The offline vault for developers who are tired of subscriptions.
A zero-knowledge, offline-first secrets and password vault for developers. Projects, environments, servers, and credentials in one encrypted file you own - no account, no cloud, no monthly bill.
No account required 路 Free tier available 路 v2.9.0路Mac & Linux builds coming soon
Project & Environment Namespace Manager
Organize and secure environment variables across projects (Local, Staging, Production). Values stay encrypted in RAM.
Real Sidebar Folders
Create, rename, and reorder folders; drag a project onto one to move it. Collapse state is remembered between sessions.
More Breathing Room
Wider spacing and a colored left accent matching the project's own color tag - no more cramped header.
Quick Links
One-click bookmarks to the consoles you actually use per project - paste a URL and Google Cloud, GitHub, Stripe, and ~25 other services are auto-detected with a real fetched icon.
Less Button Clutter
Only the actions you use constantly stay visible - Snapshots, Rename, and Delete tuck into one More... menu.
馃挕 Tap the pulse rings to explore features, or tap the screenshot itself to zoom in.
Offline-first
No server, ever. Your vault works with no internet connection at all.
Zero-knowledge
Your master password never leaves your machine, and nobody - including us - can reset it for you.
One file you own
The entire vault is a single encrypted SQLite file. Back it up, move it, inspect it - it's yours.
No account, no cloud
Nothing to sign up for. Nothing syncing to a server you don't control.
Everything in one vault
Built for the way developers actually work
Not a password manager with env vars bolted on, and not a cloud secrets platform pretending to be simple. Cloakspire is native to both jobs.
Projects, environments, and variables - modeled the way you actually work
Every project gets its own environments (local, staging, production, whatever you call them), each holding typed variables with notes, required flags, and full history. Not a flat list of secrets - a real map of your stack.
- .env import/export, plus paste-to-import from clipboard
- ENV DRIFT badge when a linked folder's .env no longer matches the vault
- Type auto-detection, masking, and a built-in password/token generator
Real sidebar folders, not a flat list
Create, rename, reorder, and drag projects between folders - single-level, no nested-folder maze to get lost in. Collapse state is remembered between sessions, and deleting a folder never deletes what's in it.
- Drag a project onto a folder, or right-click for Move to Folder
- A quieter header and toolbar: only the actions you use constantly stay visible, the rest live in More...
Quick Links: one click to the console you actually need
A row in every project's header for bookmarks to the external consoles you use for that project - Google Cloud, GitHub, Stripe, Vercel, and ~25 other common services are auto-detected from a pasted URL, with a real icon fetched in the background. A second, vault-wide row on the Dashboard covers bookmarks that aren't tied to any one project.
- An unrecognized URL still works as a plain bookmark, with a generated icon instead of a fetched one
- Optionally attach a linked secret (e.g. an OAuth client secret), copyable via the same auto-clearing clipboard as the rest of the vault
- Icon fetching never blocks - drag to reorder, click or double-click to open
A dashboard that actually catches problems
Ten cards, not two: projects, environments, variables, secrets, servers, and SSH keys at a glance, plus the numbers that matter - missing variables across every linked project, duplicate keys within an environment, and tokens about to expire.
- Duplicate Keys catches case-variant mistakes like API_KEY vs api_key that a database constraint alone can't
- Expiring Tokens reads an optional expiry date you set on any Service Credential
Snapshots: a safety net for every migration
Take a named, point-in-time capture of an environment before a risky change. Diff it against the current state any time. Restore with one click - a safety snapshot is taken automatically first, so restoring is itself undoable.
Servers & VPS, with a real terminal built in
Store host, user, and password for every server you touch - then Connect opens a genuine interactive SSH shell right inside the vault. Full color output, live resize, and TOFU host-key pinning that warns you (hard) if a key ever changes.
- Non-modal: keep a terminal open while you use the rest of the app
- Detach makes a session a fully independent window - it survives closing the dialog that opened it, and even minimizing Cloakspire itself
- Optional Default Folder auto-cd's you into the right directory on connect
- All Servers view lists every server across every project in one place
A CLI that deletes your .env files
evx run -- npm run dev injects your environment's variables straight into the child process's memory. No .env file is ever written to disk - nothing to accidentally commit, zip, or sync to the cloud.
Sync with Vercel and GitHub Actions
Push variables straight to Vercel or GitHub Actions secrets, or pull them back in - including a bulk import that creates or updates a vault project for every Vercel project in your account.
A full personal vault, not just a secrets manager
Logins, cards, secure notes, and SSH keys, organized in nestable folders - the same encrypted database and master key as your project vault. One app instead of a password manager plus a separate dev tool.
Project Intelligence
It knows your stack, not just your env var names
Missing or unused variables are the most common '3am incident' in any codebase that touches .env files - but a plain diff misses typos and has no idea what your project actually runs on. Project Intelligence reads your real source, package.json, and config files to catch both.
