Free tools Windows power users keep installed
One-click scans. No signup required.
Fernet can protect a local credential file from someone who obtains the encrypted file but not its key. It provides both encryption and tamper detection, but the protection depends on keeping the key separate and unavailable to the attacker. It does not protect a credential after your application decrypts it, or if an attacker can access both the key and the file.
What Fernet does to a credential
Fernet is a Python recipe for symmetric authenticated encryption: the same secret key is used to encrypt and decrypt data. The pyca/cryptography documentation says, “Fernet guarantees that a message encrypted using it cannot be manipulated or read without the key.” Anyone who obtains the key can read existing tokens and create valid ones.
As an Amazon Associate I earn from qualifying purchases.
A Fernet key is URL-safe base64-encoded data representing 32 bytes. Fernet’s documented construction combines AES-CBC encryption, PKCS7 padding, an HMAC using SHA-256, and a randomly generated initialization vector. The token also contains a timestamp. The authentication check detects changes to a token, but encryption does not conceal all metadata: the timestamp is visible. Fernet is intended for messages that fit in memory, making it more suitable for small credential records than large files. See the Fernet documentation for its format and limits.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →What protection you get—and what you do not
If someone copies the encrypted file but cannot obtain its key, Fernet makes the credential contents unreadable to that person and detects token tampering. This is useful for small stored secrets an application must later recover, such as an API token or database password.
#1 Best Overall
- Easily store and access 2TB to content on the go with the Seagate Portable Drive, a USB external hard drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
It is not a defense against an attacker who can read both the ciphertext and the key, control the running application, or capture the credential after decryption. Nor does it prevent misuse of a stolen credential against the account or service it unlocks. Encryption protects data in a particular state; it does not make the secret safe throughout its entire lifecycle.
Keep the key separate from the encrypted file
Key custody is the central design decision. If the key sits next to the ciphertext, anyone who gets both can decrypt the credentials. The OWASP Key Management Cheat Sheet recommends secure operating-system, framework, or cloud storage mechanisms where available, separating keys from the data they protect, and avoiding hard-coded keys, source-code repositories, and build artifacts. A compromised application may still expose a key it can access.
Rank #2
- Easily store and access 5TB of content on the go with the Seagate portable drive, a USB external hard Drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Python’s keyring library provides an interface to system keyring services and describes their use for safe password storage. Whether a particular backend is appropriate depends on the operating system, deployment, and threat model; there is no single configuration established as suitable for every environment.
Recommended Free Tools
If you derive a Fernet key from a password, use a key derivation function rather than treating the password itself as the key. The pyca/cryptography guidance currently recommends Argon2id. Its example uses a salt that must remain available so the same key can be derived later. The salt is not a secret and does not replace the password.
Rank #3
- Easily store and access 1TB to content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop. Reformatting may be required for Mac
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Choose protection for the threat you face
Application encryption, OS key storage, full-disk encryption, and password hashing solve different problems. The OWASP Cryptographic Storage Cheat Sheet notes that at-rest encryption may be applied at the application, database, filesystem, or hardware level, depending on the threat model.
| Approach | Useful for | Key limitation |
|---|---|---|
| Fernet at the application level | Encrypting selected small fields or records that the application must later decrypt. | Requires the application to handle a separate key; does not protect plaintext while the application is using it. |
| OS keyring or secure store | Storing a key or retrievable secret through an operating-system service. | Suitability depends on platform, backend, and deployment. |
| Filesystem or full-disk encryption | Reducing exposure if a device or storage medium is physically lost or stolen. | Does not protect against a remote attacker who compromises a running system. |
| Password hashing | Verifying a user’s login password without needing to recover it. | One-way by design; cannot provide the password to another service. |
These layers can complement one another. Full-disk encryption does not replace application key management, and Fernet does not replace protections for a lost device. OWASP specifically cautions that hardware-level encryption does not protect against remote compromise of a server.
Rank #4
- Easily store and access 4TB of content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Rotate keys without losing access
Fernet’s MultiFernet supports gradual key rotation. It encrypts with the first key in its list and tries keys in order when decrypting; its rotate() method re-encrypts tokens using the primary key. The Fernet documentation describes this behavior.
- Introduce a new key and make it the primary key for new encryption.
- Keep older keys available for decryption while existing tokens still depend on them.
- Re-encrypt existing tokens under the new primary key, then verify that required credentials remain readable.
- Retire an old key only after no required data depends on it, and preserve a recovery plan that does not store an exposed key alongside the encrypted data.
If every key capable of decrypting a token is lost, the credential cannot be recovered from that token. Rotation therefore needs both a migration plan and a deliberate approach to key recovery.
Best Value
- [Upgraded Version] - This external hard drive features a mirrored logo stripe combined with a striped anti-slip design, and the rounded corners of the casing make it easier to grip. The stripes also have a heat dissipation function, ensuring stable and fast data transfer.
- 【Ultra-thin and quiet】 - The motherboard adopts JMicron 578 noise-free solution, giving you a quiet working environment. Lightweight and portable size designed to fit in your pocket for easy portability.
- 【Ultra-Fast Data Transfers】 - Pairing this external hard drive with JMicron 578 solution USB 3.0 and USB 2.0 interfaces enables blazing-fast data transfer. It boasts theoretical read speeds of up to 125MB/s and write speeds of up to 103MB/s.
- 【Plug and Play】 - With no software to install, just plug it in and the drive is ready to use.The hard disk chip is wrapped with an aluminum anti-interference layer to increase heat dissipation and protect data.
- 【What You Get】 - 1 x Portable Hard Drive, 1 x USB 3.0 Cable, 1 x User Manual, Gift-type shell packaging ,Three-year manufacturer's warranty and free technical support services.
Do not encrypt login passwords that only need verification
“Credential” can mean a service secret the application must retrieve, or a user’s login password that only needs to be checked. Fernet fits the first case when the application must recover the secret to use it. For login passwords that should only be verified, OWASP recommends one-way password hashing with a password-storage algorithm such as Argon2id, bcrypt, or PBKDF2—not reversible encryption. See the OWASP Password Storage Cheat Sheet.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
