WAuth is a Python library for storing encrypted secrets in a local SQLite vault. By default, its documented key derivation uses a salted machine identifier, so a vault created on one machine is not expected to decrypt on another. Despite the phrase “locked to silicon,” the available project documentation does not establish a TPM, Secure Enclave, or other hardware-rooted key. WAuth is software whose default key is derived from machine identity—not a hardware security module.
What WAuth does
WAuth is a Python library for secret storage, distributed as a beta package. PyPI lists version 0.5.0, released May 7, 2026, and requires Python 3.9 or newer. The project describes an encrypted local vault backed by SQLite through wsqlite, as well as a Docker secret driver that reads secrets from /run/secrets. See the WAuth PyPI package page and the WAuth repository.
As an Amazon Associate I earn from qualifying purchases.
Documented operations include storing and retrieving text or files such as certificates and key files, deleting secrets, setting optional time-to-live expiration, rotating keys, and backing up and restoring encrypted data. The library also describes synchronous and asynchronous operations, plus valid(), which checks a candidate secret without returning the stored value. These are features claimed by the project, not independently reproduced tests.
How the local vault works
- Store: An application asks WAuth to save a value.
- Derive or supply a key: By default, WAuth derives a key from a salted machine identifier; a custom key can be used instead.
- Encrypt: The value is encrypted into a Fernet token.
- Persist: WAuth stores the encrypted token in its local SQLite vault.
- Retrieve: The library loads the token, checks expiration if configured, decrypts it, and returns the plaintext to the application.
In a container, the documented driver factory looks for Docker secrets under /run/secrets and can fall back to the local vault. The package description outlines these behaviors; consult the package page and project repository for the project’s implementation details.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
What “machine-locked” and “silicon” mean
Machine-locked describes the portability consequence of deriving an encryption key from machine identity: the same vault data is not usable on another machine unless that machine can reproduce the relevant key or the application is configured with a portable alternative. WAuth’s materials describe a SHA-256 hash of a salted machine ID as the default derivation.
That is not evidence of a silicon-level hardware root of trust. The reviewed project materials do not establish that WAuth uses an unextractable key stored in a TPM or Secure Enclave, or that encryption occurs inside one. “Locked to silicon” is therefore best read as a metaphor in the title, not a verified description of hardware-backed key custody.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Machine-derived encryption should not be mistaken for protection from malware or an attacker who controls the running host. The cited materials do not substantiate that broader security guarantee.
Recommended Free Tools
Can you move a WAuth vault to another computer?
Not with the default machine-derived key alone. WAuth warns that a vault encrypted on Machine A cannot be decrypted on Machine B under machine-derived keys. Copying an encrypted backup moves the ciphertext, but it does not make the matching decryption key available on the destination.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
The project documents three approaches for cross-machine use: Docker secrets, environment variables, or a custom key. These change how the secret is supplied or which key is used; they also move responsibility for protecting and distributing that key into the deployment workflow. Choose the approach that matches how the application is deployed, and make sure recovery records include whatever key configuration is required. WAuth also documents encrypted backup and restore and key rotation, but neither makes a default machine-bound vault portable by itself.
What Fernet encryption means here
The WAuth package description uses inconsistent shorthand: a tagline says “Fernet (AES-256),” while its technical feature list identifies AES-128-CBC. The Fernet specification resolves the algorithm: Fernet uses AES-128 in CBC mode for encryption. Its 256-bit combined key is split into a 128-bit signing key and a 128-bit encryption key, and its token includes a 256-bit HMAC-SHA256 for authentication. It is accurate to describe this as AES-128-CBC encryption with a 256-bit combined key and HMAC-SHA256 authentication, not as AES-256 encryption.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
How much security assurance do the published metrics provide?
The WAuth package description reports 98% test coverage, 129+ passing tests, and zero medium- or high-severity Bandit findings. These are project-maintainer figures from 2026, not independent measurements. Test coverage and static-analysis results can provide useful development signals, but they do not establish that the cryptographic design has been independently audited or that the software is production-secure.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The repository lists a security policy and technical white paper, but the available evidence does not establish the scope, date, or independence of a security audit. Treat audit status as unverified rather than assuming one has taken place. A deployment decision should account for key recovery, access to the host, secret distribution, maintenance, and any independent review relevant to your risk.
Quick Recap
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
