Derive locally
Your master password feeds Argon2id on-device. Keys live only in volatile memory for the session.
Cloak
Secrets that never leave your machine.
A zero-knowledge desktop vault for credentials, API keys, and encrypted .env files. Sync convenience. Local cryptography. Opaque cloud storage.
Open source under MIT.
Native for Windows, macOS, and Linux · MIT open source
Encrypted on-device · synced as ciphertext
Built for the stack you already trust
Tauri 2
Rust
React 19
Argon2id
XChaCha20
dotenvx
Product
One vault. Five modules. Zero plaintext on the wire.
Cloak unifies everyday credentials with developer workflows — most notably encrypted .env management — behind a fast, native interface.
01
Credentials & API keys
Store logins and tokens the way you work. Masked by default. Revealed on demand, per field.
02
Environment files
Import plaintext or dotenvx-encrypted configs. Values sealed client-side; keys wrapped with your master key.
03
Projects & backup codes
Group secrets by project. Keep recovery codes organized without scattering them across notes apps.
How it works
From master password to opaque blob.
A horizontal story of local cryptography — scroll to walk the path secrets take.
Seal before sync
XChaCha20-Poly1305 encrypts every secret before anything touches the network.
Store ciphertext
The API holds opaque blobs and auth hashes. It has nothing to decrypt — by design.
Reveal on demand
Browse metadata freely. Decrypt only the field you reveal or copy — never bulk on load.
Features
Engineered for developers who refuse to trust the cloud with keys.
Cryptography
Envelope encryption, not hope.
A per-user Vault DEK is wrapped by your master key — and by a recovery-wrapping key — so resets re-wrap without exposing data.
Argon2id · XChaCha20-Poly1305 · domain-separated KDFs
Developer workflow
.env files that understand encryption.
Import plaintext or already-encrypted dotenvx files. View, decrypt, edit, and delete — with the private key sealed under your master key.
Per-value encryption · wrapped key token · opaque sync
Exposure model
Masked until you mean it.
Secrets render as truncated ciphertext by default. Reveal and copy decrypt a single field in real time — conveying that decryption is intentional.
No bulk decrypt on browse · metadata-only search
Account recovery
Recover without surrendering knowledge.
A Recovery Key plus email flow lets you reset a lost master password. The server never learns your secrets — only new wrapped keys.
Zero-knowledge recovery · OS secure-store Remember Me
Why Cloak
Sync without surrendering the keys.
The gap between password managers and cloud secret stores — filled by local cryptography.
Password managers
The gap — Built for logins — not .env workflows, API key lifecycle, or dotenvx.
With Cloak
Five modules including environment files and projects.
Cloud secret stores
The gap — Often require trusting the provider with keys that can decrypt your data.
With Cloak
Server stores ciphertext it cannot read. Ever.
Notes & .env in git
The gap — Secrets scatter. History leaks. Accidental commits happen.
With Cloak
Encrypted vault with on-demand reveal and sandbox to explore safely.
Voices
What developers ask for.
“I needed something that understood .env files the way I understand them — encrypted at rest, sealed before sync, never plaintext in the cloud.”
“The reveal model is the point. You feel the decryption. That alone changes how carefully you treat secrets.”
“Sandbox mode sold me. Full UI, dummy data, no account — then I built from source when I was ready.”
By design
0
plaintext secrets on the server
0
vault modules in one native app
0
platforms — Windows, macOS, Linux
0-day
Remember Me via OS secure store
Product
A native vault that feels quiet and precise.
Cloak — production.env
production.env
api-service · dotenvx
DATABASE_URLenc:v1:a8f3…c21d
STRIPE_SECRETenc:v1:9b2e…f04a
JWT_SECRETenc:v1:4c7d…8e91
REDIS_URLenc:v1:1f6a…3b72
01
Vault overview
Projects, modules, and search over non-encrypted metadata — without waking sealed fields.
02
Field-level reveal
Click to decrypt. Copy to clipboard. Everything else stays masked.
03
dotenvx import
Bring encrypted configs in. Keep the private key wrapped under your master key.
FAQ
Questions, answered plainly.
Security model, platforms, sandbox, and license — without the marketing fog.
Your master password and plaintext secrets never leave the device. Keys are derived with Argon2id locally; secrets are sealed with XChaCha20-Poly1305 before any network request. The API stores ciphertext it cannot decrypt.
Your secrets stay yours.
Download the native app, explore Sandbox, or build from source. Cryptography happens on your machine — every time.
Open source under MIT.