Safe

Generates SSH and RSA key pairs directly within Vault without local file exposure, as shown with the 'ssh' and 'rsa' subcommands, reducing credential leakage risks.

Provides double-confirmation prompts for sensitive inputs without writing to disk, enhancing security during manual password entry, as described in the 'set' command usage.

Supports reformatting passwords into base64, bcrypt, or crypt-sha512 hashes and storing them as new keys via 'safe fmt', useful for system integrations like htpass files.

Allows chaining commands with '--' and additive updates to multiple paths, streamlining complex workflows, such as generating keys and setting metadata in one go.

Offers tools to issue, revoke, validate, and renew TLS/SSL certificates through the 'x509' subcommands, integrating certificate lifecycle management directly with Vault.