Read a Zen Passwords encrypted backup from the terminal. No account, no network, no server.
Your vault lives in your own iCloud or on your own device, and an exported backup is a single encrypted file. This opens that file. It is the answer to a fair question about an Apple only app: what happens when you are sitting at a machine that is not yours.
$ zen list ~/Downloads/Zen-Passwords-encrypted-backup.json
Master password:
GitHub (work) you@example.com
Home Wi-Fi secureNote
Visa creditCard
Read only, by design. It decrypts and shows. It cannot add, edit, delete or sync anything, and it never writes to your backup file. If it is compromised the worst it can do is read a file you already handed it.
Nothing leaves the machine. There is no network code in this tool at all. Verify that claim the
way you would verify anyone's: read Sources/, or run it with the network off.
Build it yourself. For a tool that handles your vault this is the right way round: you compile the source you just read, rather than trusting a binary somebody else built.
git clone https://github.com/zenproductsai/zen-cli.git
cd zen-cli
swift build -c release
.build/release/zen --helpPut it on your path if you want it everywhere:
sudo cp .build/release/zen /usr/local/bin/zenNeeds Swift 5.9 or newer. macOS 13 or newer.
zen inspect <backup.json> A summary, without decrypting anything
zen list <backup.json> List your items, after asking for the master password
zen get <query> <backup.json> Copy the matching item's secret to the clipboard
zen --version
Options:
| Flag | What it does |
|---|---|
--secret-key KEY |
For a vault protected by a Secret Key. Leave it off and you are prompted. |
--password-stdin |
Read the master password from stdin, for scripts. |
--show |
Print the secret instead of copying it. |
zen inspect decrypts nothing, so it never asks for a password. Use it to check you have the file
you think you have.
The password prompt does not echo. --show prints a secret to your terminal, where it will sit in
your scrollback and quite possibly your shell history file, so prefer the clipboard.
On Linux: the clipboard copy uses pbcopy and so is macOS only. zen get --show works
everywhere.
Every one the app can write. The key derivation is shared with the app rather than reimplemented here, which is the point of zen-vault-core:
| Marker | Derivation |
|---|---|
| 1 | PBKDF2-HMAC-SHA256, 120,000 iterations. Legacy. |
| 2 | Argon2id, 32 MiB |
| 3 | Argon2id, 64 MiB |
| 4 | Password and Secret Key. Pass --secret-key. |
| 5 | Argon2id, 128 MiB |
| 6 | Argon2id, 256 MiB |
This tool once understood only 2 and 3 while the app had moved on to 6, which meant a backup from a current build would not open here. That is the bug that produced the shared core, and there is now a test that fails if any marker the app can produce lacks a vector.
Nobody can recover your vault without your master password, including us. There is no reset.
swift testSeven tests. The fixtures they run against were produced by the shipping app, not by this code, so passing means this tool reproduces what the app actually wrote.
Privately, to hello@zenproducts.ai. Please do not open a public issue for a security problem. See zen-vault-core's SECURITY.md for what is most useful to us.
Apache License 2.0. See LICENSE.