# Designing an Encrypted Command-Line Journal with Python

> By Johnathan Belcher — June 28, 2026 — 9 min read

DeepVault is a command-line encrypted journal application written in Python. It lets users create, search, view, and delete private journal entries while keeping all data encrypted at rest using modern cryptography: AES-256-GCM authenticated encryption, PBKDF2 key derivation with a high iteration count, a modular architecture for crypto/storage/UI/orchestration, and a usable terminal interface with safe error handling.

[Source code on GitHub](https://github.com/JohnB-LWF/DeepVault)

## Project Files and Their Roles

- **journal.py**: Main CLI entry point and command loop
- **storage.py**: Journal persistence with add, delete, search, and get operations
- **crypto_utils.py**: Key derivation and AES-GCM encrypt/decrypt helpers
- **config.py**: Paths and cryptographic constants
- **ui.py**: Terminal prompts, styling, banner, and display helpers

## Design Highlights

- **Config**: Central settings define the journal file path, PBKDF2 salt length, AES-GCM IV length, and 480,000 PBKDF2 iterations.
- **Crypto primitives**: PBKDF2-SHA256 derives a 256-bit key from a passphrase; AES-256-GCM provides confidentiality and tamper-detecting integrity.
- **Storage layer**: Salt is stored as the first raw bytes of the file, followed by the encrypted JSON journal payload; decryption uses the same passphrase and extracted salt, so content is never stored in plaintext on disk.
- **Command handlers**: `new`, `list`, `view`, `search`, `delete`, and `panic` (secure wipe via overwrite before deletion).

## How Encryption and Storage Work Together

On save: generate/load salt → derive key via PBKDF2 → encrypt journal JSON with AES-GCM and a random IV → store as salt + IV + ciphertext + tag. On load: read salt from file header → derive key → attempt AES-GCM decrypt → authentication failure signals an invalid passphrase or corruption.

## Security Highlights

Authenticated encryption (AES-GCM), per-journal salt and per-encryption IV, passphrase never persisted, decryption validated via authentication tag, and a panic wipe with overwrite before deletion.

## Practical Limitations

Security still depends on passphrase quality; in-memory plaintext exists while the app runs; overwrite-based secure delete may be limited on some filesystems/SSDs; no built-in backup or passphrase recovery.

## Conclusion

DeepVault combines modern cryptographic practices with a clear modular architecture — a good starting point for learning how secure local-first Python applications are designed.