---
id: winacl
version: "0.1.9"
license: unclear
license_treatment: permissive
maintenance: aging
---

# winacl — ACL/ACE/Security Descriptor manipulation library in pure Python

License: permissive · Maintenance: aging · Downloads: 87.6K/mo

## What it is and what it does

winacl is a pure-Python library for reading, parsing, and manipulating Windows security descriptors, access control lists (ACLs), and access control entries (ACEs). It runs on any platform without requiring Windows-specific system calls or compiled extensions, making it useful for security research, forensics, and cross-platform tooling that needs to work with Windows permission structures.

The package depends only on cryptography for its core functionality. It is designed for developers who need to analyze or modify Windows security metadata outside of a Windows environment, or who want to incorporate Windows ACL handling into cross-platform Python applications. The library operates on binary security descriptor formats directly.

Use it for:

- Analyze Windows security descriptors extracted from forensic images or backups on non-Windows systems
- Build security auditing tools that examine ACL configurations across Windows file systems or Active Directory
- Develop penetration testing utilities that parse and manipulate Windows permissions for access control analysis
- Create cross-platform security research tools that work with Windows permission data without a Windows dependency

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Parses and manipulates Windows security descriptors, ACLs, and ACEs in pure Python without requiring Windows-specific libraries or system calls.

Yes, if you need to work with Windows security descriptors outside a Windows environment or in cross-platform tooling. The low install friction, permissive license, and lack of known vulnerabilities make it a straightforward choice. However, note that the project is aging—last updated in May 2024—so verify that its feature set and compatibility match your specific Windows security descriptor versions before committing to a production dependency.

## Install

pip install winacl
uv add winacl
poetry add winacl

## Installing winacl

Before you install: Low friction installation as a pure-Python wheel with a single runtime dependency (cryptography). Maintenance status is aging—last release was in May 2024 and the repository has not been updated since early January 2026, though it remains active and unarchived.

License in practice: MIT license (permissive) means you can use, modify, and distribute this package freely in both open-source and commercial projects with minimal restrictions.

Quickstart:

pip install winacl

from winacl.security_descriptor import SecurityDescriptor

# Parse a Windows security descriptor from binary
sd = SecurityDescriptor.from_bytes(descriptor_bytes)

Requires Python 3.6 or later. The package is platform-independent but designed for working with Windows security descriptor formats.

Verify before relying:

- Whether the package handles all modern Windows security descriptor formats and extensions
- Performance characteristics when parsing large or complex descriptor hierarchies
- Whether there are known limitations or edge cases in ACL/ACE manipulation

## Package facts

- License: not declared (permissive)
- Python support: supports_current
- Install friction: low
- Maintenance: aging
- Downloads: 87.6K/month (top 15,000 on PyPI)
- Known vulnerabilities: none known

## Tags

windows security descriptor parsing, ACL ACE manipulation python, windows permissions library, security descriptor analysis, cross-platform windows acl, python windows security, access control list parsing, windows-security, forensics, cross-platform

[View on SkillFed](https://skillfed.io/packages/winacl) · [View on PyPI](https://pypi.org/project/winacl/)