APP-01 · Passwords and API keys
2Password
Passwords and API keys in one encrypted file on your Mac.
2PasswordA vault for logins, notes and the API keys your projects need. Each project commits a .env.2pw file of references, and 2pw run swaps them for the real values when the process starts. No cloud, no account, no npm dependencies.
What it does
01
Commit references, not secrets
A .env.2pw holds lines like OPENAI_API_KEY=2pw://Dev/OpenAI/credential. It is safe in git because no value is in it.
02
One command runs the project
2pw run -- npm run dev resolves every reference and hands the secrets to that one process as environment variables.
03
Bring an old .env across
2pw import-env reads a plaintext .env, moves keys, tokens and passwords into the vault, and writes the reference file for you.
04
Argon2id and AES-256-GCM
The master password is stretched with Argon2id at 128 MiB. A random 256-bit key encrypts the vault, and changing the password rotates that key.
05
SDKs for Node and Python
read() and loadEnv() in both. The Python SDK is a single stdlib file. Any other language can shell out to 2pw read.
06
The password manager you expect
Vaults, search, TOTP codes and a generator. Copied secrets clear from the clipboard after 45 seconds.
What it doesn't do
- While the vault is unlocked, any program running as your user can ask the agent for a secret, the same way it could read a plaintext .env. 2pw log shows what was read and from which directory.
- There is no recovery. Forget the master password and the vault stays encrypted.
Requirements
- macOS 13 or later
- Node.js 22 or later (24.7+ for Argon2id)
- Xcode or the Command Line Tools to build the app
Network access
None. The app makes no network requests.
Title block
- Sheet
- APP-01
- Version
- 1.0.0
- Minimum macOS
- 13.0
- Code
- JavaScript · Swift · Shell · Python
- Lines
- 3,809
- Test cases
- 25
- Last build
- 25 Oct 2026
- License
- MIT
- Bundle ID
- local.twopassword.app
- Repository
- 2password
Line log
- feb81d5
README: install.sh falls back to ~/Applications when /Applications is not writable
- 918ac1d
Add MIT license and release script
- cabeaa0
Initial version of 2Password: local password and API key manager
