Sign in to add a secret
The vault below is yours to look through. Sign in to store a secret - values are encrypted at rest and never shown in the list.
Sign in🔐 Secrets Vault
Passwords, API keys and other secrets, encrypted at rest. Values are hidden until you press Reveal.
How a value is encrypted, and what that does not cover
Saving a secret sends it over HTTPS to the API, which applies envelope encryption there:
save AWS KMS mints a 256-bit data key for this one secret
the value is AES-256-GCM encrypted with a random nonce
stored: ciphertext + nonce + tag + the encrypted data key
reveal KMS decrypts the data key, the server decrypts the valueThe master key never leaves KMS, so a copy of the database alone is unreadable, and a tampered ciphertext fails to decrypt rather than returning corrupted bytes. Be clear about the limit, though: the encrypting happens on the server, not in your browser, and the plaintext passes through the API on save and again on reveal. This is not end-to-end or zero-knowledge storage.
What is stored in the clear, and the caps
- Only the value is encrypted. Label, username, URL and notes are ordinary text - write "AWS root account" there, never the key itself.
- Values run to 8,000 characters - a passphrase, a token bundle or a short private key. Labels take 150, usernames 300, notes 2,000.
- Fifty secrets, free. There is deliberately no paid tier - charging to protect more of your own credentials would be a poor incentive.
- Editing keeps the value unless you type a new one, and typing one re-encrypts the item under a freshly minted data key.
Frequently asked questions
Is the Secrets Vault end-to-end encrypted?
No. Your browser sends the plain value to the API, which encrypts it before storing it and decrypts it again on Reveal. That stops anyone reading the stored data, but not the service itself.
Are the labels and notes encrypted as well?
No, only the secret value. The label, username, URL and notes are saved as plain text so the list can be shown without decrypting anything - which is also why a password should never be typed into the notes field.
Why did a revealed password disappear on its own?
A revealed value re-masks after 20 seconds, and at once if you switch tabs. Press Reveal again, or use Copy while it shows.