Your API keys,
out of `.env` files.

Secretfold keeps tokens, keys and .env secrets encrypted on your computer. A calm desktop app and a command-line tool share one vault. Nothing sits on disk in plain text.

$ secretfold import .env
Imported into acme / dev: 6 added
$ rm .env
$ secretfold run -- npm start
secretfold: 6 secrets from acme / dev
Server listening on :3000

Encrypted on your machine

Every secret is encrypted with its own key. Your vault is one file that only your master password, or your recovery code, can open.

No `.env` on disk

secretfold run -- npm start hands secrets to your app as environment variables. Nothing is left for a stray commit or a backup to pick up.

An app and a CLI, one vault

Browse, edit and bulk-move secrets in the desktop app, or script everything from the terminal. Unlock one and both are open.

Projects and environments

Keep acme / dev apart from acme / prod. Link a repo once and every command there picks the right set.

Find it in a keystroke

Press ⌘⇧Space anywhere, type a few letters and hit Enter. The value is copied, and the clipboard clears itself 30 seconds later.

Touch ID and Windows Hello

Unlock with a fingerprint. Secretfold still asks for your password every two weeks so you never forget it.

Built like a vault, not a notes app

Argon2id turns your master password into a key, which makes guessing it slow and expensive.
XChaCha20-Poly1305 encrypts each secret separately, with its own key, and detects any tampering.
A recovery kit gets you back in if you forget your password. We never see it or keep a copy.
Auto-lock after 10 idle minutes, and the clipboard clears itself after you copy.
Zero-knowledge sync is coming. Our servers will only ever hold data they can't read.

Free on your computer. Pay when you want it everywhere.

Free

Desktop app and CLI
Unlimited secrets and projects
Touch ID, recovery kit, quick search

Get early access ↑

Pro

Coming soon

Encrypted sync across your computers
Your vault in the browser
Version history

Teams