# lazysecrets

A terminal UI for finding, reading and sharing secrets. Inspired by the fantastic lazygit.

## Main features

- **Read-only**: lazysecrets never creates, changes or deletes a secret, so
  it's safe to point at production. That's by design and may stay that way.
  (`e` opens a repo's SOPS or `.env` file in your editor, or `sops edit`;
  any change is yours.)
- **Zero setup**: uses the logins you already have (`az`, the Databricks
  CLI, `sops`, `git`). No config file needed.
- **Search everything**: `ctrl+s` searches every source at once, with
  fzf-style matching (`'exact`, `^prefix`, `suffix$`, `!not`), and jumps
  straight to the result.
- **Share links**: `s` copies a `lazysecrets://` link. A colleague opens it
  with their own access, from the terminal or with a click in the browser
  or chat.
- **Careful with values**: values stay hidden until you reveal them, and
  copied values are cleared from the clipboard after 30 seconds.
- **Scriptable**: `lazysecrets get <link>` prints a value for scripts and
  pipes.
- **Favourites**: star the secrets you use most and get back to them in one
  key.
- **Expiry warnings**: secrets, keys and certificates that expire soon are
  marked.
- **Your way**: rebind any key, pick a theme, and add custom commands to run
  on a secret.
- **Try it first**: `lazysecrets --demo` runs on built-in sample data.
- **Supported platforms**: Azure Key Vault, Databricks secret scopes, and SOPS and `.env` files in your git repos. 

> **Early development:** expect rough edges. See [CHANGELOG.md](CHANGELOG.md) for what's new.

## Install

On macOS or Linux (arm64 or x86_64):

```sh
curl -fsSL https://git.kebcloud.no/keb/lazysecrets/raw/branch/main/install.sh | sh
```

It installs the latest [release](https://git.kebcloud.no/keb/lazysecrets/releases)
into `~/.local/bin` after checking it against the release's checksums.
`sh -s -- v0.2.0` installs a given version, `LAZYSECRETS_INSTALL_DIR`
somewhere else.


lazysecrets looks for a newer release once a day: the footer then shows
`↑ v0.2.0`, and `U` shows its changelog and updates in place (or run
`lazysecrets update`).

Or build it yourself:
`go install git.kebcloud.no/keb/lazysecrets/cmd/lazysecrets@latest`.

## Get started

```sh
az login            # login with azure cli
lazysecrets         # start lazysecrets
lazysecrets --demo  # test with demo data
```

Pick a source on the left, then a vault, then a secret. The keys you'll
use most:

| Key | Action |
|---|---|
| `j`/`k`, `h`/`l`, `enter`, `esc` | move, switch panes, drill in, back |
| `/` | filter the list you're in |
| `space` | reveal / hide the value |
| `y` | copy the value (cleared from the clipboard after 30s) |
| `ctrl+s` | Go to: search everything and jump there |
| `f` / `F` | star / your favourites |
| `s` | copy a link to share |
| `?` | every key, searchable |
| `q` | quit |

## Docs

- [Keys](docs/keys.md): every key, Go to, the layout, and rebinding keys
- [Azure Key Vault](docs/azure.md): accounts, permissions, pinned vaults
- [Databricks](docs/databricks.md): profiles and Key Vault-backed scopes
- [SOPS and .env files](docs/repos.md): which repos and files, decrypting
- [Links](docs/links.md): sharing, opening, `lazysecrets get` in scripts,
  and opening links from the browser and chat
- [Custom commands](docs/custom-commands.md): run your own commands on a
  secret
- [Config](docs/config.md): every option, themes, layered configs, the
  state file
- [Development](docs/development.md): building, tests, pull requests and
  releasing

## Privacy

lazysecrets never stores, caches or sends your secret values. It talks only
to the services you use it with, and collects no usage data. The one call
of its own is a daily check for a new release on this server, which
`updateCheck: false` turns off.


## AI disclosure

Built with help from an agentic coding assistant. Every change is requested, reviewed and tested by me before it's merged.

## License

Copyright © 2026 Karl-Einar Bergstrøm.

lazysecrets is free software: you can redistribute it and/or modify it
under the terms of the GNU General Public License as published by the Free
Software Foundation, either version 3 of the License, or (at your option)
any later version. See [LICENSE](LICENSE).