- Detects your real stack: Docker, CI provider, Vercel, and Prisma - including which database engine it's configured for
- Detects third-party services in use (Stripe, OpenAI, Supabase, AWS, and more) straight from package.json
- A missing key that closely resembles an unused one gets a "did you mean X?" suggestion, with a one-click Rename that fixes it in place
- Still does the basics well: flags what's missing, what's unused, and generates a clean .env.example
CLI companion
Delete your .env files. Really.
evx run injects your environment's variables straight into a child process's memory - nothing ever touches disk. No file to accidentally commit, zip, or sync to the cloud.
- Prompts for your master password with no echo - or set EVX_PASSWORD for scripts
- Values go to stdout, messages to stderr, so piping stays clean
- The child process's exit code is forwarded, so it behaves correctly in CI
Trust is the product
Security you can actually read
Real, audited cryptographic primitives - no homemade crypto - and a plain account of what Cloakspire does and doesn't protect against.
Argon2id key derivation
New vaults derive a random master key wrapped by your password using Argon2id (memory-hard, resistant to GPU cracking) - not a directly-derived key, so changing your password never re-encrypts your data.
Fernet authenticated encryption
Every secret value is encrypted with Fernet (AES-128-CBC + HMAC-SHA256) from Python's audited cryptography library. Tampering with the database is detected, not silently ignored.
Metadata is encrypted too
Not just values: variable names and notes, snapshot contents, and server labels/hosts/usernames are all ciphertext at rest. A stolen database file reveals structure, not your infrastructure map.
TOFU SSH host-key pinning
The first connection to a server shows its SSH host key fingerprint for you to confirm, exactly like OpenSSH. If a later connection presents a different key, you get a hard warning naming both fingerprints - never a silent reconnect.
A real recovery kit
A one-time, high-entropy recovery code generated at setup can reset a forgotten master password without losing data - the industry-standard pattern, not 'forgot your password? start over.'
Clipboard auto-clear
Copied secrets clear from your clipboard automatically after a short delay, so they don't linger for the next paste in an unrelated window.
How it compares
Why not just use Bitwarden or Doppler?
Every one of them is excellent at part of this job. Cloakspire is the only one built to do all of it, fully offline.
| Capability | Cloakspire | Bitwarden | 1Password | Doppler | Infisical |
|---|---|---|---|---|---|
| Fully offline, no account required | partial | ||||
| One-time purchase available | |||||
| Dev-native project / environment vault | partial | ||||
| General password manager (logins, cards, notes) | |||||
| Live SSH terminal built in | |||||
| CLI: inject secrets, never write .env | partial | partial | |||
| Snapshots with diff and restore | partial | partial | |||
| Detects your stack (Docker, CI, Prisma) and suggests typo fixes | |||||
| Vercel / GitHub Actions sync | |||||
| Zero infrastructure to run or trust | partial |
Based on each product's publicly documented model as of this writing. Feature sets and pricing change - please verify against each vendor's current site.
What about teams?
Work offline locally, sync through CI - no team cloud required
Cloakspire is offline-first by design: there's no central server to trust, breach, or pay for per seat. For a small team, that's not a gap - it's the pitch.
Today, sharing a project between teammates means passing the vault file directly, or using the Pro Vercel / GitHub Actions sync as the hand-off point - push from your machine, teammates (and CI) pull from there. Native multi-user sync isn't built yet, and we'd rather say that plainly than pretend otherwise.
# Everyone on the team works offline, locally> evx run acme-app/production -- npm run start聽# Ship the environment through CI, not through Slack DMs> evx export acme-app/production --template > .env.examplesynced to GitHub Actions secrets on push
Pricing
Pay once. Not a subscription.
Start free with a single project. Unlock everything else whenever you're ready - no recurring charge, ever.
Free
Everything you need to stop keeping secrets in .env files.
- 1 project, unlimited environments & variables
- Full Personal Vault (logins, cards, notes, SSH keys)
- .env import/export & clipboard import
- Command palette & keyboard shortcuts
- Manual backup & restore
Pro
Unlimited projects and every developer workflow, unlocked once.
- Unlimited projects
- Snapshots with diff & restore
- Servers & VPS + live SSH terminal
- Service Credentials vault
- Project Scanner + .env.example generation
- Vercel & GitHub Actions sync
- CLI companion
- Automatic rotating backups
Pro is a one-time unlock - pay once and it's yours forever on this major version. A future major version may offer an optional paid upgrade, the same way Sublime Text and Tower do it. Never a recurring charge for what you already own.
FAQ
Questions, answered plainly
Own your vault. Starting today.
Free to start, one project included. Upgrade to Pro whenever you need more - once, not monthly.
Mac & Linux builds coming soon