You forget it's there.
Log in once, hit F5 or npm run dev, and your app just has its secrets. No prefix, no ritual, no .env.
The secrets platform that works for you
One login. Zero wrapper commands. Zero .env files. Kryptic is the first secrets platform designed daemon-first around the way developers and the teams behind them actually work.
Who it works for
Set it up once. Every role feels it.
You're happy it's there.
Pipelines, operators, and containers get their own free identities. Your life just got simpler, and your bill did not grow with your infrastructure.
You're care-free because it's there.
Nothing on disk, end-to-end encrypted, and no wrapper command to police across teams. The secure path is the default path.
You audit who did what, when.
Every mutation and every fetch is logged and exportable; secret values never are. Answers in minutes, not incident retrospectives.
You onboard people in two clicks.
SSO and SCIM handle joiners and leavers automatically, and one deactivation revokes every session instantly.
Purpose
What this platform exists to do
Every engineering team has the same three problems. New developers wait days for someone to paste them the right .env file. Secrets drift through Slack threads, wikis, and Git history. And the tools built to fix this ask developers to change their habits: prefix every command, template every config, learn another CLI.
Kryptic was built on a different bet: the best secrets manager is the one nobody notices. You set it up, you paste your secrets into a simple dialog once, and you forget it exists. Your app starts the way it always did, with the secrets it needs, and there is nothing on disk for anything or anyone to steal.
Mechanism
How it works, precisely
The daemon runs quietly in the background (LaunchAgent, systemd, or Windows tray) and keeps its refresh token in the OS keychain. You sign in once per device.
Your repo carries a commit-safe kryptic.json and a single package call at startup: .NET, Node.js, Python, Java, Go, Ruby, or C++.
At startup the package connects to the daemon over an OS-level socket restricted to your user. The daemon fetches ciphertext, decrypts it locally with the org key grant, and injects values into your process. Nothing touches disk.
Explicit environment variables always win, the package is a no-op in production and staging, and if the daemon is not running your app still starts. Zero runtime dependency in production.
That is the whole developer experience. dotnet run, npm run dev, or F5 in your IDE just work. There is no vendor run -- prefix to remember, and no crash when someone forgets it, because there is nothing to forget.
Security
How we make it secure
Keys live with you, not us
The 32-byte organization key is generated in your admin's browser and exists in plaintext only on your devices, runners, and clusters. It reaches authorized people and machines as P-256 sealed-box grants; passphrases are hardened with Argon2id.
AES-256-GCM envelopes, audited fetches
Every value is sealed in an authenticated envelope bound to its secret and environment. Every mutation and every ciphertext fetch lands in the audit log. Values are never logged, anywhere.
Nothing on disk, ever
Decrypted values live in daemon memory for at most five minutes and inside your running process. There is no .env file for malware, backups, or AI coding agents to find.
Verifiable, not just claimed
Encryption engines are Apache-2.0, the daemon and CLI are GPL-3.0. Built-in secret scanning with 222 detection rules catches keys before they reach Git. Cloud is hosted in the EU (Germany), and Business and Enterprise can self-host entirely.
People
Onboarding 1,000 developers is one instruction
IT admins stop distributing credentials. DevSecOps managers stop wondering which ex-employee still has a copy of production keys in a dotfile. Developers get access to exactly the projects and environments they were assigned, through roles, groups, and per-environment grants, and request more access in-product instead of over tickets.
Connect SCIM to your directory and joiners are provisioned automatically, while leavers lose every browser and daemon session the moment HR deactivates them. Google, Microsoft, and GitHub SSO are included on every plan, including Free. SAML 2.0 and SCIM 2.0 are included at Business, at 22 euros per developer per month, a tier where much of the industry still points you to a sales call.
Pricing philosophy
Humans are the only seats
Modern infrastructure pairs every developer with dozens of machines: CI pipelines, preview deployments, Kubernetes pods, background services. Platforms that bill per identity turn every new container into a line item. Kryptic never charges for machine identities, on any plan. They authenticate with their own short-lived credentials, they are scoped, rotatable, and audited, and they cost nothing.
The Free plan covers 3 developers with unlimited machine identities and SSO included. Team is 12 euros per developer, Business is 22 with SAML, SCIM, and the REST API, and both come with a 14-day trial that needs no credit card. For what is included at each price, Kryptic is consistently the cheapest way to do this properly, especially for small teams and especially at scale.
