Your app needs secrets.Your codebase doesn't.

Cloak replaces copied .env files, credentials pasted in chat, and hand-maintained deploy values with one encrypted source of truth, scoped to the exact service and environment that needs it.

terminal
$ cloak login
$ cloak use --workspace acme --project api --env production
$ cloak run -- npm start
✓ 12 secrets injected into process.env — nothing written to disk

Secrets don't stay secret in a group chat.

A quick ask becomes a production credential copied into a channel, and nobody's quite sure which version is current — or who's reading along.

Built for the moment secrets actually leak

Not when someone breaks in, when someone pastes a key into a thread to unblock a teammate at 6pm on a Friday.

ENCRYPTION & SECURITY

Encrypted, zero-knowledge preview

Secrets stored ciphertext-only with AES-256-GCM. Cloak keeps a safe preview so your team can verify values without exposing raw credentials.

BULK .ENV IMPORT & EXPORT

1-Click .env parsing & export

Drag-and-drop or paste raw .env files to parse and populate entire project environments in seconds. Download or copy anytime.

ENVIRONMENT DIFF

Catch missing production keys

Side-by-side comparison matrix across Development, Staging, and Production. Instantly spot missing or out-of-sync keys before deployment.

VERSION HISTORY & ROLLBACK

Instant 1-click secret rollback

Every key modification creates an immutable version log. Roll back broken API rotations or accidental edits in 1 click.

ROLE-BASED ACCESS (RBAC)

Granular Owner, Admin & Viewer roles

Assign exact responsibilities. Viewers can read secrets without editing; Admins manage team access; Owners control billing.

ZERO-DATA-LOSS FREEZING

Non-destructive workspace protections

Plan downgrades pause CLI access without EVER deleting projects, secrets, or team members. Everything instantly unfreezes upon resubscription.

One shape, every service

A workspace holds your team. A project is one deployable service. Each project mirrors the environments it actually ships to. Nothing more to model.

See the full data model →
Cloak resource hierarchy
Workspace
└── Project
     ├── development
     │    ├── DATABASE_URL
     │    └── RESEND_API_KEY
     └── production
          ├── DATABASE_URL
          └── RESEND_API_KEY

Move your first secret in under five minutes

Free for solo projects. Upgrade when your team needs to share access.