Secretfold Get early access

For developers and their AI

Keep your API keys safe. Use them everywhere.

Secretfold keeps your API keys, tokens and .env files locked away on your computer. Your apps, deploys and AI assistants can use them, but nobody has to see them or paste them anywhere.

Your computer

Early members get 50% off their first year. One email when it's ready, nothing else.

Run the payment tests against Stripe.
AI assistant Running npm test with your acme / dev keys from Secretfold… 
✓ charges a card
✓ refunds a payment
  key: [secretfold:STRIPE_KEY]
12 passed
All tests pass. I used your Stripe key without seeing it.

Your keys are probably in too many places

.env files in every project folder, one stray commit or backup away from leaking.

Chat messages where you pasted a key for your AI assistant, or for a teammate.

Three different tools for local work, deploys and CI, each holding its own copy of the same key.

Secretfold gives every key one safe home, and lets everything that needs it borrow it.

Works with your AI

Your AI can use your keys. It can't see them.

Secretfold connects to AI coding tools through MCP, the standard way AI tools plug into other apps. Your assistant can run tests, start servers and deploy with your keys. In everything it reads back, each key is replaced with a label like [secretfold:STRIPE_KEY].

You decide, per project

Off, "use but never see", or "can read, with my fingerprint each time".

Production asks first

A Touch ID prompt tells you which AI wants which keys, before anything runs.

Missing a key?

The AI asks, and you type it into a private box on your screen. The AI never gets it.

See what it did

An activity log shows every command each AI ran with your keys, and when.

Works with Claude Code, Claude desktop, Cursor and Codex. Set it up with one command: secretfold ai setup

Everything your keys need

Locked on your computer

Every key is encrypted with its own lock. Only your master password, your fingerprint or your recovery kit opens them.

No more .env files

secretfold run -- npm start hands your keys straight to your app. Nothing is left lying around in your project.

Deploy with Kamal

kamal deploy reads your keys straight from Secretfold, with one fingerprint per deploy.

Share with your team Coming soon

Invite a teammate to only the projects they work on, even just staging and not production. Remove them with one click.

Sync your computers Coming soon

Your keys on your laptop and desktop, always up to date. Our servers only ever hold locked data they can't open.

Deploy tokens for CI Coming soon

Give GitHub Actions or a server one token that opens one project's production keys, and nothing else. Cancel it anytime.

GitHub and Cloudflare

Send keys to GitHub Actions or Cloudflare Workers with one command, without copying and pasting.

Touch ID and Windows Hello

Unlock with a fingerprint. Secretfold still asks for your password every two weeks, so you never forget it.

Find any key in a second

Press ⌘⇧Space, type a few letters, press Enter. It's copied, and your clipboard clears itself 30 seconds later.

Projects and environments

Keep dev, staging and production apart in every project. Link a folder once and the right keys load there.

A recovery kit

Forgot your password? A one-time code you print or save gets you back in. We never see it.

Your vault in the browser Coming soon

Look up a key from any computer at app.secretfold.com. It's still locked, so only you can open it.

Move in with a few commands

Secretfold picks up your keys from wherever they live now: .env files, Rails key files, Kamal secrets, and anything Kamal already reads from Bitwarden or 1Password. It checks your deploys still get exactly the same keys before changing anything.

Free on Mac, Windows and Linux. A calm desktop app and a command-line tool share the same vault.

$ secretfold import .env
Imported into acme / dev: 6 added
$ secretfold kamal migrate --apply
✓ Kamal reads the same 11 keys from Secretfold
$ secretfold migrate rails-keys --apply
✓ production.key → acme / production
$ secretfold ai setup
✓ Claude Code  ✓ Cursor  ✓ Codex

Safe by design, in plain words

Free on your computer. Pay when you want it everywhere.

Early members get 50% off the first year of any paid plan.

Free

$0

forever, for one person

  • Desktop app and command line
  • Unlimited keys and projects
  • AI tools, Kamal, GitHub and Cloudflare
  • Touch ID, recovery kit, quick search
Get early access ↑

Pro Coming soon

$5/month

or $48 a year

  • Everything in Free
  • Sync across all your computers
  • Deploy tokens for CI
  • Your vault in the browser
  • Version history
Join the waitlist ↑

Teams Coming soon

$8/person/month

billed yearly, or $9 month to month

  • Everything in Pro
  • Share projects and environments
  • Roles, one-click removal, activity log
  • 5 AI agents or CI tokens per person included
  • $7 a person from 10 people, $6 from 50
Join the waitlist ↑

Need single sign-on, your own server or a support contract? Talk to us.

Questions

Is this a password manager?

Not for websites. Secretfold is for the keys your code uses: API keys, tokens, database passwords, certificates and .env files. Keep your usual password manager for logging in to websites.

Can Secretfold see my keys?

No. They're locked on your computer before anything is saved or synced, and only you hold the key. If our servers were ever broken into, the attacker would find locked data they can't open.

How can an AI use a key without seeing it?

The AI asks Secretfold to run a command, like your tests. Secretfold hands the keys to that program directly, then hides any key that shows up in the output before the AI reads it. You can also turn AI access off, or allow reading with your fingerprint each time.

What if I forget my master password?

Use your recovery kit: a one-time code you print or save when you set up. It lets you choose a new password. Without the password or the kit, nobody can get in, including us.

I deploy with Kamal. What changes?

Nothing in how you deploy. secretfold kamal migrate switches your .kamal/secrets files to read from Secretfold, and checks Kamal gets exactly the same keys before saving. You still run kamal deploy.

Can my teammate or brother use the same keys?

Yes, with Teams. You share only the projects they work on, they unlock with their own password and fingerprint, and you can remove them anytime. Sharing is coming soon.

Which computers does it run on?

Mac, Windows and Linux. The browser vault, for looking things up from any computer, is coming with Pro.