ansible-vault

What it is and what it does

ansible-vault is a Python library for reading and writing Ansible vault-encrypted YAML files outside of the Ansible CLI. It wraps the vault encryption/decryption functionality, letting you load encrypted vault data into Python objects and serialize modified data back to encrypted vault format.

The package depends on ansible-core and PyYAML, making it suitable for automation scripts, configuration management tools, or applications that need to work with Ansible vault files programmatically. It's been actively maintained since 2015 and is marked production-stable, with recent updates through 2026.

Use it for:

• Decrypt Ansible vault files in Python scripts to access secrets without invoking the Ansible CLI
• Automate vault file updates by loading, modifying, and re-encrypting YAML configuration data
• Integrate Ansible vault decryption into CI/CD pipelines or deployment automation tools
• Build configuration management tools that need to read and write encrypted Ansible vault data

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Reads and writes Ansible vault-encrypted YAML files programmatically, allowing you to load encrypted vault data and dump data back to encrypted vault format.

Yes, if you need to work with Ansible vault files from Python code. The package is actively maintained, has low install friction, and no known vulnerabilities. However, the GPL-3.0-or-later copyleft license means you cannot use it in proprietary closed-source projects without licensing the entire work under GPL.

Install

ansible-vault on PyPI

pip install ansible-vault

uv add ansible-vault

poetry add ansible-vault

Installing ansible-vault

Before you install

Low friction installation with only two runtime dependencies (ansible-core and PyYAML). Actively maintained with a recent commit in April 2026 and stable production status.

License in practice

Licensed under GPL-3.0-or-later (copyleft). Any derivative work or distribution must also be licensed under a compatible GPL version, which may restrict use in proprietary projects.

Quickstart

pip install ansible-vault

from ansible_vault import Vault

vault = Vault('password')
data = vault.load(open('vault.yml').read())
vault.dump(data, open('vault.yml', 'w'))

Verify before relying

• Whether the package works with Ansible versions beyond those implied by ansible-core dependency
• Performance characteristics when handling large vault files
• Whether password handling supports environment variables or external key management systems

Package facts

Evidence: ansible_vault-4.1.0-py3-none-any.whl

Tags

More Cryptography packages