OniLock GitHub

Free and open source

The password manager for your terminal.

OniLock keeps your passwords and private files in an encrypted vault on your own machine. Add, find and copy them with one command. Nothing is synced or uploaded.

pipx install onilock

Linux and macOS · Python 3.10+ · Apache License 2.0

Installation guide Read the code

Features

Everything stays in one vault, a few keystrokes away.

One small tool for the secrets you keep on your own machine: passwords, private files and the backups that protect them.

  • Passwords in one command

    Store an account with onilock new, see them all with onilock list, and copy a password with onilock copy. The clipboard clears itself after 10 seconds, so the password does not linger.

    newlistcopyremove-accountgenerate-pwd

  • Password health checks

    When you add a password, OniLock checks its length, variety and entropy, and warns you if it is a common password or one you already use elsewhere.

  • Private files

    Encrypt any file into the vault, then read it, edit it or export it again when you need it.

  • Backups and moves

    Make an encrypted backup, export the vault with a passphrase, and import it on another machine.

  • Separate profiles

    Keep work and personal vaults apart, and switch between them with onilock profiles use.

  • Made for scripts and aliases

    Every prompt has a matching flag, so OniLock runs in scripts, aliases and non-interactive shells. Shell completion is built in: run onilock --install-completion once.

    --master-password--passphrase--install-completion

  • A built-in doctor

    If something does not work, onilock doctor checks gpg, the keyring, the clipboard and the vault folder permissions.

Security

Security you can check for yourself.

OniLock is open source, so every claim on this page can be checked against the code. Here is how it protects your vault, and where its protection stops.

Read the security notes

  • Encrypted and sealed

    The vault uses a versioned format encrypted with AES-GCM, which also detects any change made to the file. Older vaults are upgraded to this format when OniLock reads them.

  • A master password that resists guessing

    Your master password is checked with bcrypt, at 12 rounds by default. Five wrong attempts within five minutes lock the vault for five minutes.

  • A clipboard that cleans up

    A copied password is cleared from the clipboard after 10 seconds.

  • Keys in your system keyring

    OniLock keeps its keys in the system keyring when one is available.

  • An audit log

    Vault events such as account changes, exports, imports and file operations are written to a local audit log.

  • Nothing leaves your machine

    There is no account, no server and no sync. OniLock does not send your vault anywhere.

What OniLock cannot protect against

A compromised operating system, a keylogger, or someone who can inspect the running process. File names and timestamps in the vault folder can be visible to anyone with access to your account, unless you export with encryption.

Install

Up and running in four steps.

OniLock is a Python package. We recommend installing it with pipx, which keeps it in its own environment.

  1. Install the tools it uses

    OniLock needs pipx to install, gpg for encryption and, on Linux, xclip for the clipboard.

    Debian and Ubuntu

    sudo apt install pipx xclip gpg

    macOS, with Homebrew

    brew install pipx gnupg

  2. Install OniLock

    Run this outside any active virtual environment.

    pipx install onilock

  3. Create your vault

    Choose a strong master password and keep it somewhere safe, or leave it empty and OniLock generates one for you.

    onilock initialize-vault

  4. Turn on shell completion

    Optional. Tab completes commands and options from then on.

    onilock --install-completion

To update later, run pipx upgrade onilock. Every release is listed in the changelog.

Commands

Command reference

Every command, grouped. Add --help to any of them for its options.

Passwords

onilock new
Add an account to the vault.
onilock list
List all stored accounts.
onilock copy NAME
Copy an account's password to the clipboard.
onilock remove-account NAME
Remove an account from the vault.
onilock generate-pwd
Generate a random password.

Files

onilock encrypt-file
Encrypt a file and save it in the vault.
onilock list-files
List the encrypted files in the vault.
onilock read-file
Open an encrypted file in read-only mode.
onilock edit-file
Open an encrypted file and edit it in place.
onilock export-file
Decrypt a file and export it to its original format.
onilock export-all-files
Export all encrypted files to a zip archive.
onilock delete-file
Permanently delete an encrypted file from the vault.

Vault

onilock initialize-vault
Create the vault for the active profile.
onilock backup
Create an encrypted backup of the vault.
onilock restore PATH
Restore a vault backup.
onilock export-vault
Export the vault, with --encrypt to protect it with a passphrase.
onilock import-vault PATH
Import a vault export, merging or with --replace.
onilock erase-user-data
Permanently delete all OniLock data for this profile.

Profiles and keys

onilock profiles list
List known profiles.
onilock profiles use NAME
Set the active profile for future commands.
onilock profiles remove NAME
Remove a profile and delete its local data.
onilock keys list
List GPG keys and the active vault key.
onilock keys rotate-secret
Rotate the vault secret key and re-encrypt stored passwords.
onilock keys delete
Delete a GPG key by name or key ID.

Utilities

onilock doctor
Diagnose environment and configuration problems.
onilock version
Print the installed OniLock version and the vault format.

FAQ

Questions people ask

Is OniLock free?

Yes. OniLock is open source under the Apache License 2.0. You can use it, read the code, change it and share it.

Where is my data stored?

In ~/.onilock in your home folder. To keep the vault somewhere else, set the ONI_VAULT_DIR environment variable.

Does OniLock send my passwords anywhere?

No. There is no account, no server and no sync. To move your vault, make an encrypted backup or export and import it on the other machine.

Does it work over SSH?

Yes. OniLock runs in any terminal. To copy passwords, the machine needs a working clipboard, which on Linux means xclip.

Does it run on Windows?

OniLock is built for Linux and macOS. On Windows, run it inside WSL.

How do I report a bug?

Open an issue on GitHub. To report a security problem privately, email [email protected] instead of opening a public issue.

Start with one command.

Install OniLock, create a vault, and your passwords are one command away.

pipx install onilock
Installation guide View on GitHub