Valt0

Get started

Introduction

What is Valt0

Valt0 (said "vault zero") is a free tool that keeps your project's passwords, tokens and API keys in an encrypted file, a vault, that you commit next to your code.

There is no account to make and nothing to sign in to. A service on your own machine hands your application its secrets through a Valt0 client library. Valt0 also runs on your servers and in containers.

The ideas behind Valt0, in one article: Valt0's seven principles.

How does it work

Valt0 stores secrets in encrypted files called vaults.

A vault is simply an encrypted file that has the extension .valt0.

Every vault is identified by an ID and is unlocked by a vault key. The ID is public, while the key is private and must be kept secure.

ID Public

VLT0-ID-9254C02EE8685310C76B

Key Private

VLT0-KEY-redacted

How are vaults stored

Vaults are encrypted with AES-GCM using 256-bit keys, the same encryption that protects HTTPS connections. Without its key a vault cannot be read, and if its encrypted data is altered, it fails to decrypt instead of returning different secrets.

Because a vault is encrypted, it can be stored anywhere.

prod.valt0One file
  • In your app's repoCommitted next to the code
  • In a repo of its ownShared by several projects
  • In cloud storageA bucket or a shared folder
  • On a drive or a stickOffline, in a drawer
What has to be protected is the key, not the vault file.

How many vaults do you need

More than one. The recommended setup is a vault for each environment: dev.valt0, qa.valt0, prod.valt0 and so on.

Valt0 is not limited to a single vault. Every command that works on a vault takes its name, so valt0 store dev:STRIPE_KEY and valt0 store prod:STRIPE_KEY put two different values into two different files. An application can open more than one vault too.

Each vault has its own key, and that is the reason to split them. The whole team can hold the key to dev while the key to prod stays with the people who deploy. If the dev key leaks, nothing in production is exposed, and only the secrets in dev have to be changed.

Store a secret under the same name in every vault. Your code asks for STRIPE_KEY wherever it runs, and only the vault it reads from changes between development, QA and production.

What runs on your machine

Installing Valt0 puts two things on your machine: a command you run, and a service that runs itself.

The service starts when Valt0 is installed, and starts again at every login, so it is already running before anything asks it for a secret.

  • A command line tool

    The valt0 command, used from the terminal: making a vault, putting secrets into it, reading them back and taking them out.

  • A local service

    For an application that needs a secret while it is running. It is what clients connect to, and it runs on the same machine they do.