# dotsafe > Keep .env secrets encrypted on your Mac and sync them through iCloud, Dropbox, S3 or any storage you own. A CLI, Touch ID unlock and safe access for AI agents. dotsafe is a local-first, zero-knowledge secret manager for developers. Secrets are encrypted on your Mac and synced through storage you already own (iCloud Drive, Google Drive, Dropbox, an S3 or R2 bucket, or WebDAV). There is no dotsafe server holding your vault. It ships as a macOS app and a `dotsafe` CLI that share one vault, and AI agents can run commands with your secrets through its MCP server after you approve them, without dotsafe ever handing them a value. - [Download for macOS](https://github.com/starc007/dotsafe/releases/latest/download/dotsafe.dmg) - [Docs](https://dotsafe.dev/docs.md) - [Pricing](https://dotsafe.dev/pricing.md) - [Changelog](https://dotsafe.dev/changelog.md) - [Source on GitHub](https://github.com/starc007/dotsafe) (MIT license) ## What it does - **Projects and environments.** Variables per environment, with inheritance and `${{ NAME }}` references. `dotsafe run -- ` injects them, so there's no .env file to leak. - **Secrets and rotation.** Link one secret into every environment that uses it and rotate it once, through OpenAI, Cloudflare or AWS, with pushes to Vercel and Cloudflare Workers. - **AI agents.** Claude Code, Cursor and other MCP agents can list names and run commands you approve with Touch ID. Output comes back with values replaced by `[dotsafe:NAME]`, and OpenAI and Anthropic keys go through a local proxy so the process never holds them. - **Storage you own.** iCloud Drive, Google Drive, Dropbox, any synced folder, S3-compatible buckets or WebDAV. Works offline. - **Devices.** Touch ID unlock, adding a Mac with a one-time code, and removing a lost one (the vault is re-keyed). ## Security Names and values are encrypted with XChaCha20-Poly1305 under keys derived from your master password with Argon2id. The only dotsafe server handles licenses and never sees a vault. See [Security](https://dotsafe.dev/docs/security.md). ## Pricing $49 one-time (instead of $79). Everything dotsafe does, on up to 2 Macs. Pay once, every update included. - Up to 2 Macs - Unlimited projects, variables and environments - The dotsafe CLI - iCloud, Google Drive, Dropbox, S3 and WebDAV - Imports from .env, Doppler, Infisical and 1Password - Secrets linked across environments - Key rotation through OpenAI, Cloudflare and AWS - Agent access approved with Touch ID - Lifetime updates Buy on the [pricing page](https://dotsafe.dev/pricing). The license key arrives by email; activate it in the app or with `dotsafe license activate `. There is no free version. ## FAQ ### Where are my secrets stored? In a vault in storage you pick: iCloud Drive, Google Drive, Dropbox, an S3 or R2 bucket, or a WebDAV server. Everything is encrypted on your Mac before it gets there. ### Can dotsafe see my secrets? No. There's no dotsafe server holding your vault. The only server we run handles licenses, and it sees your license key and your Mac's name, nothing else. ### What if I forget my password? You get a recovery key when you create a vault. It's the only way back in, so keep it somewhere safe. We can't reset it for you. ### Do AI agents see my keys? No. Claude Code, Cursor and other agents can run commands with your secrets only after you approve them with Touch ID, and the values are taken out of anything they read back. ### Does it work offline? Yes. Your vault lives on your Mac. If the license can't be checked for 30 days, the app asks you to go online. It never locks you out. ### Is there a free version? No. dotsafe is $49, paid once, for up to 2 Macs. You enter your license key the first time you open the app or the CLI. ### Can I move my license to another Mac? Yes. Remove it in Settings on the old Mac to free the slot, then activate it on the new one. ### Can I bring my existing .env files? Yes. Drop them into the app, or import from Doppler, Infisical and 1Password with the CLI. ### Is it open source? Yes, under the MIT license. The app, the CLI and the vault format are all on GitHub, so you can read every line.