Skip to content
jrpbuilds
Go · SOPS · age · Git

Seal secrets
into Git.
Unlock them only where they run.

Keyseal is the workflow layer around encrypted files: create safely, edit with SOPS, track with Git, render for deployment, inject into processes, and verify the repository before production gets involved.

Explore Keyseal ↗Quick start ↗
secure-shellplaintext: denied
$keyseal add production/platform/app --template laravel
STATESEALED
BACKENDGIT
CRYPTOSOPS / AGE
NO SERVERNO HOSTED VAULTNO PLAINTEXT STARTER FILEJUST A SMALL GO BINARYNO SERVERNO HOSTED VAULTNO PLAINTEXT STARTER FILEJUST A SMALL GO BINARY
01 / THE WORKFLOW

ENCRYPTED FILES, BORING OPERATIONS

One path from creation
to runtime.

SOPS already handles encryption. Keyseal makes everything around it predictable: names, layout, Git operations, deployment rendering and validation all follow the same small set of commands.

01
keyseal add

Create + encrypt

Scaffold a logical secret and encrypt it immediately. Plaintext starter content never lands at the final encrypted path.

02
keyseal edit

Edit with SOPS

Open the encrypted document through the established SOPS editing flow instead of inventing another crypto interface.

03
keyseal commit

Track precisely

Stage only Keyseal-managed files. Status, diff, history and rollback stay scoped to the secret you actually mean.

04
render / exec

Unlock at runtime

Decrypt only at the boundary where the application needs the values: file output, stdout or injected environment variables.

02 / DECRYPTION BOUNDARY

KEEP THE REPOSITORY BORINGLY SAFE

Encrypted in Git.
Useful at the edge.

Read-only paths use the official SOPS Go decrypt library. A CI or deploy machine running render, exec, doctor or verify needs Keyseal, the encrypted repository and age key material, not the external SOPS or age binaries.

Read the docs ↗
runtime.boundaryread-only decrypt
GIT REPOSITORYapp.enc.yaml
ENC[AES256_GCM,data:…]\
ENC[AES256_GCM,data:…]\
ENC[AES256_GCM,data:…]
KEYSEALAGE KEY
RUNTIMEprocess.env
DB_PASSWORD=••••••\
API_TOKEN=••••••••\
APP_KEY=••••••••••
✓ ciphertext remains committed✓ plaintext lifetime is bounded
03 / GIT-AWARE BY DESIGN

SECRETS HAVE HISTORY TOO

Treat encrypted files
like real repository objects.

Keyseal does not hide Git. It gives you narrow, safe operations around the files it manages so you can inspect changes, understand history, commit intentionally and roll back one secret without touching unrelated work.

keyseal statusmanaged changes only
keyseal diff production/appone encrypted file
keyseal history production/appfile-scoped history
keyseal rollback production/app --to <commit>dry-run before restore
04 / PRODUCT BOUNDARY

SMALL TOOL. SHARP EDGES.

Know exactly what
you are installing.

Keyseal Go mascot waving and holding a key
KEYSEAL_IS
  • + a Git-backed secret workflow
  • + a predictable repository layout
  • + a render + exec layer
  • + a CI validation tool
  • + a thin wrapper around proven primitives
KEYSEAL_IS_NOT
  • × a crypto implementation
  • × a Vault replacement
  • × a hosted secret service
  • × a daemon or web UI
  • × a Kubernetes controller
05 / DOCTOR + VERIFY

FAIL BEFORE DEPLOYMENT DOES

Make bad secret config
loud and boring.

`doctor` tells you what is wrong. `verify` turns warnings into a strict CI failure when the repository needs to prove it is ready.

keyseal verifyexit 0
01configurationPASS
02.sops.yaml recipientsPASS
03age key contextPASS
04managed file layoutPASS
05Git repository statePASS
✓deployment postureREADY
06 / COMMAND DECK

ONE SMALL BINARY

The whole workflow
fits in your terminal.

initbootstrap layout + config
addcreate + encrypt
editedit with SOPS
updatekeyssync recipients
statusmanaged Git status
difffile-scoped diff
historysecret history
commitstage managed files only
rollbackrestore from Git
renderdecrypt into runtime formats
execinject environment values
doctor / verifyvalidate before deploy

GIT-BACKED. SOPS-COMPATIBLE. DELIBERATELY SMALL.

Keep the secrets encrypted.
Keep the workflow obvious.

Pre-built Linux and macOS binaries, Debian and RPM packages, amd64 and arm64 releases, and SHA256 checksums are published on GitHub.

Download a release ↗Read the docs ↗
Keyseal mascot