n# Run command with vault secrets as environment variables\nvaultic exec \"AWS\" -- aws s3 ls\n\n# Generate shell aliases\neval \"$(vaultic shell-init bash)\"\neval \"$(vaultic shell-init zsh)\"\nvaultic shell-init fish | source\n\n# Use convenient aliases (after shell-init)\nvg GitHub          # Get entry\nvcp GitHub         # Copy password\nvrun GitHub aws    # Run with secrets\n```\n\n### AI Features\n\n```bash\n# Get AI-powered tag suggestions\nvaultic suggest --auto-tag\n\n# Apply suggested tags\nvaultic suggest --auto-tag --apply\n\n# Analyze password strength\nvaultic suggest --analyze\n\n# Check for breaches\nvaultic suggest --check-breaches\n```\n\n### Password Generation\n\n```bash\n# Generate secure password (20 chars)\nvaultic generate\n\n# Custom length\nvaultic generate --length 32\n\n# Without symbols\nvaultic generate --no-symbols\n\n# Digits only (PIN)\nvaultic generate --length 6 --no-uppercase --no-lowercase --no-symbols\n```\n\n### Import/Export\n\n```bash\n# Import from Bitwarden\nvaultic import bitwarden_export.json --format bitwarden\n\n# Import from LastPass\nvaultic import lastpass_export.csv --format lastpass\n\n# Import from 1Password\nvaultic import 1password_export.csv --format onepassword\n\n# Export to JSON (plaintext - handle carefully!)\nvaultic export backup.json --format json\n\n# Export encrypted backup\nvaultic export backup.vaultic --format encrypted\n```\n\n### Security Health Check\n\n```bash\n# Run security audit\nvaultic health\n\n# Verbose output with recommendations\nvaultic health --verbose\n```\n\n### Password History\n\n```bash\n# View password history for an entry\nvaultic history GitHub\n\n# Restore a previous password\nvaultic history GitHub --restore 2\n```\n\n### Batch Operations\n\n```bash\n# Add tags to multiple entries\nvaultic batch tag --add \"work\" GitHub AWS GitLab\n\n# Move entries to a folder\nvaultic batch move --folder \"Cloud\" AWS GCP Azure\n\n# Delete multiple entries (with confirmation)\nvaultic batch delete OldService1 OldService2\n```\n\n### Git Credential Helper\n\n```bash\n# Configure git to use vaultic\ngit config --global credential.helper vaultic\n\n# Or for a specific repository\ngit config credential.helper vaultic\n\n# Vaultic will now provide credentials for git operations\n```\n\n### Interactive TUI\n\nLaunch a full-screen terminal interface for managing your passwords:\n\n```bash\n# Make sure vault is unlocked first\nvaultic unlock\n\n# Launch terminal UI\nvaultic tui\n```\n\n```\n┌──────────────────────────────────────────────────────────────┐\n│  Vaultic - Password Manager                                  │\n├──────────────────────────────────────────────────────────────┤\n│ Entries (3)                                                  │\n│                                                              │\n│ ▶ AWS Console  admin@company.com  [cloud, work]             │\n│   GitHub       dev@example.com    [dev, code]               │\n│   Gmail        user@gmail.com     [personal]                │\n│                                                              │\n├──────────────────────────────────────────────────────────────┤\n│ j/k:nav  /:search  Enter:view  y:copy  d:delete  ?:help     │\n└──────────────────────────────────────────────────────────────┘\n```\n\n**Keybindings:**\n\n| Key | Action |\n|-----|--------|\n| `j` / `↓` | Move down |\n| `k` / `↑` | Move up |\n| `g` | Go to first entry |\n| `G` | Go to last entry |\n| `/` | Search entries |\n| `Enter` | View entry details |\n| `y` | Copy password to clipboard |\n| `p` | Toggle password visibility |\n| `d` | Delete entry (with confirmation) |\n| `r` | Refresh entries |\n| `?