Local vault · MCP for Claude
Your secrets stay home. Claude uses them without ever seeing them.
Secret Local is an encrypted desktop vault for your passwords and environment variables. Connect it to Claude Code or Claude Desktop: Claude runs your commands with the right keys and never reads their values.
Free · Windows 10 & 11 · No account needed
S3 prod
- Free
- Encrypted at rest
- 100% local
- Signed updates
Why Secret Local
Your API keys deserve better than a forgotten .env file
Developers juggle dozens of secrets. Most of them end up in places that were never meant to protect them.
.env files everywhere
Copied from project to project, synced to the cloud, sometimes committed by mistake. Nobody knows which one is up to date.
Keys pasted into chats
To let an AI run a command, you paste a token into the conversation. It now lives in a transcript you don't control.
No control, no history
Who used which key, when, for what? No answer, and no way to say no before it happens.
Secret Local keeps every value encrypted on your machine and gives Claude a controlled way to use them, with your approval.
Features
Everything around your secrets, in one app
Encrypted vault
Passwords (URL, username, password, 2FA) and free-form environment variables, encrypted with Argon2id and XChaCha20-Poly1305.
Claude through MCP
Claude sees the names, never the values. They are injected into its commands and masked in the output.
Your approval, every time
Mark an entry “verification required”: each use by Claude waits for your approval in the app.
Projects & environments
A full vault per project folder, with prod and dev folders that stay closed to Claude by default.
Shuffled PIN pad
Your PIN is typed on an on-screen pad that is shuffled every time, with recovery codes in case you forget it.
36 built-in tools
Passwords, SSH keys, JWT, TOTP with QR code, hashes, .env conversions, X.509 certificates and more.
Vault health
Weak or reused passwords, duplicates, secrets to renew and known breaches (Have I Been Pwned, k-anonymity).
Encrypted backups
Your own .slvault format with a separate passphrase, automatic backups, CSV and Bitwarden import.
Made for Windows
Windows Hello, locks with your session and on sleep, quick search window, light and dark themes, 6 languages.
Inside the app
See it in action
Real screens of Secret Local, with example data. Click around: the PIN pad, the approval and the tools respond.
S3 prod
Claude + MCP
Claude works with your keys. Never with their values.
Secret Local is an MCP server for Claude Code and Claude Desktop, installed in one click from the app.
- 1
Choose what Claude can use
Mark entries as usable by Claude and restrict them to the project folders you choose.
- 2
Claude asks, you decide
With verification required, the app shows which command wants which entry. Allow or deny.
- 3
Values stay masked
Variables are injected into the command and masked in its output, even when encoded in base64, hex or URL form.
Security
Built like a vault, from the first line
Nothing in clear text on disk
Vault, backups, Claude store and approval requests are all encrypted.
A PIN that is never a key
Your PIN goes through Argon2id, mixed with a device key kept in Windows Credential Manager.
Recovery codes
Generated when you create your PIN, so you never lose access to your data.
Almost no network
Only two optional calls: the breach check (5 characters of a hash) and the update check.
PIN locks per item
Ask for the PIN again before opening a project, a folder or a single entry.
Signed updates
Every update is signed and verified by the app before it is installed.
Free
Free. No account, no ads, no tracking.
Download Secret Local, use every feature and get every update, without paying or signing up.
- Every feature, no limits
- Claude Code and Claude Desktop through MCP
- Automatic, signed updates
- No account, no ads, no telemetry
FAQ
Frequently asked questions
Claude only receives the names of the entries you allowed. When it runs a command, Secret Local injects the values as environment variables of that command and masks them in its output, including when they appear encoded in base64, hex or URL form.
Yes, only for variables you explicitly mark as “readable”, such as a region or a non-sensitive port. Everything else stays masked.
Only on your computer, in your Windows profile, encrypted. We never receive your secrets: there is no cloud sync and no account needed to use the vault.
With XChaCha20-Poly1305. The key is derived from your PIN with Argon2id and combined with a device key kept in Windows Credential Manager, so a copy of the files alone is useless.
Yes. You can download it, use every feature and receive every update without paying anything.
No. The app works without any account, and your vault never leaves your computer.
Take back control of your secrets
Install Secret Local, create your PIN and connect Claude in under two minutes.