# Secretfold

> Secretfold is an encrypted vault for API keys, tokens and `.env` secrets, made by Synergia Solutions. A desktop app (Mac, Windows, Linux), a `secretfold` command-line tool and an MCP server share one vault, so apps, deploys and AI coding assistants can use secrets without anyone seeing or pasting them. It is in early access: join the list at https://secretfold.com/ (early members get 50% off the first year of a paid plan).

Secretfold is for developer secrets (API keys, tokens, `.env` files, key files). It is not a password manager for website logins.

## What it does

- Encrypts every secret on your computer, each with its own key. The vault is one file that only your master password or your recovery code can open.
- Runs your app with secrets as environment variables, so no `.env` file is left on disk: `secretfold run -- npm start`.
- Keeps projects and environments apart (for example `acme / dev` and `acme / prod`). Link a folder once and commands there use the right set.
- Desktop app: browse, edit and bulk-move secrets; press ⌘⇧Space (Ctrl+Shift+Space) anywhere to search and copy a value. The clipboard clears after 30 seconds.
- Unlock with Touch ID or Windows Hello. The master password is still asked for every 14 days.
- Auto-locks after 10 idle minutes. Unlocking the app or the CLI unlocks both.

## AI tools (MCP)

- `secretfold ai setup` connects Claude Code, Claude desktop, Cursor and Codex.
- AI tools can list secret names, run commands with secrets (values in output are replaced with `[secretfold:NAME]`), and ask the person to add a missing secret through a private dialog.
- Per project and environment the person chooses: off, "use but never see" (default), or "can read with Touch ID approval". Production asks first. Every AI action is logged.

## Deploys and CI

- Kamal: `secretfold kamal migrate --apply` switches `.kamal/secrets` to read from Secretfold; `kamal deploy` works as before.
- Rails: `secretfold migrate rails-keys` stores `master.key` / `credentials/*.key` as `RAILS_MASTER_KEY` per environment.
- `secretfold sync github` and `secretfold sync cloudflare` push secrets to GitHub Actions and Cloudflare Workers.
- Coming soon: deploy tokens (one token opens one project/environment in CI), sync across computers, sharing with teammates, a browser vault.

## Command line

```
secretfold init                  # create the vault
secretfold link acme --env dev   # this folder uses acme / dev
secretfold import .env           # bring in an existing .env file
secretfold add STRIPE_KEY        # prompts for the value, hidden
secretfold run -- npm start      # start with secrets as env vars
secretfold get STRIPE_KEY -e prod
secretfold list --all            # names only, never values
secretfold export > .env
secretfold lock
```

## Security

- Argon2id derives the key from your master password.
- XChaCha20-Poly1305 encrypts each secret separately and detects tampering.
- A one-time recovery code gets you back in if you forget your password. Secretfold never sees or stores it.
- Planned sync is zero-knowledge: the servers only hold data they can't read.

## Pricing

- Free: desktop app and CLI, unlimited secrets and projects, Touch ID, recovery kit, quick search.
- Pro (coming soon), $5/month or $48/year: encrypted sync across computers, deploy tokens, the vault in the browser, version history.
- Teams (coming soon), $8/person/month billed yearly or $9 monthly ($7 from 10 people, $6 from 50): sharing, roles, removal, activity log, 5 AI agents or CI tokens per person.

## Links

- [Home page](https://secretfold.com/): overview and early-access sign-up