Qt Config Vault

A secure, offline-first desktop application for managing application configurations and secrets. Built with PyQt5 and Python, featuring strong encryption and a professional Qt interface.

Features

• 🔐 Strong Encryption: AES-256-GCM encryption with PBKDF2 key derivation
• 👤 Multiple Profiles: Organize configurations into separate profiles
• 🌍 Environment Support: Manage configs for development, staging, and production
• 🔍 Search Functionality: Quickly find configurations by key or value
• 📦 Import/Export: Share profiles securely or backup your data
• 🔒 Auto-Lock: Automatic vault locking after 15 minutes of inactivity
• 🎨 Professional UI: Clean, intuitive PyQt5 interface
• 💾 Offline-First: All data stored locally and encrypted

Installation

Prerequisites

• Python 3.7 or higher
• pip

Install Dependencies

pip install -r requirements.txt

Usage

Starting the Application

python main.py

First-Time Setup

1. On first launch, you'll be prompted to create a new vault
2. Choose a strong master password (at least 8 characters)
3. Important: Remember this password - it cannot be recovered if lost!
4. A default profile will be created for you

Managing Configurations

Adding a Configuration

1. Click "Add Configuration" button or use the toolbar
2. Enter the key (e.g., DATABASE_URL)
3. Enter the value (e.g., postgresql://localhost/mydb)
4. Check "This is a secret" to mask sensitive values
5. Select the environment (default, development, staging, production)
6. Click OK

Editing a Configuration

• Double-click a row in the table, or
• Select a row and click "Edit Selected"

Deleting a Configuration

• Select a row and click "Delete Selected"

Working with Profiles

Profiles help you organize different sets of configurations (e.g., separate profiles for different projects).

Creating a Profile

1. Go to Profile → New Profile
2. Enter a profile name and optional description
3. Click OK

Switching Profiles

• Use the "Active Profile" dropdown at the top of the window

Deleting a Profile

• Go to Profile → Delete Current Profile
• Confirm the deletion (cannot delete the last profile)

Environment Filtering

Use the "Environment" dropdown to filter configurations by environment:

• All: Show all configurations
• default: Default environment
• development: Development environment
• staging: Staging environment
• production: Production environment

Search

Type in the search box to filter configurations by key or value. Search works across the currently selected environment filter.

Import/Export

Exporting a Profile

1. Go to Profile → Export Current Profile
2. Choose a location and filename (.vault extension)
3. The profile will be encrypted with your master password

Importing a Profile

1. Go to Profile → Import Profile
2. Select the .vault file
3. Enter your master password
4. If a profile with the same name exists, you'll be asked to overwrite

Exporting Vault (Plaintext Backup)

⚠️ Warning: This exports unencrypted data!

1. Go to Tools → Export Vault (Plaintext)
2. Confirm the warning
3. Choose a location for the JSON file
4. Keep this file secure!

Security Features

Auto-Lock

The vault automatically locks after 15 minutes of inactivity. Any action (adding, editing, viewing) resets the timer.

Locking Manually

• Go to File → Lock Vault, or
• Click the "Lock" button in the toolbar

Changing Master Password

1. Go to Tools → Change Master Password
2. Enter your current password
3. Enter and confirm your new password

File Storage

By default, the vault is stored at:

• Linux/Mac: ~/.config_vault.json
• Windows: C:\Users\<username>\.config_vault.json

The file is encrypted and cannot be read without the master password.

Security Best Practices

1. Use a Strong Master Password:

   • At least 12 characters
   • Mix of uppercase, lowercase, numbers, and symbols
   • Don't use common words or patterns

2. Keep Your Password Safe:

   • Don't share your master password
   • Don't write it down in plain text
   • Consider using a password manager

3. Regular Backups:

   • Export profiles periodically
   • Store encrypted backups in a secure location
   • Test restoring from backups

4. Mark Secrets Appropriately:

   • Check "This is a secret" for passwords, API keys, tokens
   • Secrets are masked in the UI as ••••••••

5. Lock When Not in Use:

   • Manually lock the vault when stepping away
   • The auto-lock provides additional protection

Technical Details

Encryption

• Algorithm: AES-256-GCM (Galois/Counter Mode)
• Key Derivation: PBKDF2-HMAC-SHA256 with 100,000 iterations
• Random Salt: 16 bytes per encryption
• Random Nonce: 12 bytes per encryption
• Authentication: Built-in GCM authentication tag

Data Structure

• Vault contains multiple profiles
• Each profile contains multiple configuration entries
• Each entry has: key, value, secret flag, environment, timestamps

Storage Format

• Data serialized as JSON
• Entire JSON encrypted with master password
• Base64 encoded for text storage
• Salt, nonce, tag, and ciphertext combined in output

Troubleshooting

"Failed to unlock vault: Invalid password"

• Double-check your password (case-sensitive)
• Ensure Caps Lock is off
• If you've forgotten your password, the vault cannot be recovered

"Failed to decrypt profile: Invalid password"

• The imported profile was encrypted with a different password
• Ensure you're using the correct password for that profile

Application won't start

• Check that all dependencies are installed: pip install -r requirements.txt
• Verify Python version: python --version (should be 3.7+)

Development

Project Structure

qt-config-vault/
├── main.py          # Main GUI application
├── encryption.py    # Encryption/decryption logic
├── models.py        # Data models (Vault, Profile, ConfigEntry)
├── storage.py       # Persistent storage backend
├── requirements.txt # Python dependencies
└── README.md        # This file

Running Tests

Currently, the project focuses on manual testing. To test:

1. Create a vault with a test password
2. Add various configurations with different environments
3. Test search, filter, edit, delete operations
4. Test profile creation, export, import
5. Test password change
6. Test auto-lock functionality

License

MIT License - see LICENSE file for details.

Contributing

Contributions are welcome! Please feel free to submit issues or pull requests.

Author

Max Base - GitHub