Every environment has every secret
msecrets check fails CI when a value is missing, and apps refuse to start with half an environment.
Encrypted secrets that live in your repository
msecrets
Commit one file. Every value is encrypted to the people and machines of its environment and signed by whoever wrote it. No server, no account, nothing to provision.
npm install --save-dev @msecrets/ui
npx msecrets init
npx msecrets set DATABASE_URL
npx msecrets run -- npm start
1 file
msecrets.json is committed with the code it configures.
age + Ed25519
Standard encryption, post-quantum optional, every value signed.
0 dependencies
Pure TypeScript on
node:crypto. Linux, macOS, Windows, Node.js 20+.
Never worry about secrets again
Access changes cannot drift
Values encrypted for an outdated set of people show up as needs sync until a member runs msecrets sync.
Tampering is detected
Each value is signed by a member of its environment and bound to its slot. Swapped or injected ciphertext is rejected.
Readable diffs, clean merges
git diff shows which values changed and who signed them; independent changes merge without conflicts.
Quick start
npm install --save-dev @msecrets/ui
npx msecrets init # creates msecrets.json and your key (OS keychain when available)
npx msecrets set DATABASE_URL # prompts for the value
npx msecrets # the terminal UI: every secret in every environment
npx msecrets run -- npm start # your app reads the secrets as environment variables
npx msecrets git setup # readable diffs and structural merges
git add msecrets.json .gitattributes
In TypeScript or JavaScript, import the file and get your secrets as a typed object:
import { createClient } from "@msecrets/ts-sdk";
import file from "./msecrets.json" with { type: "json" };
const secrets = createClient(file);
secrets.DATABASE_URL; // string, typed from msecrets.json
How the pieces fit
Author
The CLI and terminal UI create the file, set values, and manage environments and access.
Run
The runtime SDK or msecrets run decrypt the selected environment for your app.
Keys
Private keys stay in your keychain or password manager, and in your CI or container secret store.
Upgrading from msecrets 3?
Version 4 uses a new file format and age instead of OpenPGP. Export your values with v3, then run msecrets init and msecrets import. See the file format page.