Git tracks your source code.
CipherVault protects your secrets.
The simplest, safest way for developers and teams to back up and share API keys, passwords, and .env files. No cloud accounts. No monthly fees. Encrypted on your machine so only you hold the keys.
Hierarchical resource-scoped secrets, zero-cloud version control, envelope encryption with DPoP key binding, and clean-machine disaster recovery for modern development teams.
Everyday Secrets Problems & Solutions
git add . publishes live database passwords and Stripe tokens directly to public GitHub repos.
.env files vanish completely.
ciphervault pull to reconstruct all project secrets in 30 seconds on any clean machine.
Zero-Cloud Safety Hardware-Sealed Vault
Device hardware enclaves seal secrets locally before sync. Git never touches plaintext.
SQLite WAL ledger sealed by OS hardware enclaves (DPAPI, Keychain, SecretService).
Smart Delta Sync 96.15% Deduplication
Editing one key only encrypts and syncs that tiny change—saving bandwidth and time.
FastCDC Gear-rolling hashing (4–64 KiB). Only modified delta chunks re-encrypt and sync (chunk protocol v2, opt-in).
Scoped Environments Hierarchical Scopes
Dev, Staging, and Production separated by project. Stolen tokens cannot decrypt on other PCs.
Tenant → Project → Env hierarchy with XChaCha20 DEK/KEK envelopes and RFC 9449 DPoP.
Disaster Restore Clean-Machine Restore
Reconstruct your workspace on any clean PC in 30 seconds via offline paper kit, trusted guardians, or client-side passphrase backup.
Reconstruct environment on wiped machines via CVKB1 Argon2id passphrase envelopes, Paper Kit, or M-of-N Shamir shares over GF(2^8).
The Four Big Secret Headaches (And How We Fix Them) The Four Critical Secrets Failure Modes
Git ignores .env files, leaving developers exposed to four critical failure modes:
Git tracks source code. Once secrets are excluded by .gitignore, four systemic vulnerabilities emerge:
One careless git add . publishes API tokens, private keys, and database passwords directly to public Git mirrors.
Secrets are tracked in a hardware-sealed local ledger (DPAPI/Keychain). Git commits never touch plaintext secrets.
Laptop lost, damaged, or upgraded? Git restores source code, but all unbacked local .env files and certificates vanish.
Reconstruct your complete secret tree on any clean machine in 30 seconds via offline Paper Kit, Shamir guardians, or client-side passphrase key backup (CVKB1).
Centralized vaults introduce third-party custodial risk, vendor outages, internet dependencies during local builds, and monthly fees.
100% self-hosted, sovereign, and peer-replicated. Zero vendor dependencies, zero tracking, zero recurring license fees.
Plaintext .env files sitting on SSDs expose secrets to malicious npm dependency hooks, local malware, and casual eyes.
ciphervault run -- npm start decrypts secrets strictly in volatile process memory with automatic Zeroize scrubbers.
Smart Sync & Safe Transfer Engine Cryptographic Sovereignty & Engine Pipeline
See how CipherVault locks your secrets on your laptop and only syncs the tiny parts that change—saving speed and bandwidth. Built in pure memory-safe Rust with zero external C-FFI libraries. Pure client-side zero-knowledge guarantees.
Modifying a 32-byte key in a 128 KiB file re-encrypts only that single variable slice. All untouched blocks are verified in-place and reused without wire upload.
Developer Working Tree Enrollment
CipherVault tracks secret files out-of-band from Git. During enrollment via ciphervault track .env, the path is registered in the local SQLite WAL ledger and appended to .gitignore (skip with --no-gitignore). Content digests bind at snapshot time, not at enrollment.
Guarantees zero accidental staging into Git commits (git add . will never expose secrets). Host OS hardware keyrings (Windows DPAPI, macOS Keychain, Linux Secret Service) seal the vault master key R.
// apps/cli/src/commands/track.rs — cmd_track (real flow)
let file_id = store.track_file(&path_str)?; // SQLite WAL registry
if !no_gitignore {
ensure_file_in_gitignore(&path)?; // appended, not untouched
}Separate Secrets for Dev, Staging & Production Hierarchical Scopes, Envelope Encryption & DPoP Binding
Stop sharing one big unencrypted .env file. Organize passwords neatly by team and project. Keep production keys locked down while giving developers instant local testing access.
