One encrypted source of truth for every env var, on every machine, in every environment your team ships to and develops on.
curl -fsSL https://itsasecret.dev/install.sh | shEvery value is encrypted on your machine before it syncs, with a key derived from your master password. Our database only has ciphertext we cannot open. The keys exist in exactly one place: with you and the teammates you invite.
Encrypted on your machine, in the CLI or the browser. We never see plaintext.
production, staging, preview-pr-42. Fork any environment and it diverges freely.
shh secret set to sync. shh pull into .env or your shell.
Invite people by email, give them read or write per environment. Remove them and their wrapped key dies with them.
Your master key is derived on-device from your password. The server stores a separate login hash that cannot recover it.
Each value is wrapped by an org key that only your master key unwraps. One secret, one envelope.
The server stores encrypted blobs and re-encrypts them with an ephemeral session key for transport. No plaintext, at rest or in flight.
An invite is an email link, never a shared password. When the new member logs in, the org key is wrapped under their own master key - each member holds their own sealed copy, and removing a member removes theirs.
Load a directory's secrets into your current shell.
bash, zsh, fish, nushell, PowerShell. Native syntax from $SHELL.
eval "$(shh pull --shell)" in .envrc. Secrets load when you cd in.
Tab-complete every command and flag.