Install

Prebuilt binaries are published to GitHub Releases for Linux, macOS, and Windows.

Linux / macOS — download the right archive, extract, and install:

# pick your platform: linux_amd64 · linux_arm64 · darwin_amd64 · darwin_arm64
curl -fsSL https://github.com/zain-23/local-vault/releases/latest/download/lv_linux_amd64.tar.gz \
  | tar -xz lv
sudo mv lv /usr/local/bin/lv

Windows — download lv_windows_amd64.zip from the
latest release,
unzip, and add lv.exe to your PATH.

With Go

go install github.com/zain-23/local-vault@latest

From source

git clone https://github.com/zain-23/local-vault
cd local-vault
go build -o lv .
sudo mv lv /usr/local/bin/lv

The release binaries default to the hosted server. To point lv at a
different server, set SERVER_URL, e.g. export SERVER_URL=https://your-server.

Quick Start

# Initialize vault in your project
cd my-project
lv init

# Unlock once per day — no prompts after this
lv unlock

# Add secrets
lv add DATABASE_URL=postgres://localhost/mydb
lv add API_KEY=sk-live-xxx
lv add STRIPE_KEY=sk_live_xxx --env production
lv add STRIPE_KEY=sk_test_xxx --env development

# Run your project with secrets injected
lv inject -- npm run dev

# Import existing .env file
lv import .env.local

Session Management

LocalVault asks for your passphrase once per day. After that every command works without any prompt — like SSH agent.

# Unlock once
lv unlock
# ✅ Unlocked for 12 hours

# All commands work silently
lv list
lv add KEY=value
lv push
lv sync

# Lock when done
lv lock

# Lock all projects at once
lv lock --all

Each project has its own independent session. Unlocking one project never affects another.

Team Sync

# ── Dev A ──────────────────────────────────────────

lv invite
# ⏳ Waiting for teammate to join...
# 🎉 Teammate joined!
# Now run: lv push

lv push
# ✅ Sent to ahmed-laptop


# ── Dev B ──────────────────────────────────────────

lv join LV-A3F9-X2K1
# ✅ Connected to peer

lv sync
# ✅ Received 3 secret(s)

lv inject -- npm run dev  # ✅ all secrets loaded

Works from anywhere. Different offices, different cities, different networks — the signaling server bridges peers securely. If Dev B is offline when Dev A pushes, messages are stored for 48 hours and delivered when they come online.

Secret Rotation

# Rotate single key
lv rotate API_KEY
# New value: ••••••••
# ✅ API_KEY rotated
# 📤 All peers notified

# Rotate multiple keys
lv rotate API_KEY STRIPE_KEY DATABASE_URL

# Open all secrets in editor — change only what you want
lv rotate --all

# Rotate specific environment
lv rotate --all --env production

Peer Management

# See who has access
lv peers
# 👥 Trusted Peers
#   Peer 1 — ahmed-laptop   (b427d8d8...)
#   Peer 2 — sara-macbook   (c891f2a1...)

# Remove a peer
lv revoke b427d8d8-8b7f-4605-9b5a-f8be956b168d
# ✅ Revoked access for ahmed-laptop

# Rotate after revoking so cached copy is useless
lv rotate --all

Security

Passphrase → Argon2id → AES-256-GCM → vault.json.enc

X25519 Key Exchange → Shared Secret → AES-256-GCM → Encrypted blob

What the signaling server sees:

• Encrypted blobs — cannot read
• Random device IDs — not linked to identity
• IP addresses — only for peer discovery

What never leaves your machine unencrypted:

• Your secrets
• Your passphrase
• Your private keys

All Commands

Next.js

lv import .env.local --env development
lv import .env.production --env production

{
  "scripts": {
    "dev": "lv inject --env development -- next dev",
    "build": "lv inject --env production  -- next build",
    "start": "lv inject --env production  -- next start"
  }
}

Your app code stays exactly the same — process.env.KEY works as always.

What Gets Committed to Git

.lv/identity.pub     ✅  safe to commit
.lv/vault.json.enc   ❌  gitignored automatically
.lv/identity.key     ❌  gitignored automatically
.lv/identity.json    ❌  gitignored automatically