Have an invite token?
Paste the invitation link or token from the vault owner. You can join their shared vault without creating one of your own.
secrets-manager
Encrypted-env secrets, synced zero-knowledge.
A secrets manager for encrypted .env files with a simple hosted workspace and an outbound runtime beside your projects. Humans approve sensitive requests in the browser; agents use the result without receiving the credential value.
Your vault is never unlocked in our cloud.
The hosted service stores only ciphertext vault heads and salted auth verifiers. There is no decryption path in the cloud — a full server breach does not directly reveal vault contents. Account and coarse operational metadata remain part of the control plane, and the browser decrypts only after you unlock a workspace.
Get started in three steps
1. Prepare the open-source runtime
On the machine beside your projects, install Community and create the encrypted local vault. The master password and filesystem access stay there.
$ git clone https://github.com/JigSpec/secrets-manager.git
$ cd secrets-manager && pnpm install && sudo ./install.sh
$ sm vault init
2. Create your Cloud account
Use the form above and reserve your personal workspace. Cloud stores encrypted heads and the metadata required to coordinate sync.
3. Connect once, then open the workspace
Cloud gives you the exact pairing command and a one-time identity. The runtime uploads the encrypted head; afterward you unlock only in this browser tab.
Free tier
1 user, 5 vaults, and unlimited machine identities — machines and agents are never billed as seats, on any tier. Self-hosting the open-source server is always free.