Your secrets
are none of
our business.

Cryptly is a small, open source secrets manager. Every value is encrypted before it leaves your browser — so even we can't read it. Free, forever.

Open the dashboard Read the source

Free forever E2E encrypted Open source

01 DATABASE_URL = ••••••••••••••••••••••

02 STRIPE_SECRET_KEY = ••••••••••••••••

03 OPENAI_API_KEY = ••••••••••••••••••

04 GITHUB_TOKEN = ••••••••••••••••••••

05 RESEND_API_KEY = •••••••••••••••••••

Fig. 01 — the editor, in repose

One column for the blob. None for the value.

Here is our entire secrets table. The blob column is the whole secret, encrypted before it left your browser. There is no second column where the plaintext lives, and no function to produce it on demand.

◦ Encrypted before it leaves your browser
◦ Keys derived from your passphrase, never shared
◦ Re-wrapped for each collaborator, never copied

secrets · 6 rows schema

id	project	blob
68d1...	68cf...	u2l9aFZbk3Pj+Q7WkS9QfwDfMnLvSsC6XgY1xZ8pQrT+88k/4Lr2Nh==
68d2...	68cf...	fWn4pQ0R8sUvZ2Ah6YgKm9XcTdL4PrBv0WsEq1iNy+Oa7uKp3JxCh2==
68d3...	6a14...	cXpLm7nBd+TrKq9aEf1RtYz5OvHgWuJi2SkNc8MxPqDbZ0Af6ExBn4==
68d4...	6a14...	vQr3aZmHy8KfNb1XwLp5SgEdT7CuMi2OkRj0YxBh4VnPq+9SeAcJt6==
68d5...	68cf...	hKt2bNmXc4QrLp8YdWf3OvAi7ZsEu1RkPj9sVy0SgBnTq+5MxCoHa6==
68d6...	6a14...	t2bNmXc4QrLp8YdWf3OvwAi7ZsEu1RkPjqj9Vy0SgBnTq+5MxCoHa6==

The schema is short on purpose.

Fig. 02 — secrets · the whole table

Three ways to bring one teammate, or sixty of them.

Each method re-wraps the project key in the new member's browser; our server moves wrapped bytes only. Pick the one that matches your back-channels.

Channel A · the link

https://cryptly.dev/invite/a3f9-k2m-7bxQ

Channel B · the passphrase

sunrise-otter-42

Send via a different medium than the link.

One click
to GitHub Actions.

The browser re-encrypts each value against the target repository's public key — the same primitive GitHub's own CLI uses — and forwards the ciphertext. We are the courier; GitHub is the recipient.

cryptly vault source

DATABASE_URL ciphertext

REDIS_URL ciphertext

JWT_SIGNING_KEY ciphertext

STRIPE_SECRET_KEY ciphertext

OPENAI_API_KEY ciphertext

SENTRY_DSN ciphertext

cryptly-dev/api recipient

none yet · press the button

Fig. 03 — each value, re-sealed for the recipient

Every save signed. Every change recallable.

The server returns the matching ciphertexts; your browser decrypts and renders them. The audit log is yours; the answer is yours; we supplied only the shelving.

◦ Search by author or substring
◦ Filter by time range or contributor
◦ Decrypted in your tab, never on ours

6/6

Fig. 04 — the ledger, searched

In good hands. A few of the teams on the vault today — and two of them who agreed to say why.

in use today selected

BlueMenu

SignOSH

JobRef

logdash

Signosh ships on a tight calendar. Cryptly quietly removed one of our least-favorite weekly rituals — the Slack-DM secret handoff.

Jerzy Wiśniewski

Co-founder, SignOSH

We wanted end-to-end encryption without reading a whitepaper first. This was it. Onboarding a new engineer is a single link now.

Dominik Mackiewicz

Co-founder, BlueMenu

Fig. 05 — a selection, two of them on the record

People trust us with their keys. We thought you should know that before you did.

Four numbers, honestly counted. No rounding, no asterisks.

the house · today live

users

—

projects

—

diffs

—

stars

—

Fig. 06 — the house, by the numbers

Ready to join them?