secretskept forever
a cli for passwords, api keys and env files. encrypted on your machine, synced between your devices, readable by nobody else. one static binary: no runtime, no node, no ghosts.
cli
$ deadbolt init generating vault key... vault is sealed. vault 9f3km2x7 at ~/.deadbolt $ deadbolt set github/token secret: •••••••••••••••••••• stored github/token $ deadbolt run -- bun dev injected 4 secrets → bun dev ready on localhost:3000
how it works
deadbolt init generates a vault key on your machine. the key never leaves it, and we never see it.
every secret is encrypted locally before it touches disk or the network. nothing is written in plaintext, not even the names.
adding a device is a handshake between two of your machines. the old one wraps the vault key for the new one's public key and hands it over directly.
sync moves ciphertext, device to device over iroh. there is no server of ours in the middle, nothing to store your blobs and nothing to read them.
the cli decrypts in memory, hand you the secret, and forget it.
the dead don't talk
- there is no server to breach
- your devices talk to each other directly. when a relay has to forward traffic, it forwards noise it has no key for.
- lose every device, lose the vault
- there is no recovery, by design. pair a second device before you need it.
- metadata is minimal, not zero
- a relay can see that two of your devices are talking, when, and how much. it can't see what they say.
- a process you inject into can read it
- deadbolt run puts secrets in the environment of the command you give it. only run what you trust.