lazysecrets

A terminal UI for finding, reading and sharing secrets. Inspired by the fantastic lazygit.

Main features

• Read-only: lazysecrets never creates, changes or deletes a secret, so it's safe to point at production. That's by design and may stay that way. (e opens a repo's SOPS or .env file in your editor, or sops edit; any change is yours.)
• Zero setup: uses the logins you already have (az, the Databricks CLI, sops, git). No config file needed.
• Search everything: ctrl+s searches every source at once, with fzf-style matching ('exact, ^prefix, suffix$, !not), and jumps straight to the result.
• Share links: s copies a lazysecrets:// link. A colleague opens it with their own access, from the terminal or with a click in the browser or chat.
• Careful with values: values stay hidden until you reveal them, and copied values are cleared from the clipboard after 30 seconds.
• Scriptable: lazysecrets get <link> prints a value for scripts and pipes.
• Favourites: star the secrets you use most and get back to them in one key.
• Expiry warnings: secrets, keys and certificates that expire soon are marked.
• Your way: rebind any key, pick a theme, and add custom commands to run on a secret.
• Try it first: lazysecrets --demo runs on built-in sample data.
• Supported platforms: Azure Key Vault, Databricks secret scopes, and SOPS and .env files in your git repos.

Early development: expect rough edges. See CHANGELOG.md for what's new.

Install

On macOS or Linux (arm64 or x86_64):

curl -fsSL https://git.kebcloud.no/keb/lazysecrets/raw/branch/main/install.sh | sh

It installs the latest release into ~/.local/bin after checking it against the release's checksums. sh -s -- v0.2.0 installs a given version, LAZYSECRETS_INSTALL_DIR somewhere else.

lazysecrets looks for a newer release once a day: the footer then shows ↑ v0.2.0, and U shows its changelog and updates in place (or run lazysecrets update).

Or build it yourself: go install git.kebcloud.no/keb/lazysecrets/cmd/lazysecrets@latest.

Get started

az login            # login with azure cli
lazysecrets         # start lazysecrets
lazysecrets --demo  # test with demo data

Pick a source on the left, then a vault, then a secret. The keys you'll use most:

Key	Action
j/k, h/l, enter, esc	move, switch panes, drill in, back
/	filter the list you're in
space	reveal / hide the value
y	copy the value (cleared from the clipboard after 30s)
ctrl+s	Go to: search everything and jump there
f / F	star / your favourites
s	copy a link to share
?	every key, searchable
q	quit

Docs

• Keys: every key, Go to, the layout, and rebinding keys
• Azure Key Vault: accounts, permissions, pinned vaults
• Databricks: profiles and Key Vault-backed scopes
• SOPS and .env files: which repos and files, decrypting
• Links: sharing, opening, lazysecrets get in scripts, and opening links from the browser and chat
• Custom commands: run your own commands on a secret
• Config: every option, themes, layered configs, the state file
• Development: building, tests, pull requests and releasing

Privacy

lazysecrets never stores, caches or sends your secret values. It talks only to the services you use it with, and collects no usage data. The one call of its own is a daily check for a new release on this server, which updateCheck: false turns off.

AI disclosure

Built with help from an agentic coding assistant. Every change is requested, reviewed and tested by me before it's merged.

License

Copyright © 2026 Karl-Einar Bergstrøm.

lazysecrets is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. See LICENSE.