domenkozar/factorseal

FactorSeal is a local credential manager written in Rust that ties secret storage to your machine's hardware. It stores passwords and other credentials using the standard "service plus account" naming convention that existing keyring APIs already use, so applications can interact with it through familiar interfaces. An encrypted vault stays on your local machine, and there are no encrypted secret files left sitting in your project repositories. By default, FactorSeal relies on hardware security features available on your platform. On macOS it uses the Secure Enclave, and on Windows and Linux it uses TPM 2.0. The tool is strict about its security guarantees: if it detects that hardware protection is unavailable and a software fallback would be used instead, it refuses to operate. A vault created with one hardware backend cannot be silently switched to another. Every credential is encrypted individually using a cipher called XChaCha20-Poly1305, and the system takes care to keep decrypted values in memory only briefly, wiping them as soon as they are no longer needed. FactorSeal also supports an optional second factor using a YubiKey. When this feature is enabled, the vault key is split into two separate pieces. One piece is protected by your machine's hardware, and the other is protected by a PIN required on the YubiKey itself. Both pieces are required to unlock the vault, meaning neither factor alone can grant access. The YubiKey must already have a compatible key configured in a specific slot, and FactorSeal will never overwrite or create keys on the device. The project provides a command line interface for creating a vault, storing a credential, retrieving it, and checking status. Developers can also use it as a library through a keyring API. A password migration mode exists for moving older vaults to the newer hardware-backed format, but it is intentionally not a fallback for hardware vaults. The README notes that a desktop unlock agent is on the roadmap. This agent would authorize once, hold the vault key for a limited session, and serve requests without caching plaintext credentials. The author includes a prominent warning that FactorSeal is an unaudited prototype and should not be used for production secrets until it receives independent security review.