winacl
ACL/ACE/Security Descriptor manipulation library in pure Python
Decision gist · record as of 2026-08-14
Yes, if you need to work with Windows security descriptors outside a Windows environment or in cross-platform tooling. The low install friction, permissive license, and lack of known vulnerabilities make it a straightforward choice. However, note that the project is aging—last updated in May 2024—so verify that its feature set and compatibility match your specific Windows security descriptor versions before committing to a production dependency.AI-flagged interpretation of the facts on this page — verify before relying
Before you install
- Requires Python 3.6 or later.
- The package is platform-independent but designed for working with Windows security descriptor formats.
- Low friction installation as a pure-Python wheel with a single runtime dependency (cryptography).
License · maintenance · safety
permissive license (permissive) — MIT license (permissive) means you can use, modify, and distribute this package freely in both open-source and commercial projects with minimal restrictions.
last release 2024-05-06 (830 days) · last repo commit 2026-01-02 · 22 stars
0 known vulnerabilities (OSV.dev, 2026-08-14) · 87,604 downloads/mo, #13,783 on PyPI
Alternatives
Verify before relying
pip install winacl
from winacl.security_descriptor import SecurityDescriptor
# Parse a Windows security descriptor from binary
sd = SecurityDescriptor.from_bytes(descriptor_bytes)- Whether the package handles all modern Windows security descriptor formats and extensions
- Performance characteristics when parsing large or complex descriptor hierarchies
- Whether there are known limitations or edge cases in ACL/ACE manipulation
What it is and what it does
winacl is a pure-Python library for reading, parsing, and manipulating Windows security descriptors, access control lists (ACLs), and access control entries (ACEs). It runs on any platform without requiring Windows-specific system calls or compiled extensions, making it useful for security research, forensics, and cross-platform tooling that needs to work with Windows permission structures.
The package depends only on cryptography for its core functionality. It is designed for developers who need to analyze or modify Windows security metadata outside of a Windows environment, or who want to incorporate Windows ACL handling into cross-platform Python applications. The library operates on binary security descriptor formats directly.
Use it for
- Analyze Windows security descriptors extracted from forensic images or backups on non-Windows systems
- Build security auditing tools that examine ACL configurations across Windows file systems or Active Directory
- Develop penetration testing utilities that parse and manipulate Windows permissions for access control analysis
- Create cross-platform security research tools that work with Windows permission data without a Windows dependency
Worth the install?
AI-flagged interpretation of the facts on this page. Verify before relying on it.
Yes, if you need to work with Windows security descriptors outside a Windows environment or in cross-platform tooling.
The low install friction, permissive license, and lack of known vulnerabilities make it a straightforward choice. However, note that the project is aging—last updated in May 2024—so verify that its feature set and compatibility match your specific Windows security descriptor versions before committing to a production dependency.
Install
winacl on PyPI
Before you install
Low friction installation as a pure-Python wheel with a single runtime dependency (cryptography). Maintenance status is aging—last release was in May 2024 and the repository has not been updated since early January 2026, though it remains active and unarchived.
Requires Python 3.6 or later. The package is platform-independent but designed for working with Windows security descriptor formats.
License in practice
MIT license (permissive) means you can use, modify, and distribute this package freely in both open-source and commercial projects with minimal restrictions.
Quickstart
pip install winacl
from winacl.security_descriptor import SecurityDescriptor
# Parse a Windows security descriptor from binary
sd = SecurityDescriptor.from_bytes(descriptor_bytes)Verify before relying
- Whether the package handles all modern Windows security descriptor formats and extensions
- Performance characteristics when parsing large or complex descriptor hierarchies
- Whether there are known limitations or edge cases in ACL/ACE manipulation
Package facts
| License | permissive license permissive |
| Python support | Supports the current Python release >=3.6 |
| Install friction | Low. Pure-Python wheel |
| Runtime dependencies | 1 packagecryptography |
| Maintenance | Aging 830 days since the last release |
| Last repo commit | |
| First released | |
| Downloads | 87,604 / month, #13,783 on PyPI 30-day window, as of 2026-08-14 |
| Known vulnerabilities | None known OSV.dev, checked 2026-08-14 |
| Classifiers | License :: OSI Approved :: MIT LicenseOperating System :: OS IndependentProgramming Language :: Python :: 3.6 |
Evidence: winacl-0.1.9-py3-none-any.whl
Tags
Let your AI agent find packages like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 14,416 PyPI packages by what they can do, searchable in plain language.
wish › “windows security descriptor parsing”
- winaclParses and manipulates Windows security descriptors, ACLs, and ACEs…
- bbpbDecode and re-encode Protocol Buffer messages without access to the…
- rdkitRDKit is a chemoinformatics toolkit providing C++ and Python…
Give your agent the search over MCP, or paste the wish link into any chat.
More Security packages
Provides Python bindings to the FreeDesktop.org Secret Service API for securely storing and retrieving passwords and secrets through GNOME Keyring, KWallet, or KeePassXC.
MSAL for Python handles OAuth2 and OpenID Connect authentication with Microsoft identity services, managing token acquisition, caching, and refresh for applications integrating with Microsoft Entra ID, Microsoft Accounts, and Azure AD B2C.
joserfc implements JOSE standards (JWS, JWE, JWK, JWT, and related RFCs) for signing, encrypting, and managing JSON-based cryptographic tokens in Python.
Authlib provides a complete implementation of OAuth 1.0, OAuth 2.0, and OpenID Connect 1.0 for building both authentication clients and servers, with built-in support for JWS, JWK, JWA, and JWT standards.
Provides low-level CFFI bindings to the official Argon2 password hashing algorithm for use by libraries and applications that need direct access to Argon2 without higher-level abstractions.
ADAL for Python authenticates applications with Azure Active Directory to obtain tokens for accessing Azure AD-protected resources.
Install only if maintaining existing code that already depends on it, and plan a migration.
See also msldap · minidump · mitmproxy-windows · minikerberos · casbin · pypiwin32 · asysocks · pycasbin · python-barbicanclient · watchdog