` | Show help screen |\n| `Esc` | Cancel / go back |\n| `q` | Quit |\n\n---\n\n## Architecture\n\n```\n┌─────────────────────────────────────────────────────────────┐\n│                        CLI Layer                            │\n│  ┌─────────┐ ┌─────────┐ ┌─────────┐ ┌─────────┐           │\n│  │ Commands│ │  Tables │ │Progress │ │  Colors │           │\n│  └────┬────┘ └────┬────┘ └────┬────┘ └────┬────┘           │\n└───────┼──────────┼──────────┼──────────┼───────────────────┘\n        │          │          │          │\n┌───────┴──────────┴──────────┴──────────┴───────────────────┐\n│                     Core Services                           │\n│  ┌─────────┐ ┌─────────┐ ┌─────────┐ ┌─────────┐           │\n│  │ Session │ │ Storage │ │ Crypto  │ │   AI    │           │\n│  └────┬────┘ └────┬────┘ └────┬────┘ └────┬────┘           │\n└───────┼──────────┼──────────┼──────────┼───────────────────┘\n        │          │          │          │\n┌───────┴──────────┴──────────┴──────────┴───────────────────┐\n│                   Data Layer                                │\n│  ┌─────────┐ ┌─────────┐ ┌─────────┐ ┌─────────┐           │\n│  │  Sled   │ │  Files  │ │  KDF    │ │ Keyring │           │\n│  │   DB    │ │(session)│ │ params  │ │  (v2)   │           │\n│  └─────────┘ └─────────┘ └─────────┘ └─────────┘           │\n└─────────────────────────────────────────────────────────────┘\n```\n\n### File Structure\n\n```\n~/.vaultic/\n├── db                  # Sled database (encrypted entries)\n├── conf                # Sled configuration\n├── blobs/              # Sled blob storage\n├── kdf_params.json     # Salt + KDF parameters\n├── keyring.json        # v2: Encrypted unlock method keys\n└── .session            # Encrypted session (temporary)\n```\n\n---\n\n## Security Model\n\n### Encryption Stack\n\n1. **Key Derivation**: Password → Argon2id (64MB memory, 3 iterations) → 32-byte master key\n2. **Key Expansion**: Master key → HKDF → encryption key + auth key\n3. **Data Encryption**: XChaCha20-Poly1305 with random nonces\n4. **Session Storage**: DEFLATE compression → XChaCha20-Poly1305 → file\n5. **Sharing**: X25519 ephemeral key exchange → XChaCha20-Poly1305\n\n### Multi-Method Unlock (v2)\n\n- **VaultKey**: Random 256-bit key that encrypts all vault data\n- **KEK (Key Encryption Key)**: Derived from unlock method (password, recovery key, hardware key)\n- **Wrapped Keys**: VaultKey encrypted with each KEK, stored in keyring.json\n- **Recovery Keys**: BIP39 24-word mnemonic for emergency recovery\n\n---\n\n## Development\n\n```bash\n# Run tests\ncargo test\n\n# Build debug\ncargo build\n\n# Build release\ncargo build --release\n\n# Run with debug logging\nVAULTIC_DEBUG=1 cargo run -- \u003ccommand\u003e\n\n# Format code\ncargo fmt\n\n# Lint\ncargo clippy\n```\n\n---\n\n## Test Results (v2.0.0)\n\n```\ncargo test: 264 tests passing\n  - 110 bin tests (CLI commands and parsing)\n  - 108 lib tests (crypto, storage, models, migration, recovery, ai)\n  - 41 integration tests (end-to-end workflows)\n  - 5 doctests (code examples)\n\ncargo build --release: Success\ncargo clippy: No warnings\ncargo fmt --check: Formatted\n\nAll features tested and working:\n✓ init, unlock, lock, status\n✓ add, list, get, edit, delete, search\n✓ generate, health, history\n✓ identity (show, export, add, list, remove)\n✓ share (with expiration, one-time)\n✓ recovery (generate, verify, unlock)\n✓ exec, shell-init\n✓ suggest (auto-tag, analyze, check-breaches)\n✓ batch, credential\n✓ tui, import, export, completions\n```\n\n---\n\n## Contributing\n\nContributions welcome! Please:\n1. Fork the repository\n2. Create a feature branch\n3. Run tests (`cargo test`)\n4. Format code (`cargo fmt`)\n5. Submit a pull request\n\n---\n\n## License\n\nMIT License - see [LICENSE](LICENSE) for details.\n\n---\n\n## Acknowledgments\n\n- [RustCrypto](https://github.com/RustCrypto) - Cryptographic primitives\n- [Sequoia PGP](https://sequoia-pgp.org/) - OpenPGP implementation\n- [Sled](https://sled.rs/) - Embedded database\n- [ratatui](https://ratatui.rs/) - Terminal UI framework\n\n---\n\n**Security Notice**: This is a security-sensitive application. Review the code before using with real credentials. Report vulnerabilities responsibly.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fpunitmishra%2Fvaultic","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fpunitmishra%2Fvaultic","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fpunitmishra%2Fvaultic/lists"}