The offline vault for developers who are tired of subscriptions.
A zero-knowledge, offline-first secrets and password vault for developers. Projects, environments, servers, and credentials in one encrypted file you own - no account, no cloud, no monthly bill.
No account required 路 Free tier available 路 v1.0.40路Mac & Linux builds coming soon
Project & Environment Namespace Manager
Organize and secure environment variables across projects (Local, Staging, Production). Values stay encrypted in RAM.
Real Sidebar Folders
Create, rename, and reorder folders; drag a project onto one to move it. Collapse state is remembered between sessions.
More Breathing Room
Wider spacing and a colored left accent matching the project's own color tag - no more cramped header.
Quick Links
One-click bookmarks to the consoles you actually use per project - paste a URL and Google Cloud, GitHub, Stripe, and ~25 other services are auto-detected with a real fetched icon.
Less Button Clutter
Only the actions you use constantly stay visible - Snapshots, Rename, and Delete tuck into one More... menu.
馃挕 Tap the pulse rings to explore features, or tap the screenshot itself to zoom in.
Offline-first
No server, ever. Your vault works with no internet connection at all.
Zero-knowledge
Your master password never leaves your machine, and nobody - including us - can reset it for you.
One file you own
The entire vault is a single encrypted SQLite file. Back it up, move it, inspect it - it's yours.
No account, no cloud
Nothing to sign up for. Nothing syncing to a server you don't control.
Everything in one vault
Built for the way developers actually work
Not a password manager with env vars bolted on, and not a cloud secrets platform pretending to be simple. Cloakspire is native to both jobs.
Projects, environments, and variables - modeled the way you actually work
Every project gets its own environments (local, staging, production, whatever you call them), each holding typed variables with notes, required flags, and full history. Not a flat list of secrets - a real map of your stack.
- .env import/export, plus paste-to-import from clipboard
- ENV DRIFT badge when a linked folder's .env no longer matches the vault
- Type auto-detection, masking, and a built-in password/token generator
Real sidebar folders, not a flat list
Create, rename, reorder, and drag projects between folders - single-level, no nested-folder maze to get lost in. Collapse state is remembered between sessions, and deleting a folder never deletes what's in it.
- Drag a project onto a folder, or right-click for Move to Folder
- A quieter header and toolbar: only the actions you use constantly stay visible, the rest live in More...
Quick Links: one click to the console you actually need
A row in every project's header for bookmarks to the external consoles you use for that project - Google Cloud, GitHub, Stripe, Vercel, and ~25 other common services are auto-detected from a pasted URL, with a real icon fetched in the background. A second, vault-wide row on the Dashboard covers bookmarks that aren't tied to any one project.
- An unrecognized URL still works as a plain bookmark, with a generated icon instead of a fetched one
- Optionally attach a linked secret (e.g. an OAuth client secret), copyable via the same auto-clearing clipboard as the rest of the vault
- Icon fetching never blocks - drag to reorder, click or double-click to open
A dashboard that actually catches problems
Ten cards, not two: projects, environments, variables, secrets, servers, and SSH keys at a glance, plus the numbers that matter - missing variables across every linked project, duplicate keys within an environment, and tokens about to expire.
- Duplicate Keys catches case-variant mistakes like API_KEY vs api_key that a database constraint alone can't
- Expiring Tokens reads an optional expiry date you set on any Service Credential
Snapshots: a safety net for every migration
Take a named, point-in-time capture of an environment before a risky change. Diff it against the current state any time. Restore with one click - a safety snapshot is taken automatically first, so restoring is itself undoable.
Servers & VPS, with a real terminal built in
Store host, user, and password for every server you touch - then Connect opens a genuine interactive SSH shell right inside the vault, as a tab in one shared Terminal Hub. Full color output, live resize, a real draggable scrollbar over 4000 lines of history, and TOFU host-key pinning that warns you (hard) if a key ever changes.
- Every server you connect to lands as a tab in the same Terminal Hub window, whether you opened it from a project or from All Servers
- Detach pops one tab out into its own fully independent window - the live session carries over, and it survives closing the Hub or minimizing Cloakspire itself
- Mouse wheel or a real scrollbar pages through local history, not just a keyboard shortcut
- Optional Default Folder auto-cd's you into the right directory on connect
- All Servers view lists every server across every project in one place
A CLI that deletes your .env files
evx run -- npm run dev injects your environment's variables straight into the child process's memory. No .env file is ever written to disk - nothing to accidentally commit, zip, or sync to the cloud.
Sync with Vercel and GitHub Actions
Push variables straight to Vercel or GitHub Actions secrets, or pull them back in - including a bulk import that creates or updates a vault project for every Vercel project in your account.
A full personal vault, not just a secrets manager
Logins, cards, secure notes, SSH keys, tokens, and API keys, organized in nestable folders - the same encrypted database and master key as your project vault. One app instead of a password manager plus a separate dev tool.
- API Keys get fields Tokens don't: a Key ID (the public identifier some systems pair with the secret), Scopes/Permissions, the Header Name it's sent in, and an Active/Revoked status
- Every item type can carry a custom icon - fetched automatically from its website, or uploaded manually
Backup, restore, and a genuine escape hatch if you forget your password
A timestamped backup of the whole encrypted database is written automatically on every app exit, and you can save a full manual snapshot anywhere, any time. Moving to a new machine is a one-step restore, not a manual file hunt.
