FAQ

Valt0 is said "vault zero", with the 0 read as a number.

Yes. Valt0 is free to use, with no limit on how many machines you install it on or how many vaults you create, and the work you do with it can be commercial.

An organisation's employees and contractors may use it on the organisation's behalf.

Read the licence

No. There is no account and no hosted server, and the tool makes no network requests of its own: no telemetry, no usage statistics, no crash reports and no update checks.

The only service Valt0 runs is the one on your own machine, and your application asks it for its secrets.

Read the privacy policy

Yes, that is what a vault is for. Without its key a vault cannot be read, so the file can sit in your repository, on your git host and in every clone.

What has to be protected is the key, not the vault file. How a vault is encrypted is in Introduction, and Security has the rest.

The vault can no longer be opened, by you or by anyone else.

Byte 1620 has no copy of your key and no way to recover it or to reset a vault. Keep the key somewhere safe as soon as valt0 init prints it.

Valt0 runs on macOS, Linux and Windows.

The computer you develop on needs a security chip: a TPM on Windows and Linux, or the Secure Enclave on a Mac. A server or container you deploy Valt0 to does not need one. Installation has the install for each system.

Valt0 has client libraries for a growing list of languages, and Clients has the current one.

Your application uses one to ask the service on your machine for a secret by name. At the command line, valt0 get prints one secret's value.

A .env file keeps secrets in plain text, so it has to stay out of git and be passed around by hand. A vault is encrypted, so it is committed with the code.

Your application asks the Valt0 service for each secret by name instead of reading it from a file. To turn a .env file you already have into a vault, use valt0 convert. Its entry on the CLI reference has the details.

Valt0 has no account and no hosted service. A vault is a file in your repository, and nobody without its key can read it, your git host included.

Your secrets are versioned with the code they belong to, and the only service involved runs on your own machine.

Yes. In development, an application in a container reaches the Valt0 service on your machine. In deployment, Valt0 is installed where the application runs and each vault is opened with two keys made for the purpose.

From a container covers development, and Deployment covers servers and images.

Bugs, questions and feedback go to a public issue tracker on GitHub. Security problems go privately to hello@byte1620.com, never to a public issue.

Issues are public, so never put a key or a secret's value in one. Report a problem has the links.