https://github.com/jasperdevs/shush-vault

Open-source, encrypted secret and API key manager for desktop and CLI
https://github.com/jasperdevs/shush-vault

Last synced: about 1 month ago
JSON representation

Open-source, encrypted secret and API key manager for desktop and CLI

• Host: GitHub
• URL: https://github.com/jasperdevs/shush-vault
• Owner: jasperdevs
• License: mit
• Created: 2026-04-30T02:23:21.000Z (about 1 month ago)
• Default Branch: main
• Last Pushed: 2026-04-30T05:05:36.000Z (about 1 month ago)
• Last Synced: 2026-04-30T05:14:32.364Z (about 1 month ago)
• Language: Rust
• Size: 2.99 MB
• Stars: 0
• Watchers: 0
• Forks: 0
• Open Issues: 0
• Metadata Files:
  • Readme: README.md
  • License: LICENSE

Awesome Lists containing this project

README

          


  


  
🤫 shush vault


  
open-source, encrypted secret and API key management for desktop and CLI.


  


    

    

    

  


  


    Shush Vault is a local-first vault for storing, organizing, importing, and copying secrets and API keys from native desktop apps and a cross-platform CLI.

    The repo is native-first: WinUI 3 for Windows, SwiftUI for macOS, GTK 4 for Linux, and Rust for the CLI/shared vault crate.

  


  
features


  

    

      Feature

      Preview

    

    

      Encrypted local vault for API keys, tokens, and secrets

      

    

    

      Workspaces for projects, clients, and apps

      

    

    

      Environment labels like Dev, Staging, and Prod

      

    

    

      Search, filters, and masked values by default

      

    

    

      Add, edit, delete, and copy secrets quickly

      

    

    

      Provider, notes, and metadata for each secret

      

    

    

      .env import with preview, errors, and conflict handling

      

    

    

      CLI for init, add, list, copy, import, and export

      

    

  

  
recommended codebase


  

    

      Layer

      Choice

      Why

    

    

      Desktop shell

      Native per OS

      WinUI 3 for Windows, SwiftUI for macOS, GTK/libadwaita for Linux. No Electron.

    

    

      Core logic

      Rust vault core plus matching .NET adapter

      Shared encrypted vault format using PBKDF2-SHA256 and AES-256-GCM so the Windows app and CLI can read the same vault file.

    

    

      CLI

      Rust binary with clap

      Fast startup, easy distribution, and direct reuse of the vault crate.

    

    

      UI

      OS-native UI

      Each platform uses its own native UI instead of sharing a web shell.

    

    

      Storage

      Encrypted local database

      Store searchable metadata separately from encrypted secret values.

    

    

      Key handling

      Passphrase unlock

      Interactive hidden prompts are preferred. CLI env/argument passphrases are automation paths.

    

  

  
status


  

    

      Area

      Status

    

    

      Windows app

      WinUI 3 app with custom titlebar, monochrome UI, shared encrypted vault storage, CRUD, search/filter, copy, .env import/export, and Velopack packaging.

    

    

      CLI

      shush Rust command for init, add, get, update, delete, list/search, copy, import, and export using the shared encrypted vault core.

    

    

      macOS

      SwiftUI native client with encrypted vault unlock, CRUD, search, copy, .env import/export, and macOS CI tests.

    

    

      Linux

      GTK 4 native client with encrypted vault unlock, CRUD, search/filter, copy, .env import/export, and Linux CI checks.

    

    

      Sync

      The data model is sync-shaped with stable IDs and timestamps. E2E sync transport is not implemented.

    

  

  
starter CLI shape


  
shush init

shush add OPENAI_API_KEY sk-... --workspace my-app --env Dev

shush list --workspace my-app --env Dev --search openai

shush get OPENAI_API_KEY --workspace my-app --env Dev

shush update OPENAI_API_KEY --workspace my-app --env Dev --value sk-new...

shush copy OPENAI_API_KEY --workspace my-app --env Dev

shush import .env --workspace my-app --env Dev --preview

shush import .env --workspace my-app --env Dev --conflict overwrite

shush export --workspace my-app --env Dev --stdout

shush delete OPENAI_API_KEY --workspace my-app --env Dev


  
copy and export expose plaintext by design. Clipboard copies clear after 30 seconds by default, and export requires --stdout or --output.


  
MIT