Keep secrets out of git
Sealed is a local-first encrypted secrets manager for developers. Store secrets once, inject into any project - without committing them. Open source, MIT-licensed, and free - no estimate needed.
MIT · AES-256-GCM- Local-first
- AES-256-GCM
- MIT license
Ciphertext stays on your machine - plaintext never syncs.
View source on GitHub- Encrypted at rest
- Local-first default
- Inject, don't commit
- MIT on GitHub
256-bit
AES-GCM
Encryption at rest on your device
3
Desktop platforms
macOS, Windows, and Linux
3
Inject targets
.env, launchSettings.json, and shell
1
MIT license
Inspect the crypto and build from source
Why it exists
Secrets should never live in version control.
Developers need credentials to build. `.env` files drift, get copied into chat, and occasionally land in a commit history that never forgets.
The problem
Secrets scattered across repos and chat
API keys in `.env` files get copied, pasted, and accidentally committed. Per-project drift makes onboarding slow and rotations painful.
Our approach
One encrypted vault, injected where you work
Unlock once, organize secrets per app, and auto-inject into `.env`, `launchSettings.json`, or your shell - without storing plaintext in git.
What Sealed does
A vault on your machine. Injection in your stack.
Honest product facts - not invented adoption metrics.
Encrypted vault
AES-256-GCM at rest. Your master password derives keys locally and never leaves the device.
Per-app isolation
Group secrets by project or environment so tokens stay organized as the catalog grows.
Auto-inject
Write `.env`, `launchSettings.json`, or export to your terminal session when you start work.
Local-first sync
Default is a local vault file. Optional MongoDB sync stores ciphertext only - never plaintext.
Cross-platform desktop
Electron for macOS, Windows, and Linux - the same vault workflow on every machine.
Open source
MIT-licensed on GitHub. Read the crypto, open issues, or build from source if you prefer.
Create your vault
At rest
Ciphertext on disk. Password stays local.
- AES-256-GCM encryption for the vault file
- Master password derives keys on the device
- Plaintext is not written back to disk unencrypted
Add apps and secrets
Organization
One vault. Secrets grouped per app.
- Create an app entry per project or environment
- Store keys, tokens, and connection strings together
- Rotate in one place instead of hunting `.env` copies
Inject on demand
Workflow
Inject where your stack already looks.
- `.env` for Node and most web stacks
- `launchSettings.json` for .NET local runs
- Shell export when you need a session, not a file
Use cases
Same vault. Different desks.
Built for how developers already work - solo, in a team, or reviewing the source before they trust it.
Solo developers
Keep personal API keys organized across side projects without a `.env` sprawl in every repo.
Engineering teams
Standardize secret injection for Node and .NET projects with per-app vaults and a shared desktop workflow.
Security-conscious orgs
Audit the MIT-licensed source, verify the crypto, and run the vault on your own machines.
Getting started
Three steps on your machine
Download a release or build from source. No hosted account required.
Create your vault
Set a master password and choose a local vault file - or optional MongoDB ciphertext sync.
Add apps and secrets
Create an app entry per project. Store keys, tokens, and connection strings with per-app isolation.
Inject on demand
Export or auto-inject into `.env` / `launchSettings.json` when you start work - no secrets in git.
Common questions
Hosting, platforms, and the public repository. The source of truth is GitHub.
What is Sealed?
Sealed is a local-first encrypted secrets manager for developers. You store credentials in a vault on your machine, then inject them into project files or a shell session instead of committing `.env` files.
Does Myrafy host my secrets?
No. The default is a local vault file. Optional MongoDB sync stores ciphertext only - the server never sees your master password or decrypted values.
What platforms does it run on?
An Electron desktop app for macOS, Windows, and Linux. Releases are published on GitHub.
Is the source available?
Yes. Sealed is MIT-licensed. The repository is the canonical product home - inspect the crypto, file issues, or build from source.
Can Myrafy help us adopt it or build around it?
Yes. Sealed itself is free. Talk to us if you want help rolling it into a team workflow, or if you need a custom secrets or developer-platform layer under contract.
Local-first secrets.
Ready to keep secrets out of git?
Download the latest release, build from source, or inspect the MIT-licensed crypto - it's free, no estimate needed.
- AES-256-GCM vault on your machine
- Inject `.env` and launchSettings on demand
- MIT-licensed - inspect the crypto
github.com/Myrafy/sealedMore from Myrafy
Related products
Other platforms and utilities from the same studio.