Secrets that work when you press run

Kryptic replaces .env files and CLI wrappers with a background daemon that silently injects secrets into any app - .NET, Node, Python, Java, and more. Authenticate once. Never think about it again.

Get started free See how it works

kryptic-api · developmentdaemon online

# Your workflow stays the same
dotnet run

# Kryptic injects via local socket
DATABASE_URL=postgres://••••@localhost:5432/kryptic
JWT_SECRET=••••••••••••••••
STRIPE_SECRET_KEY=sk_test_••••••••

The AI era

AI agents read everything - including your .env

Coding assistants and autonomous agents index your repository, your shell history and your environment to be helpful. A plaintext .env sitting in the working directory is one prompt away from being pasted into a chat log, a context window, or a third-party API. Kryptic keeps secrets out of files entirely: they live in daemon memory, are injected only into the running process, and never exist on disk for an agent to find.

The problem

Developers shouldn’t trade security for speed

.env files get Slack-DM’d, committed by mistake, and never revoked when someone leaves. CLI-based secret tools help - but only if developers remember to wrap every command. Under deadline pressure, they don’t.

.env sprawl

No audit trail, no rotation, credentials scattered across laptops and chat.

Wrapper fatigue

secret-manager run -- breaks IDE run buttons and gets skipped when you’re in a hurry.

✓

The Kryptic model

One daemon, one SSO login. Secrets arrive before your app starts - invisibly, every time.

How it works

Three steps to zero-friction local secrets

01
Install the daemon
One lightweight background client for Windows, macOS, or Linux. Sign in once with Google or Microsoft.
02
Add the package
A single line in your app plus a committed kryptic.json with your project ID - no secrets in git.
03
Run as usual
F5 in your IDE, npm run dev, dotnet run. Secrets inject over a local socket. No wrapper commands.

Safe to commitkryptic.json

{
  "projectId": "proj_a1b2c3d4e5f6",
  "defaultEnvironment": "development"
}

Project ID only - no tokens, no credentials. Clone the repo and run.

Trust model

Your secrets are encrypted before they leave the machine

Kryptic stores ciphertext it cannot open. Decryption happens on your laptop, in your browser, or on a CI runner that holds a sealed grant. There is no server-side decrypt path to misuse, and plaintext never crosses the network.

Laptop

Your appdotnet run

DaemonDecrypts in memory

Alex, Software Engineer

Pipeline

CI runnerGitHub Actions, GitLab CI

Machine identity decrypts on the runner. The job never fetches plaintext from us.

ciphertext only

Kryptic

Stores envelopes it cannot open. No server-side decrypt path exists.

ciphertext only

Console

Maya, Platform AdminBrowser vault

Values are encrypted in the browser before they are saved. We never receive the org key.

Cluster

Your infrastructureKubernetes operator, servers

A sealed grant on the machine unwraps the org key. Plaintext stays in your environment.

Ciphertext over TLS. This is all Kryptic ever sees.
Plaintext on a local socket. Never on the network.
Org key lives on your devices, not on our servers.

Read the security model

Platform

Built for developers and the teams behind them

Core

Passive daemon

Authenticate once. Every project on your machine works - no prefix commands, no per-session login.

Identity

SSO on every plan

Google, Microsoft Entra, GitHub, and GitLab from day one. Enterprise SAML when you need it.

Language-native packages

Thin clients for .NET, Node.js, Python, Java, Go, Ruby, and more. Idiomatic injection per stack.

Teams

Org & audit

Projects, environments, RBAC, and immutable audit logs - built for teams from 2 to 2,000 developers.

Ops

CI/CD & Kubernetes

Machine identities for pipelines. Operator syncs secrets into your cluster on a schedule you control.

Deploy

Self-hosted option

Run the full platform in your infrastructure. MIT-licensed core; commercial features when you scale.

One daemon, thin package per language

Passive detection - if the daemon isn’t running, your app still starts with existing env vars.

Installation

dotnet add package krypticdev

Usage

using KrypticDev;

var builder = WebApplication.CreateBuilder(args);

// Add this single line - that is the entire integration
builder.Configuration.AddKryptic();

var app = builder.Build();

// Secrets available via IConfiguration, IOptions<T>, etc.
var dbUrl = builder.Configuration["DATABASE_URL"];

Why teams choose Kryptic

	Kryptic	Typical CLI tools
Dev workflow	Passive daemon - zero workflow change	CLI wrapper every run
SSO on free tier	Yes	Often paid add-on
.NET integration	Native IConfiguration	Generic env injection
Open source client	MIT daemon & packages	Varies

Pricing

Simple plans that scale with your team

SSO is included on every tier - not an enterprise upsell. Self-hosting is available from Business up.

Free

€0up to 3 developers

3 projects
Unlimited CI runners
SSO included

Popular

Team

€12per developer / month

Up to 25 developers
K8s operator
90-day audit log

Business

€22per developer / month

SAML & SCIM
Self-hosting available
1-year audit retention

All listed prices exclude VAT. VIES-eligible EU businesses and customers outside the European Economic Area are VAT-exempt. Enterprise self-hosted and unlimited seats, contact us for custom pricing.

Create your free account

Free for up to 3 developers. Authenticate once, then secrets inject when you press run.