Get started
● End-to-end encrypted terminal-native synced

Remember everything. Reveal nothing.

vult keeps your passwords, API keys and 2FA codes encrypted on your devices and in sync between them. Our servers only ever hold noise: no names, no paths, no idea what you keep.

$ curl -fsSL https://vult.app/install.sh | sh

Apple Silicon and Intel. Run it again any time to update.

Try it in 60 seconds How it stays secret

Free forever for 1 space. No credit card. No browser extension.

~ zsh
01 What we see

Go on, type a secret. Here's all the server gets.

This runs the same scheme vult uses, right in your browser, with a throwaway key your browser just made. Nothing you type leaves this page.

On your deviceplaintext

Change either field and watch the right side change completely.

On our relaywhat we store
node id · HMAC-SHA256(key, path)…
value · AES-256-GCM, padded to 512 bytes…

A 4-digit PIN and a long recovery phrase come out the same size. The path is gone, folders are gone, even the list of what exists is an encrypted node like this one.

02 What goes in

Everything you'd hate to see in a breach.

Anything that fits in a string. Organise it with paths, the way you already think: bank/bmo/pin, work/aws/prod.

Passwords & PINs

Bank logins, door codes, the router password you set once in 2019.

vult put bank/bmo/pin 0420

API keys & tokens

Keep keys out of dotfiles and shell history, and pipe them straight into scripts.

export KEY=$(vult get work/stripe/live)

2FA codes

Store the TOTP secret once; get a fresh code, with its countdown, on every device.

vult get otp/github --cb

Recovery codes

The backup codes every service tells you to "store somewhere safe". This is somewhere safe.

vult put recovery/google "8c2f 19ab …"

Card & account numbers

Copy to the clipboard when a form asks. Never written to disk in the clear.

vult get bank/bmo/account/1234 --cb

Server notes

SSH passphrases, database URLs, the one-liner that fixes prod. Split work and home into spaces.

vult put work:db/prod "postgres://…"
03 Why vult

Three promises. No asterisks.

i.

Secure

Encrypted before it leaves your machine, signed by your key, unreadable everywhere else.

  • Your password never leaves the device
  • Paths and values are both encrypted
  • Relays reject writes you didn't sign
  • Shares are sealed for one person
ii.

Simple

One binary. One login. Your secrets are a tree you already understand.

  • Works offline, syncs when online
  • Locks itself after a few idle minutes
  • No browser extension, no app store
iii.

Ergonomic

Commands that read like sentences, and output that pipes cleanly into your scripts.

  • put, get, ls, rm: that's the core
  • --cb copies instead of printing
  • Plain stdout for $(…) and pipes
04 How it stays secret

We built it assuming our own servers get stolen.

If someone copied our entire database tomorrow, here's what they'd have: random-looking ids pointing at same-sized encrypted blobs. Here's how.

  1. Your password unlocks your private key, on your device

    Stretched with PBKDF2-SHA256 over 100,000 rounds and a salt, it decrypts a private key that only ever travels encrypted. The password itself is never sent anywhere. Changing it re-encrypts that key and signs every device out.

  2. One key splits into many

    HMAC-SHA256 derives separate keys from the private key for encrypting values and for naming nodes, so no key does two jobs.

  3. Paths turn into noise

    Each secret is stored under HMAC(key, space + path). Without your key, nobody can even test a guess like "is there a bank/bmo?"

  4. Values are sealed and padded

    AES-256-GCM with a fresh random nonce per write, padded to a power of two (at least 512 bytes). Sizes give nothing away.

  5. Even the index is hidden

    The map of paths to nodes is itself encrypted, lives at a secret location, and looks exactly like every other node. There's no "file list" to find.

  6. Every write is signed

    Your ECDSA P-256 key signs each change. The relay refuses anything not signed by you, and every device checks every signature.

Security isn't a feature here. It's the whole product.

Every decision in vult starts with one question: what could someone do with our servers if they had them? These are the rules we hold ourselves to.

  1. We can't read your secretsNot won't: can't. Keys are made and kept on your devices.
  2. No backdoor, no master keyThere's no recovery path for us, so there's none for an attacker or anyone who asks us for one.
  3. No home-made cryptoOnly well-studied standards: AES-256-GCM, PBKDF2, HMAC-SHA256, ECDSA and ECDH on P-256.
  4. Nothing to guess from the outsideNames, paths, sizes and structure are hidden along with the values.
  5. Every change is signedYour devices verify every write. Nobody can slip data into your secrets.
  6. Trust is pinnedWhen you share, the other person's key is remembered. If it ever changes, vult refuses and tells you.

