Your API keys, encrypted, offline, on your terms.

One encrypted file, one password only you know, and a CLI that gets your keys in and out without ever leaving them lying around. No account. No server. No cloud sync to worry about.

Install now See it in action View on GitHub 
# one command and you're in
pip install microvault
microvault

Features

Everything a scattered pile of .env files should have been.

MicroVault stores every API key in one encrypted file and gets it in and out of your shell without it ever sitting in plaintext on disk.

CORE
🔒

Hidden key entry

Adding a key is a hidden prompt, same as typing a password — it never echoes, never lands in your shell history.

🏷️

Name services whatever you want

openai, aws, that-weird-internal-tool — no fixed list to fight with.

📥

Bulk import

Parses NAME=value, NAME: value, NAME value, even export NAME=value — and shows you exactly what it parsed before touching your vault.

🐚

One-line shell export

eval "$(microvault env)" — every stored key becomes a real environment variable for that session, gone the moment you close the terminal.

🔀

Alias any env var name

Tools expect odd names (WPSCAN_API_TOKEN, VTCLI_APIKEY, GH_TOKEN). alias maps MicroVault's name to whatever that tool actually wants.

⚡

microvault run

Unlocks the vault, injects the key, and replaces itself with the real command — one line instead of the eval + run dance. Ideal for MCP servers spawned as subprocesses.

🐍

Python API

from microvault import vault — vault.get("openai") reads the same encrypted file the CLI uses. No server, no daemon.

🧭

Arrow-key menu

The interactive vault opens directly into a navigable action menu; prompts collect service names, aliases, paths, and profiles after each selection.

What's actually happening under the hood

Real encryption, not obfuscation.

MicroVault isn't a text file with a fancy name. It's a proper encrypted vault, and it's built so that losing the password means the keys are actually gone — for anyone, including us.

  • PBKDF2-SHA256, 600,000 iterations — deliberately expensive, so brute-forcing the password isn't cheap either
  • Fernet (AES-128-CBC + HMAC-SHA256) — every key encrypted at rest, tamper-evident, not just unreadable
  • Atomic writes — a crash or power loss mid-save leaves you the old file or the new file, never a corrupted mess
  • Auto-snapshot backups — every save backs itself up, so an accidental delete is a restore away
  • Password never written anywhere — not to disk, not to a log, not to memory longer than it has to be
$ microvault

Master password: ********

Choose a command: Add a key
Service name: openai
API Key (input hidden): ••••••••••••••••••••••
Saved openai.

$ eval "$(microvault env)"
OPENAI_API_KEY exported.

Forgot the password? Nobody can recover it —
that's the deal for real security.

Start in 60 seconds

Installation

01

Install

pip install microvault
Then run microvault. First run asks you to set a master password.

02

Store a key

Choose Add a key in the interactive menu.
Paste the key at the hidden prompt. It never touches your screen or shell history.

03

Load it into your shell

eval "$(microvault env)"
Every stored key becomes a real env var for that session only.

Using a stored key with any tool

Same four steps, every time, no matter what the tool is.

A lot of real tools expect a specific env var name that isn't the obvious one. alias bridges MicroVault's naming to whatever that tool actually expects.

# 1. store it from the MicroVault menu Choose a command: Add a key Service name: wpscan_api API Key (input hidden): [paste the key] Saved wpscan_api. # 2. alias it to what the tool expects Choose a command: Configure an environment alias Service name to set an alias for: wpscan_api Export name (suggested: WPSCAN_API_TOKEN): [Enter] wpscan_api will now export as WPSCAN_API_TOKEN. # 3. load it into your shell eval "$(microvault env wpscan_api)" # 4. run the tool — it auto-reads the env var wpscan --url https://your-authorized-target.com

Or skip the eval + run dance entirely — microvault run unlocks the vault, injects the key, and replaces itself with the real command. The key is never written to disk, never shown on screen, and lives only as long as the process does:

microvault run github -- npx -y @modelcontextprotocol/server-github

Adaptive integration

Built to pair with MeXiCOSINT

MicroVault is a standalone encrypted CLI with a supported MeXiCOSINT integration: MeXiCOSINT can detect it automatically and pull its five service keys without an unencrypted config file.

AUTO-DETECTED

MeXiCOSINT reads your vault automatically

If you use MeXiCOSINT for Mexican phone number OSINT, run microvault, choose Add a key five times, and store these exact service names:

geoapify opencage_api ipgs numverify_api abstract_api

Then create the supported mexicosint profile, so MeXiCOSINT only ever sees its own five keys — never the rest of your vault:

microvault profile mexicosint \ geoapify opencage_api ipgs numverify_api abstract_api

MeXiCOSINT detects MicroVault and the supported mexicosint profile automatically on launch — no flag, no config file to edit, nothing in plaintext.

Storage

Everything lives at ~/.microvault/

📁

Default location

~/.microvault/ — one encrypted vault, non-secret metadata, and a rolling encrypted backup.

🧭

Configurable

Set MICROVAULT_HOME and the vault follows you there.

🐍

Python API

vault.get("openai"), vault.env_name("github"), vault.list() — password prompt fires once per process, then reuses the in-memory session.