Derive locally
Your master password feeds Argon2id on-device. Keys live only in volatile memory for the session.
Cloak
Secrets that never leave your machine.
A zero-knowledge desktop vault for credentials, API keys, SSH keys, and encrypted .env files. Sync convenience. Local cryptography. Opaque cloud storage.
Native for Windows, macOS, and Linux · MIT open source
Encrypted on-device · synced as ciphertext
Built for the stack you already trust
Tauri 2
Rust
React 19
Argon2id
XChaCha20
dotenvx
Product
One vault. Seven modules. Zero plaintext on the wire.
Cloak unifies everyday credentials with developer workflows — encrypted .env management, cloud access keys, SSH key files — behind a fast, native interface.
01
Credentials & API keys
Store logins and tokens the way you work. Masked by default. Revealed on demand, per field.
02
Access & SSH keys
AWS-style key pairs — typed in or imported from a credentials CSV — plus RSA/ED25519 key files in PEM or PuTTY format, detected on import.
03
Environment files
Import plaintext or dotenvx-encrypted configs. Values sealed client-side; keys wrapped with your master key.
04
Projects & backup codes
Group secrets by project. Keep recovery codes organized without scattering them across notes apps.
Why Cloak
Alternatives cover a slice. Cloak covers the workflow.
Password managers stop at logins, secret stores stop at the server, and notes stop at nothing. One vault closes the gaps.
Password managers
Cloud secret stores
Notes & .env in git
CloakZero-knowledge, client-side encryption
Encrypted .env files (dotenvx-compatible)
API keys, access keys & SSH key files
2FA backup codes, organized per platform
Field-level reveal — one secret at a time
Role-based access control for teams
Per-organization audit trail
Secure team sharing without plaintext on a server
Native desktop app for Windows, macOS, Linux
Free & MIT open source
Included Partial — plugins, add-ons, or manual workarounds Not covered
How it works
From master password to opaque blob.
A horizontal story of local cryptography — scroll to walk the path secrets take.
Seal before sync
XChaCha20-Poly1305 encrypts every secret before anything touches the network.
Store ciphertext
The API holds opaque blobs and auth hashes. It has nothing to decrypt — by design.
Reveal on demand
Browse metadata freely. Decrypt only the field you reveal or copy — never bulk on load.
Features
Engineered for developers who refuse to trust the cloud with keys.
Cryptography
Envelope encryption, not hope.
A per-user Vault DEK is wrapped by your master key — and by a recovery-wrapping key — so resets re-wrap without exposing data.
Argon2id · XChaCha20-Poly1305 · domain-separated KDFs
Developer workflow
.env files that understand encryption.
Import plaintext or already-encrypted dotenvx files. View, decrypt, edit, and delete — with the private key sealed under your master key.
Per-value encryption · wrapped key token · opaque sync
Exposure model
Masked until you mean it.
Secrets render as truncated ciphertext by default. Reveal and copy decrypt a single field in real time — conveying that decryption is intentional.
No bulk decrypt on browse · metadata-only search
Account recovery
Recover without surrendering knowledge.
A Recovery Key plus email flow lets you reset a lost master password. The server never learns your secrets — only new wrapped keys.
Zero-knowledge recovery · OS secure-store Remember Me
Voices
What developers ask for.
“I needed something that understood .env files the way I understand them — encrypted at rest, sealed before sync, never plaintext in the cloud.”
“The reveal model is the point. You feel the decryption. That alone changes how carefully you treat secrets.”
“Sandbox mode sold me. Full UI, dummy data, no account — then I built from source when I was ready.”
By design
0
plaintext secrets on the server
0
vault modules in one native app
0
platforms — Windows, macOS, Linux
0-day
Remember Me via OS secure store
Product
A native vault that feels quiet and precise.
Cloak — production.env
production.env
api-service · dotenvx
DATABASE_URLenc:v1:a8f3…c21d
STRIPE_SECRETenc:v1:9b2e…f04a
JWT_SECRETenc:v1:4c7d…8e91
REDIS_URLenc:v1:1f6a…3b72
01
Vault overview
Projects, modules, and search over non-encrypted metadata — without waking sealed fields.
02
Field-level reveal
Click to decrypt. Copy to clipboard. Everything else stays masked.
03
dotenvx import
Bring encrypted configs in. Keep the private key wrapped under your master key.
FAQ
Questions, answered plainly.
Security model, platforms, sandbox, and license — without the marketing fog.
Your master password and plaintext secrets never leave the device. Keys are derived with Argon2id locally; secrets are sealed with XChaCha20-Poly1305 before any network request. The API stores ciphertext it cannot decrypt.
Your secrets stay yours.
Download the native app, explore Sandbox, or build from source. Cryptography happens on your machine — every time.