# dotsafe

> dotsafe is a local-first, zero-knowledge secret manager for developers. Secrets are encrypted on your Mac and synced through storage you already own (iCloud Drive, Google Drive, Dropbox, an S3 or R2 bucket, or WebDAV). There is no dotsafe server holding your vault. It ships as a macOS app and a `dotsafe` CLI that share one vault, and AI agents can run commands with your secrets through its MCP server after you approve them, without dotsafe ever handing them a value.

Every page on this site is also plain Markdown: add `.md` to its URL (the home page is https://dotsafe.dev/index.md). [llms-full.txt](https://dotsafe.dev/llms-full.txt) has every docs page in one file.

## Getting started

- [Introduction](https://dotsafe.dev/docs.md): What dotsafe is and how it keeps your secrets.
- [Install](https://dotsafe.dev/docs/install.md): Download the app and the CLI, and activate your license.
- [Quick start](https://dotsafe.dev/docs/quick-start.md): Create a vault, import a .env file and run your app.

## Guides

- [Projects and environments](https://dotsafe.dev/docs/environments.md): Projects, environments, inheritance and references between variables.
- [Secrets and rotation](https://dotsafe.dev/docs/secrets.md): Share one value across environments, rotate it in one step and keep its history.
- [Integrations](https://dotsafe.dev/docs/integrations.md): Rotate keys through OpenAI, Cloudflare and AWS, and push them to Vercel and Workers.
- [AI agents](https://dotsafe.dev/docs/agents.md): Let Claude Code, Cursor and other agents run commands with secrets they never see.
- [Storage and sync](https://dotsafe.dev/docs/storage.md): Keep the vault in a synced folder, an S3 or R2 bucket, or WebDAV.
- [Devices](https://dotsafe.dev/docs/devices.md): Touch ID unlock, adding a Mac with a code, and removing a lost device.
- [Import and export](https://dotsafe.dev/docs/import-export.md): Bring variables in from .env files and other secret managers, and keep them out of git.

## Reference

- [CLI](https://dotsafe.dev/docs/cli.md): Every dotsafe command and its main options.
- [Security](https://dotsafe.dev/docs/security.md): How the vault is encrypted, what the app and agents can see, and what dotsafe never stores.

## More

- [Home](https://dotsafe.dev/index.md): What dotsafe is, in short
- [Pricing](https://dotsafe.dev/pricing.md): The one plan and the FAQ
- [Changelog](https://dotsafe.dev/changelog.md): What changed in each release
- [Source code](https://github.com/starc007/dotsafe): The app, the CLI and the vault format, MIT licensed