An encrypted .env vault that never leaves your laptop.
Most secret managers want an account, a server, and a monthly invoice to hold keys you already have on your own machine. NovaBash skips all of that. Your vault is encrypted in the browser, you paste your keys in, and you pull a .env when you need one. Nothing syncs, because there is nowhere for it to sync to.
AES-256-GCM in your browser. There is no server to breach, because there is no server.
Three steps, then you forget it exists
Pick a passphrase
It derives the key that encrypts the vault. We never see it, and there is no reset link, because there is no us to email one. You also get a 24-word recovery phrase as a backup way in, so a forgotten passphrase is not the end of the road. Keep both somewhere you trust.
Paste your keys
Add services by hand, or apply a stack bundle and fill in the blanks. Supabase, Stripe, OpenRouter, whatever your project drags along. It all stays on the device.
Pull a .env
Generate a .env for the environment you are working in and get back to it. Export an encrypted backup so a wiped browser is an annoyance, not a catastrophe.
Why keep it local
A solo dev or a small team does not need a third party babysitting their keys. Keeping the vault on your own machine kills the account, the bill, and the awkward question of who else can read your secrets. The catch is honest, so here it is: you own your backups. Export the encrypted file, keep it somewhere safe, and you can walk it to any machine.
What you actually get
- An encrypted vault in the browser, AES-256-GCM under your passphrase.
- Stack bundles, so you are not staring at a blank .env.
- A separate .env per environment, generated on demand.
- A hash-chained audit log, so you can prove your own history was not quietly edited.
- Encrypted export and import, for backups and new machines.
Open it and have a poke around
It runs entirely in the browser. Pick a passphrase and you are in. No signup, no card, no welcome email three minutes later.