Developer secrets manager

Secrets management
without the setup tax.

The same encryption, scoping and audit trail you'd get from Vault or AWS — without the afternoon of configuration, and without the 2am troubleshooting when something breaks.

Start free — no card See how it works

Free tier: 2 projects, 25 secrets, 2 runtime keys. No time limit.

vault · encrypt

keyDATABASE_URL

cipherAES-256-GCM

nonce7e3ac6…59fe

auth_tagf4bc0a…b8ee

stored▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓

encrypted at rest · scoped access · fully audited

Why this exists

Enterprise tooling asks for an enterprise team

Vault and AWS Secrets Manager are excellent — if you have someone whose job is running them. Most teams don't, and end up with credentials in a .env file nobody wants to talk about.

The usual path

Cluster setup, seal/unseal, policy language to learn
IAM roles, KMS keys, regional configuration
An afternoon before storing your first secret
Documentation written for platform teams
Incidents that need someone who knows the internals

V-Secrets

Sign in with GitHub, create a project, store a secret
One API key, one header, done
Five minutes to production
Documentation written for the person shipping the app
Behaviour you can reason about at 2am

Same AES-256-GCM. Same scoped access. Same audit trail. Less ceremony.

How it works

Three steps, about five minutes

Store a secret

Encrypted with AES-256-GCM before it reaches the database. Plaintext never touches disk or logs.

curl -X POST api.vsecrets.dev/projects/$ID/secrets \
  -H "X-API-Key: $VSECRETS_KEY" \
  -d '{"key":"DATABASE_URL","value":"postgres://…"}'

Issue a runtime key

Scoped to one project, read-only or read-write, with an expiry date. Your service authenticates without a password.

scopes:  projects:read
         secrets:read
         secrets:reveal

Read it at boot

Fetch once at startup, hold it in memory. Every reveal is recorded against the key that requested it.

const res = await fetch(revealUrl, {
  method: "POST",
  headers: { "X-API-Key": process.env.VSECRETS_KEY },
});
const { value } = await res.json();

What you get

Built for the incident, not the demo

Rotation with a grace period

Rotating issues a replacement and keeps the old key alive for 24 hours, so your services pick up the new value without an outage. Most tools make you choose between rotating and staying up.

Scopes that actually scope

A key can list secrets without being able to decrypt them. Bind it to a single project so a leak in staging can't reach production.

Every reveal recorded

Which credential, from where, whether it succeeded. When you need to answer "what did this key touch", the answer is already there.

Versioned secrets

Updating creates a new version instead of overwriting. Rotations stay reversible.

Passwordless by default

GitHub OAuth or an emailed sign-in link. No password to leak, phish, or reuse. Password sign-in stays available if you want it.

REST API, no SDK required

One header, standard HTTP. Works from any language, any CI system, any container — nothing to install.

Under the hood

The specifics, not the adjectives

You're being asked to hand over your AWS and Stripe credentials. Here is exactly what happens to them — judge for yourself rather than taking "bank-grade" on faith.

Encryption

AES-256-GCM, authenticatedEach ciphertext is bound to its project, key name and version. Moving encrypted data between projects makes decryption fail rather than silently succeed.

Key derivation

HKDF-SHA256, one key per projectProjects are cryptographically isolated. Compromising one doesn't expose another.

Password hashing

Argon2id, 64 MiB memory costMemory-hard, so GPU and ASIC farms can't parallelise an offline attack. The current OWASP recommendation.

Runtime keys

268 bits of entropy, stored as HMAC-SHA256The raw key exists once, at creation. A database dump contains hashes, not credentials.

Brute force

Progressive lockout, per account and per IPRepeated failures escalate from minutes to hours. Credential stuffing across many accounts trips the per-IP limit.

Sessions

30-minute tokens, refreshed silentlyA stolen token is useful for minutes, not weeks — without making you sign in every half hour.

What we don't claim. V-Secrets is not SOC 2 certified and decrypts server-side, which means we technically can read your values. Anyone telling you otherwise about a product at this stage is overselling. Zero-knowledge encryption — where the server mathematically cannot decrypt — is in development. Until it ships, this page won't pretend otherwise.

Pricing