Introduction

dotsafe keeps your environment variables and API keys encrypted on your Mac and syncs them through storage you already own: iCloud Drive, Google Drive, Dropbox, an S3 or R2 bucket, or WebDAV. There's no dotsafe server holding your vault.

It comes as a desktop app and a dotsafe command-line tool. Both open the same vault, so a change in one shows up in the other.

How it works

• Encrypted on your device. Your master password never leaves your Mac. The vault is a folder of encrypted files, and whatever syncs it only ever sees ciphertext.
• Synced by storage you own. Put the vault in a synced folder or a bucket, and every Mac that opens it stays in step. Each one keeps a copy, so dotsafe works offline.
• Injected, not written down. dotsafe run starts your app with its variables set, so there's no .env file to leak or commit.
• Safe for agents. Claude Code, Cursor and other MCP agents can run commands with your secrets after you approve, and dotsafe never hands them a value.

Where to start

1. Install the app and the CLI.
2. Follow the quick start to move a project's .env into a vault.
3. Read Security for what dotsafe protects against, and what it doesn't.