Move beyond monolithic .env files. Isolate credentials across Tenants, Workspaces, Projects, and Environments with per-version envelope encryption, dual-admin approvals, and tamper-evident audit chains.
cvst1_apex_checkout_api_prod_8f3a9e2d...
DEK: 8b4f129c... [ZeroizeOnDrop]
tenant:apex-fintech|project:checkout-api|env:production|secret:DATABASE_URL|v:4
Computing...
DPoP Fingerprint: ed25519:... (Verified on Loopback)
Every secret creation, read, rotation, and deletion appends an immutable record into the control-plane SQLite WAL ledger. Each entry cryptographically incorporates the prior block's hash. Any retroactive row modification breaks the entire chain immediately.
Computing...
Computing...
Computing...
Computing...
Migrate monolithic .env files and legacy raw vault snapshots into scoped secrets with zero downtime, zero plaintext disk writes, and readback verification before atomic cutover:
Parses legacy dotenv files into discrete keys; computes SHA-256 pre-migration digests.
ciphervault migrate plan
Detects name collisions or invalid slugs; isolates conflicts into a non-destructive quarantine.
migrate resolve --migration-id <ID> --entry <id>
Generates per-version DEKs under XChaCha20-Poly1305 with scope-bound AAD and project KEK wrap.
ciphervault migrate apply
Reads back ciphertext over loopback TLS, decrypts in memory, and asserts bit-identical match.
ciphervault migrate verify
Production migrations require second-approver cryptographic signature before pointer promotion.
ciphervault approve --sign
Atomically updates the active version pointer; older applications continue without interruption.
Atomic DB Flip (WAL)
Zeroizes RAM buffers and shreds obsolete un-scoped plaintext copies from disks.
ZeroizeOnDrop Memory Wipe
Repositories are bound to projects by immutable provider IDs (GitHub numeric ID, GitLab project ID, Bitbucket UUID). Survives renames, transfers, and monorepos:
# Bind GitHub repo with signed HMAC-SHA256 webhooks
ciphervault repo bind --project checkout-api --provider github --repo-id 84920194 --name apex/checkout --url https://github.com/apex/checkout
# Confine secret to specific repository binding or service
ciphervault secret set STRIPE_WEBHOOK_KEY --repo-binding 84920194 --env productionLightning Fast on Any Computer Performance Metrics vs. Traditional Systems
Because CipherVault runs directly on your computer instead of waiting for slow cloud servers, operations happen in milliseconds with zero lag. Empirical benchmarks measured on x86_64 release builds, backed by 150+ workspace test files and live multi-region nodes.
| EVALUATION DIMENSION | CIPHERVAULT | AWS SECRETS MGR | HASHICORP VAULT | 1PASSWORD / DOPPLER | SOPS / GIT-CRYPT |
|---|---|---|---|---|---|
| Trust Model | Zero-Knowledge (Client) | Custodial (Cloud KMS) | Semi-Custodial (Server) | SaaS Custodial | Sovereign (Local) |
| Deduplication | FastCDC 96.15% | 0% (Full Blob) | 0% (Full Blob) | 0% (Full Blob) | 0% (Full Blob) |
| Durability Proof | PoS Nonce (461 B) | None (Cloud SLA) | Raft Heartbeat | None (SaaS SLA) | Git Hash Only |
| Disaster Recovery | Paper Kit / Shamir / CVKB1 | Cloud Account Auth | 3-of-5 Unseal Keys | Account PDF Key | PGP Master Key |
| Disk Exposure | Zero-Disk RAM Execution | Plaintext Disk Export | Plaintext Disk Export | Plaintext .env File | Checked out Plaintext |
| Scope Model & Isolation | Hierarchical (Tenant/Proj/Env) + AAD Envelope | Flat ARNs / Paths | Path Mount Namespaces | SaaS Project / Env | Single File PGP/KMS |
| Token Security (DPoP) | Asymmetric DPoP-Lite (Anti-Replay) | Bearer IAM Credentials | Bearer Vault Token | Bearer Service Token | N/A (Local Key Only) |
| Audit Verification | SHA-256 Chained Hash Ledger + L2 Anchor | Centralized CloudTrail | Flat File Audit Log | SaaS Audit Export | Git Commit History Only |
| Zero-Downtime Migration | 7-Stage Pipeline with Readback Verify & Rollback | Manual Scripted (Risk of Outage) | KV v1→v2 Engine Migration | Manual Secret Re-entry | Full Git Re-encrypt |
| Offline Autonomy | 100% Offline-First | Fails on Cloud Outage | Requires Vault Host | Requires SaaS API | 100% Offline |
| Cost & Licensing | Free / MIT / Apache-2.0 | $0.40/secret + API calls | BSL / Commercial | $3-$18/user/month | Free / Open Source |
Restore Everything if Your Computer Dies Clean-Machine Sovereign Disaster Recovery
If your laptop is lost, stolen, or destroyed, how do you get your passwords and keys back? Choose the method that fits your team: Reconstruct confidential developer files on a completely wiped machine without asking permission from any cloud custodian or SaaS provider.
