# Slinky

> Slinky keeps secrets out of files. A free, open-source, native Mac app (Apple silicon, macOS 15 Sequoia or later) for API keys and tokens, each project's .env variables, two-step backup codes and recovery keys. Everything is in one encrypted file on the Mac, opened with Touch ID (Secure Enclave), with a printed Recovery Key as the backup. No account and no server. Optional sync: an encrypted copy in a folder the person chooses (iCloud Drive, Dropbox), moved by their own sync service.

## What it does

- **Add Item (⌘N):** paste anything secret; the value turns into dots, Slinky recognizes the service (Stripe, OpenAI, Anthropic, GitHub, Supabase, Resend, AWS and more) and suggests where it goes. Warns about duplicates. Refuses crypto wallet phrases.
- **Projects:** drop a project folder (apps inside it too); Slinky reads its .env files (read-only) and shows, per environment (Local, Preview, Production), what's new, changed, the same, or only in Slinky, saving only what's checked (Update from Folder, undoable). Checks .gitignore, finds key files like .p8, and uses .env.example to show what's missing. Copy an environment as .env lines, or save a names-only .env.example.
- **Recovery:** backup codes that cross themselves off when copied, low-code warnings, and recovery keys with a printed-copy reminder.
- **Quick Access (⌥⌘K):** find and copy from any app. Copies are marked private (concealed/transient), skipped by clipboard history apps, and cleared after 60 seconds.
- **Locking:** Touch ID to open; locks with the screen, on sleep, when idle, and after 12 hours.
- **Import:** 1Password .1pux, or CSV from Apple Passwords, Bitwarden (custom fields too), LastPass, KeePass or a sheet of keys, or a text file; keys found in notes come in too. Rename before importing; Undo takes it back. Passwords are skipped.
- **Sync (optional):** an encrypted copy of the vault in a folder the person chooses (iCloud Drive, Dropbox), moved by their sync service; a second Mac adopts it once with the Recovery Key; changes merge item by item.
- **Sharing (optional):** each Mac has a sharing card (public keys only). Share items or a project's environment with people as a file only their Macs can open, sent any way (AirDrop, Messages, Mail); or keep a project in step with a team through one encrypted, signed file in a folder the team already shares (shared iCloud Drive, Dropbox). Only members can change who's in a project; removing someone makes a new key and lists the keys to replace. Post-quantum (ML-KEM-768, ML-DSA-65) alongside P-256 on macOS 26 and later. People you share with keep what they saw.
- **Keyboard and selection:** ⌘1–⌘7 for each place, ⌘E edit, ⇧⌘C copy as NAME=value, ⌥⌘C copy a name; select several to delete or change together; Edit › Undo.
- **Shortcuts:** Add to Slinky, Copy from Slinky (Touch ID every time; never returns the value), Open Quick Access, Lock Slinky.
- **The `slinky` command:** `slinky run -- npm run dev` injects a project's variables after Touch ID (no .env on disk); `slinky env --export`, `slinky xcconfig`, `slinky run --file NAME` (secret file as a 0600 temp file), `slinky check`, `slinky guard` (pre-commit check), `slinky example` (a names-only .env.example), `slinky open [NAME]`, `slinky lock`, and an optional zsh, bash or fish hook that loads variables on cd. The command is the app's own signed binary; the app checks the caller's signature.
- **AI agents:** an MCP server (`slinky mcp`) for Claude Code, Cursor, Codex and Claude: list_secrets, check_env, request_secret, describe_policy. Names only, never values. Agents run commands through `slinky run`, approved with Touch ID showing the command; live keys, never-for-agents items, shells, inline code, env/printenv, curl/ssh, git push and publishing are refused. Connect in Settings › Command Line & Agents.
- **Health:** exact-match search for saved values in linked projects and their git history, Claude Code/Codex/Cursor conversations and shell history, on the Mac, names and places only; one-click fixes; keys unused for 60 days and values saved twice.
- **Apple developer files:** App Store Connect .p8 keys, certificates, service-account JSON (up to 256 KB) in the vault; save a notarytool keychain profile; app-specific passwords recognised.
- **Rotation and hosts:** "Make New Key on <service>" opens the service's key page and replaces the key wherever it's used; Send to Host pushes a project's variables to Vercel, Netlify, Cloudflare Workers/Pages or Fly.io via their CLIs (values on stdin).
- **Activity:** what was copied, used or imported, when and by whom; names only, inside the vault. Item details show when each was last used.

## What leaves the Mac

Nothing about the person or their vault. Once a day Slinky asks GitHub for the latest release (can be turned off). Only if the person turns on Load icons from websites, it asks each saved website directly for its icon (no third-party icon service). Updates install in place only if signed by Slinky's developer (team B3U6BXA8KP). When the person chooses Send to Host, that host's own command-line tool sends the values they picked to that service. If the person turns on sync, Slinky writes an encrypted copy of the vault (openable only with their Recovery Key or on a Mac they set up) to a folder they chose; their sync service, not Slinky, moves it. If the person shares, Slinky writes encrypted files only the people they picked can open: a share file they send themselves, or a shared project's file in a folder their team syncs. Slinky sends neither.

## Coming next

A Raycast extension, and sync through your own Postgres or S3-compatible storage (still encrypted before it leaves the Mac).

## Compare

- [All comparisons](https://slinkyfiles.com/compare/): the full table, as of October 2026.
- [Slinky vs 1Password](https://slinkyfiles.com/compare/1password/)
- [Slinky vs Apple Passwords](https://slinkyfiles.com/compare/apple-passwords/)
- [Slinky vs Bitwarden](https://slinkyfiles.com/compare/bitwarden/)
- [Slinky vs Doppler](https://slinkyfiles.com/compare/doppler/)
- [Slinky vs Infisical](https://slinkyfiles.com/compare/infisical/)
- [Slinky vs HashiCorp Vault](https://slinkyfiles.com/compare/hashicorp-vault/)
- [Slinky vs .env files](https://slinkyfiles.com/compare/env-files/)
- [Slinky vs dotenvx](https://slinkyfiles.com/compare/dotenvx/)
- [Slinky vs direnv](https://slinkyfiles.com/compare/direnv/)
- [Slinky vs Keychain Access](https://slinkyfiles.com/compare/keychain-access/)

## Guides

- [Where to keep API keys on a Mac](https://slinkyfiles.com/guides/store-api-keys-on-mac/)
- [Keep .env files out of git](https://slinkyfiles.com/guides/keep-env-files-out-of-git/)
- [Where to save two-factor backup codes](https://slinkyfiles.com/guides/save-2fa-backup-codes/)
- [Let AI coding tools use your API keys without seeing them](https://slinkyfiles.com/guides/ai-agents-and-api-keys/)
- [Keep your App Store Connect API key safe](https://slinkyfiles.com/guides/app-store-connect-api-key/)

## Download

- Latest DMG: https://github.com/heyderekj/slinky/releases/latest
- Homebrew: `brew tap heyderekj/slinky https://github.com/heyderekj/slinky && brew install --cask slinky`
- Source (MIT): https://github.com/heyderekj/slinky
- Signed but not yet notarized: first launch needs System Settings › Privacy & Security › Open Anyway.

## Family

- Dinky makes files smaller: https://dinkyfiles.com
- Binky sorts your files: https://binkyfiles.com
- Made by Testament Made, LLC: https://testamentmade.com · derek@testamentmade.com