Zero-knowledge by default

Secrets, safe by design.

SecretPass keeps personal passwords and developer secrets in one workspace — client-side encrypted, role-controlled, and ready to self-host.

Two encryption models, one platform

Because a human's password and a CI pipeline's API key deserve different protection.

Zero-knowledge

Passwords, notes and cards encrypted on your device. The server only ever stores ciphertext and wrapped keys — it can never read your data.

Envelope + KMS

API keys and env vars protected with envelope encryption, so machines and CI can decrypt without a master password — gated by RBAC and audit.

Owner, admin, member and viewer roles, isolated per workspace.

Organize secrets by project and dev / staging / prod environments.

Every change recorded to an append-only, tamper-evident trail.

Share a vault by re-wrapping its key — items are never re-encrypted.

Run it yourself with Docker, or use the hosted service.

Light, dark and midnight themes; English, German and Persian.