During ciphervault init, a 256-bit Master Secret R with CRC32 checksum is printed exclusively to your terminal.
It is never written to disk, and volatile RAM is purged immediately with ZeroizeOnDrop compiler fences.
Split recovery power among team leads using polynomial interpolation over Galois Field GF(28). Any 2 of 3 guardians can cooperatively reconstruct the epoch root.
Back up your root keys into an immutable, content-addressed operator object protected by your memorable master passphrase. Derived purely client-side via memory-hard Argon2id (64 MiB RAM, 3 passes, 4 lanes) and sealed with authenticated XChaCha20-Poly1305. Zero server unwrap oracle — restore on any wiped PC with only your passphrase.
sha256(envelope) calculating...
ciphervault recovery key-restore --locator … --output recovery-kit.txt
Disaster recovery does not merely dump loose files on disk. On a completely wiped machine, ciphervault recover resolves the immutable genesis locator, automatically initializes a new SQLite vault.db store at the recovered epoch (init_vault_at_epoch), mints a fresh recovery-signed device identity, and pulls all snapshot chunks. The clean device is instantly primed for immediate push, diff, and pull commands without manual re-configuration.
Install CipherVault on Your Computer Developer Quickstart & Node Setup
Download pre-compiled binaries for Windows, Mac, or Linux, or install via your favorite terminal package manager: Get started in 60 seconds using pre-compiled native binaries, direct Cargo source compilation, or Docker Compose.
# Install CipherVault for Windows via PowerShell (Release v1.0.28)
irm https://raw.githubusercontent.com/samuel-1-avson/CipherVault/main/dist/scripts/install.ps1 | iexPrefer standalone executables without running package scripts? Download official standalone archives directly from the release feed:
Generates master secret R, binds OS hardware keyring, and prints emergency paper kit.
Enroll confidential files without changing your Git working tree or commit index.
FastCDC slices changes into encrypted chunks and replicates them across storage operators.
Publishes snapshot commitments to CipherVaultRegistry.sol for immutable timestamp verification.
Injects decrypted secrets directly into process RAM without writing to SSD storage.
Back up root keys into an Argon2id CVKB1 envelope and monitor continuous replication health.
Run an independent zero-knowledge storage operator node for your team with K-of-N multi-sig admission:
ciphervault node setup --port 8201 --data-dir /var/lib/ciphervault && ciphervault invite join ticket.json --node https://<node-url>
Frequently Asked Questions
Clear answers without technical jargon:
push and pull.
.gitignore only stops files from being pushed to Git—it does not back them up or sync them. CipherVault securely backs up and syncs your secrets out-of-band.
CVKB1). Your keys are sealed client-side with Argon2id and stored content-addressed on operator nodes. Recover on any wiped laptop with ciphervault recovery key-restore --locator <HEX> and your memorable passphrase.
ciphervault-push.timer on Linux systemd or register-push-task.ps1 on Windows Task Scheduler) plus ciphervault watch for continuous, automatic zero-lag secret replication.
CipherVault is 100% sovereign, open-source, and operated without SaaS subscriptions. Donations fund testnet quorum nodes and continuous build runners.