RHEX is a lightweight and secure command-line password and key manager written in Python. It provides encrypted local storage, configurable key generation, and a compact CLI workflow for creating, saving, listing, and resetting entries.
- Secure local password and key storage
- AES-GCM authenticated encryption for stored entries
- Configurable key length and charset via
config.toml - Automatic clipboard copy after new key generation
- One-time random data generation with
--random - Master password protection with optional Argon2id verification
- Encrypted backup archive with timestamped snapshots
- Startup banner can optionally print a GitHub link
- Displays install instructions when required packages are missing
- Fast CLI workflow with
--new-master-key,--random,--list-keys, and--delete-all - Encrypted entries are stored as Base64-encoded ciphertext in
data/data.enc --list-keysdecrypts and prints entries directly without creating a temporary plaintext file
RHEX was built with a simple philosophy: password management should be secure, straightforward, and free from unnecessary complexity.
Unlike larger password managers, RHEX focuses on local encrypted storage, a minimal dependency footprint, and a clean command-line experience.
Security is the primary goal of RHEX.
All stored data is encrypted using AES-GCM, providing both confidentiality and integrity.
Master password verification supports two modes:
- SHA-256 (default)
- Argon2id (recommended)
When security_mode is enabled in config.toml, the master password is stored using Argon2id hashing. Otherwise it uses SHA-256 with padded input.
Security Notice
RHEX uses modern cryptographic techniques, but users should review the source code and keep backups of important data separately.
- Python 3.11 or newer
Required packages:
- colorama
- pyfiglet
- pyperclip
- pyfastfile
- argon2-cffi
Install dependencies using:
python -m pip install -r requirements.txtIf required packages are missing, RHEX shows a helpful message and recommends installing dependencies from requirements.txt.
Clone the repository:
git clone https://github.com/batuhansenol/RHEX.gitEnter the project directory:
cd RHEXInstall dependencies:
python -m pip install -r requirements.txtpython main.py --new-master-keyUse this on first run when no master key exists. The command prompts you to enter a new master password interactively.
python main.py --randomThis prints a generated one-time value, copies it to the clipboard, and exits.
python main.pyThe application will:
- Verify the master password.
- Generate a secure random key.
- Copy the new key to the clipboard.
- Ask if you want to save the key under a name.
- Encrypt and store the entry if confirmed.
If print_key is enabled in config.toml, the generated key is also printed to the terminal; otherwise only a confirmation message is shown and the key stays clipboard-only.
If you choose not to save, press Enter when prompted for a password.
python main.py --list-keysThis command decrypts the Base64-encoded ciphertext from data/data.enc and prints the stored entries directly.
python main.py --delete-allThis command now requires the master password and an additional on-screen verification code to confirm the reset before all stored data is deleted.
RHEX stores encrypted files locally in the data/ folder:
data/key.txt— hashed or Argon2id-hashed master keydata/data.enc— Base64-encoded encrypted password/key databasedata/backup.zip— encrypted backup archive containing historical copies ofdata/data.enc
Keep the data/ folder private. Enabling security_mode stores the master key using Argon2id.
Example config.toml:
[app]
name = "RHEX"
[key]
length = 20
master_key_length = 10
lowercase_letters = true
uppercase_letters = false
special_characters = false
figures = true
[encryption]
encryption_mode = "gcm"
[advanced_settings]
print_key = true
print_github_link = true
security_mode = true
print_secure_mod_information = true
delete_all_operation_sleep_time = 0
list_all_operation_sleep_time = 0
add_key_sleep_time = 0
[argon2]
time_cost = 5
memory_cost = 262144
parallelism = 4
hash_len = 32
salt_len = 16| Setting | Description |
|---|---|
length |
Length of generated keys |
master_key_length |
Recommended master password length |
lowercase_letters |
Include lowercase letters in generated keys |
uppercase_letters |
Include uppercase letters in generated keys |
special_characters |
Include symbols in generated keys |
figures |
Include digits in generated keys |
print_key |
Print generated key to terminal as well as clipboard |
print_github_link |
Print the GitHub repository link on startup |
print_secure_mod_information |
Show whether security mode is active and config info |
security_mode |
Enables Argon2id master password verification |
encryption_mode |
Encryption mode used for stored data |
delete_all_operation_sleep_time |
Delay after delete-all failure |
list_all_operation_sleep_time |
Delay after list-keys failure |
add_key_sleep_time |
Delay after failed save operation |
| File | Description |
|---|---|
data/data.enc |
Encrypted password database |
data/key.txt |
Stores the master password hash |
data/backup.zip |
Encrypted backup archive |
RHEX is designed to start quickly and keep resource usage low while maintaining strong security. By focusing on a lightweight architecture and efficient local storage, it provides a responsive experience even on modest hardware.
This project is licensed under the GNU General Public License v3.0 (GPL-3.0).
See the LICENSE file for more information.
Contributions, bug reports, feature suggestions, and pull requests are welcome.
If you find a bug or have an idea for improving RHEX, feel free to open an issue or submit a pull request.
RHEX is provided as is, without warranty of any kind.
Although every effort has been made to implement secure cryptographic practices, users should always keep backups of important data and remember their master password. Losing the master password may result in permanent loss of access to encrypted data.