Features

Zero-friction secrets for every developer, every stack

Authenticate once. Every project on your machine works forever - no prefix commands, no .env files, no Slack-DM'd credentials.

Core platform

Built for developers and the teams behind them

Core

Passive daemon

A lightweight background client authenticates once via SSO and serves secrets over a local socket. No wrapper commands, no per-session login.

Zero workflow change

F5 in your IDE, npm run dev, dotnet run - secrets inject before your app starts. The developer experience stays exactly the same.

Packages

Language-native packages

Thin clients for .NET, Node.js, Python, Java, Go, and Ruby. Each package injects secrets idiomatically for its runtime.

Identity

SSO on every plan

Google, Microsoft Entra, GitHub, and GitLab from day one. SAML 2.0 and SCIM available on Business and Enterprise tiers.

Teams

Organization management

Projects, environments, RBAC, and immutable audit logs. Built for teams from 2 to 2,000 developers.

Secrets

Secret versioning

Every change is versioned with full rollback. Bulk import and export from .env format, with every export audit-logged.

Integrations

From local dev to production pipelines

CI/CD

CI/CD pipelines

Machine identities for GitHub Actions, GitLab CI, Azure DevOps, CircleCI, Jenkins, and more. Scoped, short-lived access tokens.

K8s

Kubernetes Operator

Sync secrets from Kryptic into Kubernetes Secret objects on a schedule you control. Available on Team plan and above.

API

Public API

A versioned REST API for machine identities: fetch encrypted bundles and write envelopes from your own tooling. Decryption always happens on your side.

IDE

IDE extensions

VS Code, JetBrains, Visual Studio, and Rider plugins show daemon status, environment context, and secret count in the status bar.

One daemon, thin package per language

Passive detection - if the daemon isn't running, your app still starts with existing env vars. Zero production dependency.

Language	Registry	Package	Injection target
.NET / C#	NuGet	krypticdev	IConfiguration
Node.js	npm	krypticdev	process.env
Python	PyPI	krypticdev	os.environ
Java	Maven	krypticdev	Spring Environment
Go	pkg.go.dev	krypticdev	os.Environ
Ruby	RubyGems	krypticdev	ENV
C++	vcpkg	krypticdev	getenv

Installation

dotnet add package krypticdev

Usage

using KrypticDev;

var builder = WebApplication.CreateBuilder(args);

// Add this single line - that is the entire integration
builder.Configuration.AddKryptic();

var app = builder.Build();

// Secrets available via IConfiguration, IOptions<T>, etc.
var dbUrl = builder.Configuration["DATABASE_URL"];

Quick start ->

Security

Security by design, not by checkbox

End-to-end encrypted, open source

Secrets are encrypted in your browser, daemon, or CI runner with AES-256-GCM under an org key our servers never hold. The open-source engine shows exactly how.

Local socket only

Daemon-to-package communication never leaves your machine. Tokens live in the OS keychain; secrets stay in memory only.

Secret scanning

140+ secret patterns detected via pre-commit hooks, CI steps, or the kryptic scan CLI command.

Immutable audit logs

Every action logged with timestamp, actor, and IP. Logs cannot be modified or deleted - exportable as CSV or JSON.

Use cases

How teams use Kryptic

Developer onboarding

Invitation, install daemon, SSO login, clone repo, run. Under 10 minutes to a working local environment. No Slack DMs.

Multi-project developers

Freelancers and agency devs switch between client projects seamlessly. The daemon fetches the right secrets for whichever project is running.

Environment promotion

Override the environment for a single run with KRYPTIC_ENV=staging or a kryptic.json default - no config file changes needed.

Secret rotation

Update a secret in the dashboard. Every daemon, CI pipeline, and K8s operator picks up the new value automatically within minutes.

Incident response

Revoke a user's access instantly. Refresh tokens invalidate within 15 minutes. No secrets on disk - nothing to recover from a lost laptop.

Self-hosted compliance

Run the full platform in your infrastructure from Business up. Air-gapped deployment with offline licence validation on Enterprise, for regulated industries.

Why teams choose Kryptic

	Kryptic	Typical CLI tools
Dev workflow	Passive daemon - zero workflow change	CLI wrapper every run
SSO on free tier	Yes	Often paid add-on
.NET integration	Native IConfiguration	Generic env injection
Open source client	MIT daemon & packages	Varies
Self-hosted	Business and Enterprise	Often unavailable
Works in your IDE	Any - no plugin needed	CLI wrapper or plugin