Landscape
Where Kryptic sits among secrets tools
Three different problems, three different tools
| Kryptic (daemon-first) | CLI-wrapper platforms | AI agent proxies | |
|---|---|---|---|
| Built for | Developers, DevOps, IT admins | Developers willing to change workflow | Untrusted autonomous AI agents |
| Daily usage | Run apps as usual, F5 included | Prefix every command or embed an SDK API call | Route agent traffic through a proxy |
| Delivery mechanism | Local daemon + one-line package over a local socket | Wrapper process or cloud API call | Fake tokens swapped at the network edge |
| Server can read secrets | No: ciphertext only, no decrypt path | Varies by vendor and configuration | Yes: the proxy holds real credentials |
| Machine identity cost | Free and unlimited, never a seat | Often billed per identity | Varies |
| Protects against | .env leakage, repo and chat sprawl, stale offboarding | Same goals, with workflow friction | Prompt-injection exfiltration by agents |
The honest version: if your main problem is autonomous AI agents holding their own outbound API credentials, an agent proxy is the right category and complements Kryptic. If your problem is people, laptops, pipelines, and clusters, which is where roughly all software development happens, that is the problem Kryptic was built for, and nobody else built for it this way.
FAQ
Questions teams ask when comparing
How is Kryptic different from Infisical, Doppler, or HashiCorp Vault?
Kryptic is daemon-first: after one login, a background daemon and a one-line language package inject secrets into your app at startup over a local socket, so plain "npm run dev" or F5 in your IDE just works. Infisical and Doppler deliver local secrets primarily through a wrapper command (like "infisical run --" or "doppler run --") or a cloud SDK call, and HashiCorp Vault is low-level infrastructure that needs a platform team to operate. Kryptic is also end-to-end encrypted with no server-side decryption path, includes SSO on the free plan, and never bills machine identities.
Does Kryptic charge for machine identities?
No. Machine identities for CI/CD pipelines, Kubernetes operators, containers, servers, and AI agents are unlimited and free on the Free, Team, and Business plans, and included org-wide on Enterprise. They never consume a developer seat, so the bill scales with headcount instead of infrastructure size.
Do I need to prefix my commands with a CLI wrapper to get secrets?
No. There is no wrapper command in Kryptic. You log in once, your repo carries a commit-safe kryptic.json plus one line of package code, and every normal way of starting your app (dotnet run, npm run dev, F5 in the IDE) receives its secrets automatically from the local daemon.
Can Kryptic servers read my secrets?
No. Kryptic is end-to-end encrypted. Secret values are sealed with AES-256-GCM using an organization key that is generated in your browser and only ever exists in plaintext on your devices, CI runners, and clusters. The servers store ciphertext and have no decryption path for secret values. The encryption engines, daemon, and CLI are open source so this is verifiable.
Does Kryptic protect secrets from AI coding agents?
Yes, at the filesystem level. Coding assistants and autonomous agents index repositories, dotfiles, and shell history. With Kryptic there is no .env file on disk to read or leak: secrets exist as ciphertext in the cloud and as short-lived plaintext inside your running process. This is complementary to network-edge agent proxies (such as Infisical Agent Proxy), which solve a different problem: giving untrusted autonomous agents fake tokens and swapping them at an outbound HTTP boundary.
Is SSO an enterprise feature in Kryptic?
No. Google, Microsoft, and GitHub single sign-on are included on every plan, including the free tier. SAML 2.0 and SCIM 2.0 provisioning are included in the Business plan at 22 euros per developer per month and in Enterprise, without requiring a custom enterprise contract.
How does onboarding and offboarding work at scale?
Onboarding is one instruction: install Kryptic and log in. The developer immediately has the secrets of exactly the projects and environments they were assigned. With SCIM connected to your directory, provisioning and deprovisioning are automatic, and deactivating a user instantly revokes every browser and daemon session. No .env files were ever distributed, so nothing needs to be rotated in a panic when someone leaves.
What happens in production? Does Kryptic add a runtime dependency?
No. The language packages are automatic no-ops in production and staging, and explicitly set environment variables always win. Production and CI delivery run through machine identities, the CI export command, the Kubernetes operator, and the REST API, with decryption happening on your runner or in your cluster.
Where is Kryptic hosted, and can I self-host it?
Kryptic cloud runs in the EU (Hetzner, Germany) as the default and only cloud deployment, operated by Theka.dev, an EU company. Business and Enterprise plans can self-host the full platform with Docker Compose or Helm, including air-gapped deployments on Enterprise. The daemon, CLI, and encryption engines are open source.
What does Kryptic cost compared to other secrets managers?
Free covers 3 developers with unlimited machine identities and SSO. Team is 12 euros per developer per month, Business is 22 euros with SAML, SCIM, and the REST API, and there is a 14-day trial with no credit card. Because machine identities are never billed and SSO is not an upsell, total cost is typically far below per-identity or enterprise-gated competitors, especially for small teams and at scale.