A local secrets manager for developers

Keep passwords, tokens, and keys in encrypted vaults

Your project's secrets go in one encrypted file that you commit next to the code.

01Store

Safely store a secret in a few commands

valt0 init makes the vault and prints its key, once. valt0 store asks for that key, then the value. The vault is one encrypted file, so it goes in the repo next to the code.

~/project

$ valt0 init prod

Created the empty vault file.

key VLT0-KEY-D8B38D16-19B5681D-… save it now

$ valt0 store prod:STRIPE_KEY

Key for prod.valt0: ••••••••••••

Value for STRIPE_KEY: ••••••••••••••••

The secret is now stored safely in the vault.

$ git add prod.valt0 && git commit

1 file changed. Locked, as always.

02Read

Then read it from your app in a few lines

Your code opens the vault by its id and asks for a secret by name. It never needs the key, and the secret stays redacted in logs until you ask for its value.

Read the Node.js client docs

app.ts

import { openVault } from '@valt0/client'

const vault = await openVault({
    id: 'VLT0-ID-9254C02EE8685310C76B',
    name: 'prod',
})

const secret = await vault.secret('STRIPE_KEY')

const stripe = new Stripe(secret.reveal())
secret.destroy()

import "go.valt0.com/valt0"

vault, err := valt0.OpenVault(valt0.VaultOptions{
    Id:   "VLT0-ID-9254C02EE8685310C76B",
    Name: "prod",
})
if err != nil {
    log.Fatal(err)
}

secret, err := vault.Secret("STRIPE_KEY")
if err != nil {
    log.Fatal(err)
}
defer secret.Destroy()

stripe.Key = secret.Reveal()

import valt0

vault = valt0.open_vault(
    id="VLT0-ID-9254C02EE8685310C76B",
    name="prod",
)

with vault.secret("STRIPE_KEY") as secret:
    stripe.api_key = secret.reveal()

03Private

Nothing to sign up for. Nothing sent anywhere.

No hosted service
There is no Valt0 server to reach. The only service is the one on your own machine.
Unreadable without its key
Without its key a vault cannot be read, and encrypted data that has been altered fails to decrypt.
The key stays with you
Nobody has the key except you, and it doesn't get sent anywhere.

Create your first vault.

$ valt0 init prod

Install