keyrings.cryptfile

What it is and what it does

keyrings.cryptfile provides an encrypted file-based keyring backend for the keyring package, designed for scenarios where the system's default keyring storage (like GNOME Keyring or KDE Wallet) is unavailable or unsuitable. It stores passwords in a portable .ini-format file secured with Argon2 key derivation and authenticated AES encryption (GCM by default), with support for CCM, EAX, and OCB schemes.

The package encrypts each password with a keyring master password, deriving an Argon2 hash that serves as the encryption key. Service and user identifiers are included as associated data in the authenticated encryption, preventing tampering. The resulting encrypted data, salt, nonce, and MAC are stored in a text file. Operations are intentionally slow (around 1 second per call) due to the Argon2 KDF, which raises the computational cost of brute-force attacks.

Use it for:

• Store API keys and database passwords in a portable encrypted file for development environments without a system keyring.
• Secure credential storage in containerized or headless systems where desktop keyring services are unavailable.
• Protect plaintext passwords in configuration files by replacing them with keyring lookups.
• Implement password management in cross-platform scripts that need consistent credential handling.
• Archive encrypted credentials in version control or backups with protection against casual inspection.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

A keyring backend that stores passwords in an encrypted file using Argon2 key derivation and authenticated AES encryption, integrating with the keyring package for portable credential storage.

Yes, with conditions. Install if you need portable encrypted password storage and can tolerate high build friction (C compiler, development headers) and the ~1 second delay per password operation. The MIT license and active maintenance are favorable. Skip if your system already has a working keyring service or if build dependencies are unavailable; the package is not suitable for high-frequency password access due to intentional KDF slowness.

Install

keyrings-cryptfile on PyPI

pip install keyrings-cryptfile

uv add keyrings-cryptfile

poetry add keyrings-cryptfile

Installing keyrings.cryptfile

Before you install

High install friction: the package requires compilation of cryptographic dependencies (argon2-cffi, pycryptodome, cryptography) and system development packages (python-devel, openssl-devel). Maintenance is active with a recent commit (2026-06-26), though the latest release is from 2022-11-20.

License in practice

MIT license is permissive, allowing commercial and private use with minimal restrictions—suitable for most projects.

Quickstart

from keyrings.cryptfile.cryptfile import CryptFileKeyring
kr = CryptFileKeyring()
kr.set_password("service", "user", "secret")
password = kr.get_password("service", "user")

Requires C compiler and development headers (python-devel, openssl-devel) to build cryptographic dependencies; KDF operations introduce ~1 second delay per password operation.

Verify before relying

• Whether the Argon2 parameters (m=65536, t=15, p=2) remain resistant to modern attacks beyond 2017.
• Current security posture of the static reference value encryption scheme against known-plaintext attacks.
• Whether keyring integration requires additional setup beyond instantiation.

Package facts

Evidence: keyrings.cryptfile-1.3.9.tar.gz

Tags

More Cryptography packages