winacl

What it is and what it does

winacl is a pure-Python library for reading, parsing, and manipulating Windows security descriptors, access control lists (ACLs), and access control entries (ACEs). It runs on any platform without requiring Windows-specific system calls or compiled extensions, making it useful for security research, forensics, and cross-platform tooling that needs to work with Windows permission structures.

The package depends only on cryptography for its core functionality. It is designed for developers who need to analyze or modify Windows security metadata outside of a Windows environment, or who want to incorporate Windows ACL handling into cross-platform Python applications. The library operates on binary security descriptor formats directly.

Use it for:

• Analyze Windows security descriptors extracted from forensic images or backups on non-Windows systems
• Build security auditing tools that examine ACL configurations across Windows file systems or Active Directory
• Develop penetration testing utilities that parse and manipulate Windows permissions for access control analysis
• Create cross-platform security research tools that work with Windows permission data without a Windows dependency

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Parses and manipulates Windows security descriptors, ACLs, and ACEs in pure Python without requiring Windows-specific libraries or system calls.

Yes, if you need to work with Windows security descriptors outside a Windows environment or in cross-platform tooling. The low install friction, permissive license, and lack of known vulnerabilities make it a straightforward choice. However, note that the project is aging—last updated in May 2024—so verify that its feature set and compatibility match your specific Windows security descriptor versions before committing to a production dependency.

Install

winacl on PyPI

pip install winacl

uv add winacl

poetry add winacl

Installing winacl

Before you install

Low friction installation as a pure-Python wheel with a single runtime dependency (cryptography). Maintenance status is aging—last release was in May 2024 and the repository has not been updated since early January 2026, though it remains active and unarchived.

License in practice

MIT license (permissive) means you can use, modify, and distribute this package freely in both open-source and commercial projects with minimal restrictions.

Quickstart

pip install winacl

from winacl.security_descriptor import SecurityDescriptor

# Parse a Windows security descriptor from binary
sd = SecurityDescriptor.from_bytes(descriptor_bytes)

Requires Python 3.6 or later. The package is platform-independent but designed for working with Windows security descriptor formats.

Verify before relying

• Whether the package handles all modern Windows security descriptor formats and extensions
• Performance characteristics when parsing large or complex descriptor hierarchies
• Whether there are known limitations or edge cases in ACL/ACE manipulation

Package facts

Evidence: winacl-0.1.9-py3-none-any.whl

Tags

More Security packages