The honest part: because we never hold your password or keys, we can't recover your data if you forget the password. Write it down somewhere offline.

05 Every device

Laptop, desktop, server. Same secrets, instantly.

A small background service on each device keeps an encrypted local copy and syncs through a relay. Write on one machine; it's on the others a moment later.

Offline-first

Reads and writes work with no network. Changes sync the moment you're back.

Locks itself

The key is dropped from memory after a few idle minutes (you choose how many with vult config secret ttl 2m).

You decide which devices

vult session ls lists every device signed in. Lost a laptop? vult session logout … cuts it off the relay right away.

06 Hand it over

Share a secret with one person. Nobody in between can read it.

The Wi-Fi password for your partner, the staging key for a teammate, the insurance login for family. One command, read-only, end-to-end encrypted. No links to leak, no "view once" pages, no copies sitting in chat.

07 Get started

From zero to your first secret in five commands.

Real commands, real output. Click through.

1 · install
$ curl -fsSL https://vult.app/install.sh | sh
==> Fetching latest release...
==> Latest version:    2026-11-08-9da7e57
==> Downloading vult.darwin.arm64.2026-11-08-9da7e57.9da7e57...
==> Installing to /usr/local/bin
==> Installation complete!
$ vult start
vult daemon started
$ vult status
daemon:    running (pid 50753)
connected: 1 of 1

On Windows, in PowerShell: irm https://vult.app/install.ps1 | iex. Run the installer again any time to update. vult start sets up a small user-level background service that keeps the encrypted local copy and talks to the relay.

08 2FA, built in

Your authenticator app, minus the phone hunt.

otp/github · demo secret
••••••
OTP code expires in –
$ vult get otp/github --cb
copied the OTP code for otp/github to the clipboard; it expires in –

That's a real code, generated live in your browser from the public demo secret JBSWY3DPEHPK3PXP. Add it to any authenticator app and the codes will match.

  • Code plus countdown, so you never paste one with two seconds left.
  • --cb copies straight to the clipboard and still tells you how long it's good for.
  • Synced like everything else, so a dead phone doesn't lock you out of anything.
  • The 2FA secret is encrypted like any other value, and --raw shows it when you need to move it.
09 Clearance levels

Start free. Upgrade from your terminal.

Every plan gets the same encryption and sync across all your devices. Bigger plans just hold more. Click a plan for a step-by-step guide.

End-to-end encryptionUnlimited devices2FA codes & clipboardSession managementEncrypted sharingOffline access

What's a node? Each secret is one node, and your account uses three for itself (the account, the node list and the encrypted index). So Free holds about 97 secrets, and each person you share with takes one more. Downgrading never deletes anything: you keep reading and deleting, you just can't add more until you're under the limit.

10 Privacy policy, readable

We know your email. That's where it ends.

No ads, no analytics, nothing sold. Here's the complete list, in plain words.

What we can read4 items

  • Your email addressTo verify you and send account mail. Kept in a private database, never on the public relay.
  • Your plan and usage countsHow many nodes, bytes and spaces you use, to apply plan limits. Counts only, not contents.
  • Your signed-in devicesDevice name, OS, IP address and when each was last seen: the list behind vult session ls, so you can sign devices out.
  • Who you share withOnly that you share something with an email, so their devices know whose secrets to look in. Never what, and never how much.

What we can't readeverything else

  • The values you store
  • The names and paths of secrets
  • Your space names
  • How your secrets connect (edges)
  • What you share, with anyone
  • Your password and keys
Invisible on the relay.Nobody browsing the public relay can tell you use vult. Your account there is named by a hash of your email and password, so it can't be looked up or linked back to you.
~@3f9a0c27e1b84d55a6c2f0e9b17d3a48c5e2f1aa
└─ nodes → 7c1e…, a90f…, 22d4…, e5b3…
11 Your move

Stop pasting secrets into your notes app.

Install, sign up and store your first secret in under a minute. Free, for as long as you like.

$ curl -fsSL https://vult.app/install.sh | sh

Apple Silicon and Intel. Run it again any time to update.

Level 1

Get Pro