The secrets vault for developers, on your Mac.
API keys, .env files, .p8 keys, databases and credentials organized by project. Encrypted on this Mac, unlocked with Touch ID, no servers in between.
brew trust safe8bit-app/tap
brew install --cask safe8bit-app/tap/safe8bit
The Shield in 30 seconds
An AI agent tries to read a .env. Safe8bit blocks it, and the app still gets its keys through safe8bit run.
An animation made with the Shield’s real messages.
Lite: the vault, free forever
Everything you need to store and use secrets every day. No account, no limit on secrets and no time limit.
Vault per project
API keys, .env files, Apple .p8 keys, database connections and credentials, sorted by app and by environment (dev, staging, prod). Each secret keeps its version history and expiry date.
Touch ID and strong encryption
You open the vault with your fingerprint or your master password. Everything is encrypted with AES-256-GCM and Argon2id, with no metadata in the clear. It locks itself when the Mac sleeps or the screen locks.
AutoFill, passkeys and 2FA
Fills in logins in Safari and in apps, creates passkeys to sign in to sites like GitHub with Touch ID, and generates 2FA codes. Scan the site’s QR code and the code shows up when you copy the password.
Quick Access and Generator
⌃⇧Space opens a search over any app: Enter copies the value or the code and takes you back where you were. The Generator creates passwords and tokens.
Rotation Radar
Shows the secrets that are expired, reused, weak or have gone too long without rotation, so you know which to change first. The analysis runs only on your Mac.
Detector and Import
Searches a folder (for example ~/Development) for .env, .p8, .pem and .jks files forgotten in the clear and saves them to the vault. Imports from Apple Passwords, Chrome, Firefox, 1Password and Bitwarden.
Also in Lite: sync the vault between your Macs through your own iCloud, always encrypted; open .safe8bit shares people send you; and the Emergency Kit, a printed recovery key for when you forget your master password.
Pro: the developer tools
Pro takes the vault to the terminal, to git and to AI agents. This is where you stop keeping secrets in files. Every command is in the manual.
Terminal without .env
safe8bit run -e prod -- npm start injects the project’s variables into the process, with no file on disk. mount serves the .env through a pipe, read and otp give you a value or a code, list shows the names without the values, and env writes the file when a tool insists on one. Every use asks for Touch ID.
Git Guard
A pre-commit hook compares the new lines with the values in the vault and blocks the commit before the key reaches GitHub. Install it in one repository or in every repository in a folder, and safe8bit guard scan looks for values that were already committed. In Lite it only logs what it finds.
Shield for AI agents
Stops Claude Code and Cursor from reading .env files, keys and vault values. safe8bit shield scan looks for keys left behind in CLAUDE.md, AGENTS.md, .mcp.json and in the Codex and Gemini settings. In Lite it only logs.
SSH Agent with Touch ID
Your SSH keys live in the vault and never leave it. Every ssh or git push asks for your fingerprint, even with the app closed.
Test, rotate and push
safe8bit test asks each service (OpenAI, Anthropic, Stripe, GitHub, Vercel and Supabase) whether the keys still work. safe8bit push sends the variables to Vercel after testing them.
Encrypted shares
Share a secret in an encrypted .safe8bit file, with a passphrase and an expiry date, over AirDrop, Slack or email. The recipient opens it in Safe8bit, even on Lite.
Lite and Pro side by side
The same download. Pro is activated in the app with the key you get by email.
| Lite | Pro | |
|---|---|---|
| Vault per project, Touch ID, history | ✓ | ✓ |
| AutoFill, passkeys and 2FA codes | ✓ | ✓ |
| Quick Access, Generator and Radar | ✓ | ✓ |
| Detector and Import | ✓ | ✓ |
| Open shares and Emergency Kit | ✓ | ✓ |
| Sync with iCloud | ✓ | ✓ |
| Terminal: run, env, read, otp, list, mount, push, test | — | ✓ |
| Git Guard | logs only | blocks |
| Shield for AI agents | logs only | blocks |
| SSH Agent with Touch ID | — | ✓ |
| Create encrypted shares | — | ✓ |
| Free | $39 / year |
Questions
Do I need to create an account?
No. You download the app and create the vault on your Mac. The Pro license is a key you paste in Settings › License; it is verified on the Mac itself, with no internet connection.
What happens when the subscription ends?
The key is valid until the end of the paid period, plus 7 days. After that, the app goes back to Lite: the vault and your secrets stay there, only the Pro tools stop. Git Guard and the Shield keep running, but only log.
Do my secrets go through any server?
No. There is no Safe8bit server and no telemetry. Once a day the app checks safe8bit.com for a new version (you can turn this off), and only safe8bit test and safe8bit push talk to the services you choose. If you turn on sync, the vault travels through your own iCloud, already encrypted: Apple only sees encrypted data.
Can I try Pro before paying?
Lite is free and never expires, so you can use the vault for as long as you like. If you buy Pro and it isn’t for you, you have 14 days to ask for a refund (see Refunds).
Does it work on more than one Mac?
Yes. iCloud sync, which is free, keeps the vault the same on all of them, and the same Pro key works on all your Macs. Each Mac uses its own Touch ID.
How do I install it?
With the Download button, or with Homebrew: brew trust safe8bit-app/tap and then brew install --cask safe8bit-app/tap/safe8bit. Homebrew also installs the safe8bit command.