Simple terminal-based password vault built with ncurses. It stores entries in a CSV-like file that is lightly obfuscated. Intended for learning and experimentation, not for protecting real secrets.

login	help
show all	show id

• Built and run on macOS (Darwin, ncurses).
• Expected to work on Linux and BSD variants with a C11 compiler and ncurses installed.
• Windows support is not verified; use WSL or a curses layer such as PDCurses/WinLibc if attempting a native build.

• Data is only XOR-obfuscated with the master password; this is not cryptographically secure.
• Use the program for testing and practice only; do not store sensitive credentials.
• The master password gates access but should be considered easily brute-forced if the DB is obtained.

How XOR obfuscation works (toy example):

Let P be a plaintext byte and K the matching byte of the key. The stored byte is C = P ⊕ K. To read, compute P = C ⊕ K. Example: P = 0x41 ('A'), K = 0x2B, then C = 0x41 ⊕ 0x2B = 0x6A; recovering: 0x6A ⊕ 0x2B = 0x41.

Prerequisites: C11-compatible compiler and ncurses development headers.

Clone from GitHub

# Prepare the dev directory, change it if it differs from yours ;-):
mkdir ~/dev/
cd ~/dev/
git clone https://github.com/rtulke/vaultdb.git

Build locally:

make

Install the binary (defaults to /usr/bin/vault, override with BINDIR=/custom/bin):

make install

Uninstall (prompts before deleting the database):

make uninstall

Prerequisites: C11-compatible compiler and ncurses development headers and sudo.

Clone from GitHub

# Prepare the dev directory, change it if it differs from yours ;-):
mkdir ~/dev/
cd ~/dev/
git clone https://github.com/rtulke/vaultdb.git

Build locally:

make

Install the binary (defaults to /usr/bin/vault, override with BINDIR=/custom/bin):

sudo make install

Uninstall (prompts before deleting the database):

sudo make uninstall

• Running as root stores the database at /var/lib/vaultdb/vault.db and the log at /var/log/vault.log.
• Running as a regular user stores the database at ~/.vault.db and the log at ~/.vault.log.

Interactive vault for keeping test credentials: add, view, edit, delete entries with fields such as description, user, password, URL, tags, dates, and status. Provides a basic wizard, command logging, and tab completion in the TUI.

• ncurses TUI with colorized header/body and centered dialogs.
• Auto-lock after 5 minutes of inactivity.
• Tab completion for commands, IDs, users, tags, and statuses.
• Cross-field search via show find (description/user/url/tags/comment/status).
• Copy password to clipboard for 10s via copy <id> (pbcopy/xclip/xsel/wl-copy/clip).
• Passwords are masked in table views; view details or copy to clipboard to reveal.
• Toggle password visibility in detail view via Ctrl+T/toggle after a show <id>.
• Extra fields: OTP/TOTP secret, security question, favorite flag; table shows a Fav column (*).
• Obfuscated CSV database persisted to ~/.vault.db (or system locations when root) with fields id,description,user,password,url,comment,tags,createdate,updatedate,status,otp,security_question,favorite.
• Command history logging to ~/.vault.log.
• Action logging with timestamps for add/change/delete/password ops and lock/unlock events.
• Wizard-driven entry creation and edits, including optional password generation.

• 1 digits, 2 letters, 3 alnum, 4 digits+specials, 5 letters+specials, 6 alnum+specials, 7 alnum+common-special.
• Special set defaults to !@#$%^&*()-_=+[]{};:'",.<>/?\~`; can be overridden when choosing a special mode.

• Strong encryption & KDF: AES-GCM + Argon2id (configurable memory/iterations) with auth-tag check.
• Master password policies: length/complexity checks and weak-password warnings.
• Field-level extras: OTP/TOTP fields, security questions, favorite/starred flag.
• Password reveal toggle in detail view (not only table masking).
• Entry expiry/reminders: expiry date with warning for expired entries.
• Backup/Import/Export: encrypted export/import (age/openssl), warn on plaintext; auto encrypted backup on save.
• Search/Filter: fuzzy search, combined filters (tag+user+status), sorting (updated desc/status), quick search alias, optional --json output.
• Clipboard enhancements: configurable timeout; copy user/URL/OTP.
• Audit/log options: toggle logging or reduce to errors/events without command text.
• Config file: ~/.vaultdbrc for defaults (DB path, auto-lock, clipboard timeout, colors, readonly).
• Multimaster/Key rotation: rotate master password with re-encrypt in one step.
• Entry templates: predefined templates (Web, SSH, API token) with suitable fields/status.
• TOTP: store secret and generate codes (if dependencies acceptable).
• Quick search: global find alias and optional --json output for scripting.
• Tests: unit tests for parser/save/load/encrypt; integration test (temp DB add/show/rm); fuzz CSV parser.

