Prompt Software · Passwords and API keys
Hidewell
Passwords and API keys in one encrypted file on your Mac.
A vault for logins, notes and the API keys your projects need. Each project commits a .env.2pw file of references, and 2pw run swaps them for the real values when the process starts. The vault is one encrypted file on your Mac and needs no account.
- Encryption
- AES-256-GCM
- Key derivation
- Argon2id, 128 MiB
- Clipboard clears
- 45 s
- SDKs
- Node.js, Python
What it does
Commit references, not secrets
A .env.2pw holds lines like OPENAI_API_KEY=2pw://Dev/OpenAI/credential. It is safe in git because no value is in it.
One command runs the project
2pw run -- npm run dev resolves every reference and hands the secrets to that one process as environment variables.
Bring an old .env across
2pw import-env reads a plaintext .env, moves keys, tokens and passwords into the vault, and writes the reference file for you.
Argon2id and AES-256-GCM
The master password is stretched with Argon2id at 128 MiB. A random 256-bit key encrypts the vault, and changing the password rotates that key.
SDKs for Node and Python
read() and loadEnv() in both. The Python SDK is a single stdlib file. Any other language can shell out to 2pw read.
The password manager you expect
Vaults, search, TOTP codes and a generator. Copied secrets clear from the clipboard after 45 seconds.
Good to know
- While the vault is unlocked, any program running as your user can ask the agent for a secret, the same way it could read a plaintext .env. 2pw log shows what was read and from which directory.
- There is no recovery. Forget the master password and the vault stays encrypted.
System requirements
- macOS 13 or later
- Mac with Apple silicon
- Node.js 22 or later (24.7+ for Argon2id)
Network access
None, apart from the licence check about once a month.
Articles about this product
More from the same line
Folder compare and sync
Mirrorline
Compare two folders side by side and sync them on your terms.
macOS 14+View
Disk space analyzer
Spacewalk
See what fills your Mac's disk, then clear out large files one card at a time
macOS 14+View
Batch file renamer
Namesmith
Rename batches of files in chained steps and check every new name before it applies
macOS 14+View