stash

encrypted local key-value store. AES-256-GCM, PBKDF2-SHA256 key derivation, 200k rounds.

vault lives at %APPDATA%\stash\vault.bin. no cloud, no server.

stash set <key> <value>    store a value
stash get <key>            retrieve a value
stash del <key>            delete a key
stash ls                   list all keys (no values shown)
stash clear                wipe the entire vault

---

example

> stash set api_key abc123
  passphrase: ····
  ✓ set api_key

> stash get api_key
  passphrase: ····
abc123

> stash ls
  passphrase: ····

  db_password
  api_key

  2 keys

wrong passphrase → decryption fails silently (no hint about which keys exist).

crypto details

property	value
encryption	AES-256-GCM
key derivation	PBKDF2-SHA256
iterations	200,000
salt	16 bytes, random per save
nonce	12 bytes, random per save
tag	16 bytes

file format: [16 salt][12 nonce][4 len][ciphertext][16 tag]

build

dotnet build -c Release

.NET 8+, all platforms.

license

MIT