Valt0

A modern secrets manager for Developers

Keep passwords, tokens, and keys in encrypted vaults

Install

Free, no account

MY-APPsrcTSapp.tsTSconfig.ts{}package.jsonprod.valt0README.md{}tsconfig.jsonTSapp.ts1import { openVault } from '@valt0/client'23const vault = await openVault({ id, name: 'prod' })4const secret = await vault.secret('STRIPE_KEY')5const stripe = new Stripe(secret.reveal())$valt0 store prod:STRIPE_KEY••••••••
  1. Store a secret from your terminal
  2. It goes into an encrypted vault
  3. Your app asks for it by name

Replace your .env file with an encrypted vault

Valt0 is a free secrets manager for developers. It keeps your project's passwords, tokens and API keys in one encrypted vault file that you commit next to your code, and your app asks for them by name through a Valt0 client library.

  • Encrypted, so it is committed

    A .env file is plain text, so it stays out of git and gets passed around by hand. A vault is encrypted, so it lives in the repo.

  • Versioned with your code

    Secrets change in the same commits as the code that uses them, on every branch and in every clone.

  • Free on macOS, Linux and Windows

    Install it on as many machines as you like and make as many vaults as you need, at no cost.

From .env

Turn your .env file into a vault in one command

valt0 convert makes a vault from your .env file, with each environment variable stored as a secret under its own name. It prints the new vault's key once, and leaves the .env file as it is.

Starting fresh? valt0 init makes an empty vault, and valt0 store adds one secret at a time.

Weighing the options? Read Alternatives to .env files

~/project

$ cat .env

DATABASE_URL=postgres://app:s3cret@db:5432/app

STRIPE_KEY=sk_live_51Hx…

$ valt0 convert .env --output prod

key VLT0-KEY-D8B38D16-19B5681D-… save it now

$ git add prod.valt0 && git commit

1 file changed. Locked, as always.

In your code

Then read it from your app in a few lines

Your code opens the vault by its id and asks for a secret by name. It never needs the key, and the secret stays redacted in logs until you ask for its value.

Read the Node.js client docs
app.ts 
import { openVault } from '@valt0/client'

const vault = await openVault({
    id: 'VLT0-ID-9254C02EE8685310C76B',
    name: 'prod',
})

const secret = await vault.secret('STRIPE_KEY')

const stripe = new Stripe(secret.reveal())
secret.destroy()

Share it with your team. Ship it with your app.

  • Your team gets it with the code

    A teammate pulls the repo and runs valt0 import so their app can read the vault. You give its key only to the people who need it.

    Working with vaults

  • A vault for each environment

    Make a dev, a qa and a prod vault, each with its own key. Everyone can hold the dev key, and only the people who deploy hold the prod one.

    How many vaults you need

  • Containers while you develop

    valt0 container prints the settings that let an app in Docker, Docker Compose or Podman reach Valt0 on your machine.

    Developing in containers

  • Deploy it with your app

    The vault ships in your image or to your server and opens there with two keys made for deployment. Neither opens it on its own, and the vault key stays out of your build.

    Deployment

Nothing to sign up for. Nothing sent anywhere.

  • No hosted service

    There is no Valt0 server to reach. The only service is the one on your own machine.

  • Unreadable without its key

    Without its key a vault cannot be read, and encrypted data that has been altered fails to decrypt.

  • You choose who holds the key

    Valt0 prints a vault's key once and keeps no copy. Only the people you give it to can open the vault.

Questions before you install?

Frequently asked questions What Valt0 costs, what it sends, what happens if you lose a key, and how it compares with a hosted secrets manager. How Valt0 keeps secrets safe What protects a vault, what runs on your machine, the keys for a deployment, and how to report a security problem.

Create your first vault.

$ valt0 init prod

Install
How it works