- New install? Choose "Already have a vault? Restore from backup" on first setup instead of creating a new one
- Forgot your master password and have no recovery code? Start Fresh sets up a brand-new vault without deleting the old, still-encrypted one - it's archived, not destroyed, in case you remember the password later
- A restored vault always starts on the Free tier on its new machine, even if it was Pro before - re-enter your license key to unlock Pro there too (it has no device limit, so this is one paste, not a repurchase)
Directories: a credential registry for your whole team
Named collections of people - name, job position, department, email, username, password, phone, and an Active/Inactive status - for the "who at this company has what login" security review, not for your own logins. Import an existing spreadsheet via CSV, export a report back out.
- As many named Directories as you need - one per client, per department, whatever fits
- CSV import matches columns by header name and skips (and reports) any row missing a name, instead of failing the whole file
Project Intelligence
It knows your stack, not just your env var names
Missing or unused variables are the most common '3am incident' in any codebase that touches .env files - but a plain diff misses typos and has no idea what your project actually runs on. Project Intelligence reads your real source, package.json, and config files to catch both.
- Detects your real stack: Docker, CI provider, Vercel, and Prisma - including which database engine it's configured for
- Detects third-party services in use (Stripe, OpenAI, Supabase, AWS, and more) straight from package.json
- A missing key that closely resembles an unused one gets a "did you mean X?" suggestion, with a one-click Rename that fixes it in place
- Still does the basics well: flags what's missing, what's unused, and generates a clean .env.example
CLI companion
Delete your .env files. Really.
evx run injects your environment's variables straight into a child process's memory - nothing ever touches disk. No file to accidentally commit, zip, or sync to the cloud.
- Prompts for your master password with no echo - or set EVX_PASSWORD for scripts
- Values go to stdout, messages to stderr, so piping stays clean
- The child process's exit code is forwarded, so it behaves correctly in CI
Trust is the product
Security you can actually read
Real, audited cryptographic primitives - no homemade crypto - and a plain account of what Cloakspire does and doesn't protect against.
Argon2id key derivation
New vaults derive a random master key wrapped by your password using Argon2id (memory-hard, resistant to GPU cracking) - not a directly-derived key, so changing your password never re-encrypts your data.
Fernet authenticated encryption
Every secret value is encrypted with Fernet (AES-128-CBC + HMAC-SHA256) from Python's audited cryptography library. Tampering with the database is detected, not silently ignored.
Metadata is encrypted too
Not just values: variable names and notes, snapshot contents, and server labels/hosts/usernames are all ciphertext at rest. A stolen database file reveals structure, not your infrastructure map.
TOFU SSH host-key pinning
The first connection to a server shows its SSH host key fingerprint for you to confirm, exactly like OpenSSH. If a later connection presents a different key, you get a hard warning naming both fingerprints - never a silent reconnect.
A real recovery kit
A one-time, high-entropy recovery code generated at setup can reset a forgotten master password without losing data - the industry-standard pattern, not 'forgot your password? start over.'
Clipboard auto-clear
Copied secrets clear from your clipboard automatically after a short delay, so they don't linger for the next paste in an unrelated window.
How it compares
Why not just use Bitwarden or Doppler?
Every one of them is excellent at part of this job. Cloakspire is the only one built to do all of it, fully offline.
| Capability | Cloakspire | Bitwarden | 1Password | Doppler | Infisical |
|---|---|---|---|---|---|
| Fully offline, no account required | partial | ||||
| One-time purchase available | |||||
| Dev-native project / environment vault | partial | ||||
| General password manager (logins, cards, notes) | |||||
| Live SSH terminal built in | |||||
| CLI: inject secrets, never write .env | partial | partial | |||
| Snapshots with diff and restore | partial | partial | |||
| Detects your stack (Docker, CI, Prisma) and suggests typo fixes | |||||
| Vercel / GitHub Actions sync | |||||
| Zero infrastructure to run or trust | partial |
Based on each product's publicly documented model as of July 2026 - click a competitor's name above to check their current pricing page. Feature sets and pricing change over time, so re-verify before citing this table anywhere.
What about teams?
Work offline locally, sync through CI - no team cloud required
Cloakspire is offline-first by design: there's no central server to trust, breach, or pay for per seat. For a small team, that's not a gap - it's the pitch.
Today, sharing a project between teammates means passing the vault file directly, or using the Pro Vercel / GitHub Actions sync as the hand-off point - push from your machine, teammates (and CI) pull from there. Native multi-user sync isn't built yet, and we'd rather say that plainly than pretend otherwise.
# Everyone on the team works offline, locally> evx run acme-app/production -- npm run start聽# Ship the environment through CI, not through Slack DMs> evx export acme-app/production --template > .env.examplesynced to GitHub Actions secrets on push
Pricing
Pay once. Not a subscription.
Start free with a single project. Unlock everything else whenever you're ready - no recurring charge, ever.
Free
Everything you need to stop keeping secrets in .env files.
- 1 project, unlimited environments & variables
- Full Personal Vault (logins, cards, notes, SSH keys, tokens, API keys)
- .env import/export & clipboard import
- Command palette & keyboard shortcuts
- Manual backup & restore
Pro
Unlimited projects and every developer workflow, unlocked once.
- Unlimited projects
- Snapshots with diff & restore
- Servers & VPS + live SSH terminal with tabs
- Service Credentials vault
- Directories: a credential registry for your team
- Project Scanner + .env.example generation
- Vercel & GitHub Actions sync
- CLI companion
- Automatic rotating backups
Pro is a one-time unlock - pay once and it's yours forever on this major version. A future major version may offer an optional paid upgrade. Never a recurring charge for what you already own.
FAQ
Questions, answered plainly
Own your vault. Starting today.
Free to start, one project included. Upgrade to Pro whenever you need more - once, not monthly.
Mac & Linux builds coming soon