Privy Python Utility

The encrypted output produced by hide() follows this ASCII format:

ascii(Argon2 algorithm || security level || base64(salt) || base64(Fernet token))

The security parameter in hide() controls the Argon2 memory (m) and time (t) settings. Higher levels are more resistant to brute-force attacks but consume more resources.

Note: Levels 11-20 are very resource-intensive and are recommended only for individual use.

Privy allows you to password-protect secret data (like API keys or seeds) by deriving a key from a password using Argon2 and encrypting the data with the Fernet protocol.

Use privy.hide() to encrypt a secret and privy.peek() to decrypt it.

import privy

# Encrypt a secret
data = b'secret'
password = b'my_password'
hidden = privy.hide(data, password)

# Decrypt the secret
original_data = privy.peek(hidden, password)
print(original_data)  # b'secret'

Install the Privy utility using pip. It is compatible with Linux, macOS, and Windows, and supports Python 2.7, 3.3+, PyPy, and PyPy3.3-5.5+.

$ pip install privy

Encrypts a secret using a password. Returns the hidden secret as a unicode string.

Parameters:

• secret (bytes): The secret to encrypt.
• password (bytes or unicode): The password used to access the secret.
• security (int): A number from 0-20 inclusive. Higher values increase security but require more time and memory. Defaults to 2.
• salt (bytes): The salt used for the password hash. Defaults to os.urandom(32).
• server (bool): If True, uses the Argon2i algorithm (recommended for side-channel attack protection). If False, uses Argon2d.

hidden = privy.hide(secret, password, security=2, salt=None, server=True)

Decrypts a hidden secret using a password. Returns the secret as bytes.

Parameters:

• hidden (bytes or unicode): The hidden secret to decrypt.
• password (bytes or unicode): The password used to access the secret.
• expires (int): The maximum number of seconds since encryption that is allowed. If the time elapsed exceeds this value, a ValueError is raised. Defaults to no expiration.

Errors: Raises ValueError if the password is incorrect, if the password was attempted on a different hidden secret, or if the secret has expired.

secret = privy.peek(hidden, password, expires=None)