secrets

The three tools

Plaintext never touches the disk

While you edit, the decrypted sheet exists only in /dev/shm — tmpfs, which is RAM — in a private directory, shredded on every exit path including Ctrl+C and an editor crash. Saving encrypts to a temporary file, verifies that it decrypts, and only then replaces the store, so a failed encryption can never truncate your credentials.

Neither front-end ever sees your passphrase. Anything needing one is handed to gpg, which prompts you itself.

Deleting a secret actually deletes it

By default every save shreds the previous version immediately, so a credential you remove is not left in a backup that opens with the same passphrase. Your undo lives somewhere more useful: each save drops a dated copy of the ciphertext into whatever mirror directories you configure — a second disk, a USB stick, a network share. It is encrypted, so an untrusted medium is fine. A mirror that is missing or unwritable is reported and skipped; it never costs you the save.

It tells you which passphrase opens which file

Symmetric GnuPG files carry no hint about the passphrase they were made with, so after a rotation a directory holds a mix that looks identical. Every mirrored copy is tagged with a generation number. secrets mirrors reports which passphrase each file needs, secrets rekey brings older copies forward to the current one, and a location you have stopped writing to can be listed as retired so its copies stay reachable instead of living forever on a stick in a drawer.

Install

tar -xzf secrets.tar.gz
cd secretsuite
sh secrets-install.sh

Installs into ~/.local — no root, nothing system-wide. It checks for gnupg (required) and offers dialog and tk for the front-ends, which are optional. It never overwrites an existing store, config or template, and sh secrets-install.sh --uninstall removes the tools while keeping your credentials.

First run

secrets templates     # what you can start a sheet from
secrets init          # create your first store; choose a passphrase
secrets edit          # add, change and remove — it is just Markdown
secrets scan          # find credential files lying loose on your disks

Put the passphrase somewhere independent of the machine. Nothing can recover it — that is the deal you are making, and it is the right one.

Notes

• POSIX sh and Tcl/Tk. No Python, no runtime, no network calls.
• Multiple stores, each with its own passphrase and its own generation counter.
• Templates are ordinary Markdown holding no secrets — write your own.
• shred cannot guarantee erasure on a journalling filesystem or a wear-levelled SSD. What it removes is ciphertext, so a recovered fragment still needs the passphrase of its generation.