vault-crypt
Minimalist encryption for those who live off the grid.
A GPG-powered vault manager for your .kdbx password databases.
No GUI. No cloud. Just your keys, your vault, and the silence between.
What is vault-crypt?
A BASH script that:
- Encrypts and signs your KeePassXC
.kdbxfile using GPG. - Decrypts when needed, verifies signature integrity.
- Purges the unsealed vault to eliminate traces.
- Backs up your encrypted vault with timestamped versions.
All operations are local. No 3rd-party sync.
You are the cloud. You are the guardian.
Philosophy
Your vault is your memory.
Sign it with your hand.
Seal it with your ghost.
Let no cloud eat what you protect.
— DeadSwitch
Features
- GPG encryption + signature validation
- File wiping of plaintext vaults
- Timestamped backup creation
- Lightweight and auditable
- Config via
.envfile
File Structure
.
├── examples
│ └── sample.env
├── README.md
└── vault-crypt.sh
Setup
Clone the repo
git clone https://github.com/DeadSwitch404/vault-crypt.git
cd vault-crypt
Copy and configure your env:
cp examples/sample.env .env.pwmanager
nano .env.pwmanager
Make the script executable:
chmod +x vault-crypt.sh
Test your GPG setup:
gpg --list-keys
Commands
./vault-crypt.sh encrypt # Encrypt and sign the KeePass DB
./vault-crypt.sh decrypt # Decrypt and validate the vault
./vault-crypt.sh status # Show vault state
./vault-crypt.sh backup # Create encrypted, timestamped backup
./vault-crypt.sh help # Show usage
Example .env.pwmanager
KEY_ID="deadbeef42"
PW_DIR="$HOME/vault/passwords"
CLEAR_PW_DB="secrets.kdbx"
CRYPT_PW_DB="secrets.kdbx.gpg"
BACKUP_DIR="$HOME/vault/backups"
TIMESTAMP=$(date +"%Y%m%d-%H%M")
CURRENT_DIR="$PWD"
Important:
Keep this .env file outside of version control.
DeadSwitch recommends using chmod 600 and storing it on encrypted storage.
Bonus: Harden Your Flow
- Use shred or srm to wipe files on exit (manual or optional enhancement).
- Alias vault-crypt.sh decrypt to open-sesame for that final hacker vibe.
- Run via cron for daily encrypted backups to external storage (offline preferred).
Backdoor-Free Guarantee
Audit it yourself.
You're home.
License
MIT.
Use. Fork. Adapt. Ghost away.
But respect the silence. Credit DeadSwitch.
DeadSwitch | The Silent Architect