keb
1c8d69d957
The right pane kept showing the selected secret when you moved to Vaults or Sources. Now it follows focus: | focus | right pane | |---|---| | Sources | the account (group row), or the subscription / workspace / repo: name, note, ID / profile / path, host or remote, account, web page, vault count | | Vaults | the vault / scope / file: name, note, URI / backend / format, source, web page, counts of loaded secrets, keys, certificates | | Secrets | the secret, as before | | the right pane itself | what it described when you went in; `shift+tab` goes back there | All but the secret use the `Fields` pane (#7), so `j`/`k`, `/` and `y` work on them; `Detail` loses the error message it got in #4, which is now a red "problem" row in `Fields`. A value revealed from a left pane stays in view until hidden, so `space` from any pane still shows it. `tab` from a subscription goes to Vaults as before; only an account row skips to its details. This also changes the startup view: focus starts in Sources, so the right pane describes the first subscription instead of the first secret (golden output updated). Tests that read the secret pane focus Secrets first; a new test walks secret → vault → subscription → into the pane → back, and reveals from Sources. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Karl-Einar Bergstrøm <karl-einarb@outlook.com> Reviewed-on: #9
lazysecrets
A terminal UI for finding, reading and sharing secrets. Inspired by the fantastic lazygit.
Main features
- Read-only: lazysecrets never creates, changes or deletes a secret, so
it's safe to point at production. That's by design and may stay that way.
(
eopens a repo's SOPS or.envfile in your editor, orsops edit; any change is yours.) - Zero setup: uses the logins you already have (
az, the Databricks CLI,sops,git). No config file needed. - Search everything:
ctrl+ssearches every source at once, with fzf-style matching ('exact,^prefix,suffix$,!not), and jumps straight to the result. - Share links:
scopies alazysecrets://link. A colleague opens it with their own access, from the terminal or with a click in the browser or chat. - Careful with values: values stay hidden until you reveal them, and copied values are cleared from the clipboard after 30 seconds.
- Scriptable:
lazysecrets get <link>prints a value for scripts and pipes. - Favourites: star the secrets you use most and get back to them in one key.
- Expiry warnings: secrets, keys and certificates that expire soon are marked.
- Your way: rebind any key, pick a theme, and add custom commands to run on a secret.
- Try it first:
lazysecrets --demoruns on built-in sample data. - Supported platforms: Azure Key Vault, Databricks secret scopes, and SOPS and
.envfiles in your git repos.
Early development: expect rough edges. See CHANGELOG.md for what's new.
Install
On macOS or Linux (arm64 or x86_64):
curl -fsSL https://git.kebcloud.no/keb/lazysecrets/raw/branch/main/install.sh | sh
It installs the latest release
into ~/.local/bin after checking it against the release's checksums.
sh -s -- v0.2.0 installs a given version, LAZYSECRETS_INSTALL_DIR
somewhere else.
lazysecrets looks for a newer release once a day: the footer then shows
↑ v0.2.0, and U shows its changelog and updates in place (or run
lazysecrets update).
Or build it yourself:
go install git.kebcloud.no/keb/lazysecrets/cmd/lazysecrets@latest.
Get started
az login # login with azure cli
lazysecrets # start lazysecrets
lazysecrets --demo # test with demo data
Pick a source on the left, then a vault, then a secret. The keys you'll use most:
| Key | Action |
|---|---|
j/k, h/l, enter, esc |
move, switch panes, drill in, back |
/ |
filter the list you're in |
space |
reveal / hide the value |
y |
copy the value (cleared from the clipboard after 30s) |
ctrl+s |
Go to: search everything and jump there |
f / F |
star / your favourites |
s |
copy a link to share |
? |
every key, searchable |
q |
quit |
Docs
- Keys: every key, Go to, the layout, and rebinding keys
- Azure Key Vault: accounts, permissions, pinned vaults
- Databricks: profiles and Key Vault-backed scopes
- SOPS and .env files: which repos and files, decrypting
- Links: sharing, opening,
lazysecrets getin scripts, and opening links from the browser and chat - Custom commands: run your own commands on a secret
- Config: every option, themes, layered configs, the state file
- Development: building, tests, pull requests and releasing
Privacy
lazysecrets never stores, caches or sends your secret values. It keeps the
names and metadata of what you've loaded in a cache file readable only by
you, to show it at once next time (cache: false turns it off). It talks
only to the services you use it with, and collects no usage data. The one
call of its own is a daily check for a new release on this server, which
updateCheck: false turns off.
AI disclosure
Built with help from an agentic coding assistant. Every change is requested, reviewed and tested by me before it's merged.
License
Copyright © 2026 Karl-Einar Bergstrøm.
lazysecrets is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. See LICENSE.