Purpose-built for demonstrations to highlight the weak XOR obfuscation. Do not use for unauthorized access.

Reads candidates from the wordlist until the CSV header decrypts.

python3 scripts/bruteforce.py wordlist --db ~/.vault.db --wordlist /path/to/wordlist.txt

python3 scripts/bruteforce.py exhaustive --db ~/.vault.db --min-len 4 --max-len 6 --charset alnum-special --special "%$#-+." --workers 4

Enumerates every combination in the length range using charset presets:

• digits, letters, alnum, special, digits-special, letters-special, alnum-special
• --special overrides the special-character set for presets that include specials.
• --workers sets parallel processes (default: detected CPU cores). Note that search space grows exponentially with length; keep ranges small for tests.
• Common special-character sets in real-world passwords often include symbols like !@#$%^&*()-_=+[]{};:'",.<>/?\~. Use --special` to reflect the set you want to test.

Example runs:

On an Apple M4 MacBook Pro (10 performance/efficiency cores visible), omitting --workers uses all detected cores. Specifying --workers N caps parallelism (e.g., --workers 4 uses 4 workers even if 10 are available).

# Minimal wordlist run with default DB — runtime depends on list size; a few million entries finish in seconds.
python3 scripts/bruteforce.py wordlist --wordlist /tmp/rockyou.txt

# Wordlist run with caps and quieter progress — 500k tries cap stays well under 10s at tens of millions checks/sec.
python3 scripts/bruteforce.py wordlist --db ~/.vault.db --wordlist ./small.txt --max-tries 500000 --time-limit 10 --progress-every 20000

# Stop after first two matches from wordlist — duration depends on where matches appear.
python3 scripts/bruteforce.py wordlist --wordlist ./candidates.txt --max-matches 2

# Exhaustive: digits only, 4–6 chars, 4 workers — ~1.1 million combos; sub-second at ~50M+ checks/sec.
python3 scripts/bruteforce.py exhaustive --min-len 4 --max-len 6 --charset digits --workers 4

# Exhaustive: alnum+special with custom specials, 4–5 chars, 6 workers — ~85 billion combos; hours to a day+ if fully searched (use limits).
python3 scripts/bruteforce.py exhaustive --min-len 4 --max-len 5 --charset alnum-special --special "%$#-+." --time-limit 15 --workers 6

# Exhaustive: common-special preset, length 4, stop after 100k — full space ~14 billion combos; capped run completes quickly, full run would take minutes to hours.
python3 scripts/bruteforce.py exhaustive --min-len 4 --max-len 4 --charset common-special --max-tries 100000

# Exhaustive: custom charset, very small space — 7^3=343 combos; instant.
python3 scripts/bruteforce.py exhaustive --min-len 3 --max-len 3 --charset custom --chars "abc123!" --progress-every 5000

# Exhaustive: run quietly (no progress logs) — letters len 4 => 26^4≈456k combos; sub-second to a couple seconds.
python3 scripts/bruteforce.py exhaustive --min-len 4 --max-len 4 --charset letters --quiet

# Exhaustive: common-special, len 4–8, auto-workers (~10 on an M4) — search space ~5×10^15 combos; even at ~100M/s aggregate this would take ~1.6 years, so use smaller ranges or wordlists instead.
python3 scripts/bruteforce.py exhaustive --min-len 4 --max-len 8 --charset common-special

Use only for legal testing/education; these lists can be very large.

• https://github.com/danielmiessler/SecLists (Passwords/Leaked-Databases, Passwords/Common-Credentials)
• https://github.com/berzerk0/Probable-Wordlists
• https://github.com/jeanphorn/wordlist
• https://github.com/kkrypt0nn/Wordlists
• https://github.com/kaonashi-passwords/Kaonashi
• https://crackstation.net/crackstation-human-only.txt.gz
• https://download.weakpass.com/wordlists/ (multiple mega/gigabyte dumps)
• https://haveibeenpwned.com/Passwords (Pwned Passwords download/API; SHA-1 hashes)
• https://github.com/PrinceDhaliwal/WordList-Collection
• https://https://github.com/topics/wordlist (GitHub Collection with Tags "wordlist")
• https://github.com/insidetrust/statistically-likely-usernames (usernames, sometimes paired with small password sets)