credentials

To securely store credentials locally, use a master password with AES-256-GCM encryption and PBKDF2 key derivation. This approach applies a per-credential salt and random IV, ensuring plaintext secrets remain protected across local workflows without exposure.

The best way to rotate a master password for encrypted secrets is using a rotate-password operation that safely re-encrypts all stored credentials. This maintains data integrity by securely deriving new keys with PBKDF2 while preserving the existing per-credential salts.

Yes, you can list stored credentials for auditing without exposing plaintext secret values. The list operation returns metadata for inventory purposes, ensuring sensitive encrypted data remains completely hidden while you review your stored items.

PBKDF2 key derivation protects encrypted credentials by generating a strong cryptographic key from your master password using a per-credential salt. This process drastically increases the computational cost for attackers attempting to brute-force the AES-256-GCM encrypted local store.

If an error occurs while adding or retrieving encrypted credentials, the system enforces strict error handling and uses atomic writes to guard data integrity. This prevents partial or corrupted writes from compromising the local store during failed operations.