Stop pasting API keys into chat. Store them in an encrypted vault. Let your AI agent read them safely.
Every time you paste a key into ChatGPT, Claude, or Cursor, it gets logged, stored, and possibly trained on.
Chat history lives on servers. You can't delete it. Your keys are there permanently.
A malicious prompt can trick the AI into sending your keys to an attacker. It's happened.
Some providers use conversations for training. Your keys could end up in model weights.
Screen sharing, screenshots, recordings — once a key is visible, it's compromised.
The AI agent starts a local web server. The user opens a link and pastes keys into a form. Everything is encrypted.
One command: npm install -g @adewale0o/envlock. The agent does this itself.
envlock init creates an encrypted vault on disk. AES-256 encryption. Master password required.
envlock serve spins up a local web server. Agent gets a URL with a random access token.
User sees a clean form with 46 service templates. Picks OpenAI, Stripe, Discord, AWS — whatever they need.
Key goes into the form. Clicks "Save Securely". Key is encrypted and stored. Never touched chat.
envlock get OPENAI_API_KEY — agent gets the key programmatically. Uses it to call the API. Done.
The web UI runs in two modes depending on where the agent and user are.
Agent and user on the same computer. Most secure — nothing leaves the machine.
127.0.0.1:PORTAgent on a server/VPS, user on a different device. Same WiFi or LAN network.
192.168.x.x:PORT"Same network" means devices connected to the same WiFi router, LAN, or private cloud network. For example:
Every secret encrypted at rest with PBKDF2 key derivation
Clean browser form for users — no keys in chat
OpenAI, Stripe, Discord, AWS, and 42 more
JSON API for programmatic access by AI agents
Generate keys, tokens, UUIDs, passwords
Separate dev/staging/prod environments
Validate credential formats automatically
Encrypted backups with one-click restore
Every access logged with timestamp
Find secrets by name, tag, or description
Shell, dotenv, Docker, JSON formats
Encrypted bundles for sharing secrets
Users don't have to figure out field names. Pick a service, fill in the blanks.
Every layer is designed to keep your secrets safe.
All secrets encrypted at rest with AES-256-CBC. Key derived via PBKDF2 with 100,000 iterations.
Web UI requires a random 32-character token. Without it, you see nothing. Token changes every restart.
Web UI only listens on 127.0.0.1 by default. Must explicitly opt-in to expose to network.
Every read, write, delete, and access is logged with timestamp and agent ID.
Vault files are 0600 — only the owner can read or write. No other user on the system can access them.
Set secrets to expire after N seconds. Expired secrets are automatically inaccessible.
Takes 30 seconds. No sign-up, no cloud, no BS.
npm install -g @adewale0o/envlockenvlock initenvlock serve