Secrets on a separate Git branch

How it fits

git-vault is a Git subcommand that encrypts files into a dedicated orphan branch. Your working tree and application commits stay free of vault configuration and ciphertext.

1. 01

   Encrypt with age

   Encryption uses age, a simple file encryption tool. Recipients are age public keys.

2. 02

   Commit to vault

   git vault save updates the orphan branch without checking it out or touching your index.

3. 03

   Restore on demand

   Decrypt into the working tree when you need plaintext again.

4. 04

   Profiles

   Group secrets by environment such as development and production, each with its own recipients who may decrypt.