keyrings.cryptfile is a Python library that provides an encrypted file keyring backend for the standard `keyring` package. It enables secure storage of plaintext passwords in a portable encrypted file, particularly useful when typical desktop environment keyring implementations are unsuitable. The project encrypts data using Argon2 for key derivation and authenticated AES encryption (GCM by default). The latest version is 1.3.9, released on November 20, 2022. While there isn't a strict release cadence, updates appear to be infrequent.
pip install keyrings-cryptfileVerified import paths — ran on the pinned version, not inferred.
This quickstart demonstrates how to initialize the `CryptFileKeyring`, set a master password (either interactively or via an environment variable for non-interactive use), store a service password, and then retrieve it. It also shows how to optionally integrate it with the main `keyring` library.
Always provide the `keyring_key` securely, for example, by prompting the user via `getpass`, or by retrieving it from an environment variable in non-interactive environments (e.g., `os.environ.get('KEYRING_CRYPTFILE_MASTER_PASSWORD')`).For automated scripts, ensure `kr.keyring_key` is set before calling password operations to avoid interactive prompts. Be aware of the inherent cryptographic delay in performance-sensitive contexts.
Ensure `keyring` is installed (`pip install keyring`) and `keyrings-cryptfile` is installed. If automatic selection is not working, explicitly set the keyring using `keyring.set_keyring(kr)` where `kr` is an instance of `CryptFileKeyring`.
Check the GitHub issues for `keyrings-cryptfile` for known compatibility problems. Consider pinning the `keyring` library to an older, compatible version (e.g., `pip install keyring==X.Y.Z`) or awaiting an update to `keyrings-cryptfile`.
Verify that the `keyring_key` (master password) provided is absolutely correct. If the password is correct and the error persists, the keyring file may be damaged, and recreating it might be the only solution.
Before any password operations, ensure that the `kr.keyring_key` attribute is set programmatically, typically by reading the master password from a secure environment variable (e.g., `os.environ.get('KEYRING_CRYPTFILE_MASTER_PASSWORD')`).