MeowPass
An open-source, zero-knowledge CLI secret manager that derives keys on-device so the server only ever stores ciphertext it cannot read.
- Zero-knowledge vault, the server stores ciphertext and nothing else
- Team sync in one command, "mp pull" replaces Slack DMs and copy-paste
- Drift detection that can block a bad deploy in CI
MeowPass is an open-source CLI secret manager built around one property: the server never possesses enough information to decrypt your secrets.
The problem
Your team's .env files are never in sync, and nobody knows which secrets are current.
The practical version: a developer joins a project, or just changes machines, and asks which .env file is the current one. The honest answers are usually "ask whoever set it up six months ago" or "check Slack". In between, the real secrets are scattered across Slack messages, local files, notes, and individual machines, and no single copy is authoritative. That is secret sprawl, and configuration drift is what it turns into.
The obvious fix is a central store, but most of them solve sprawl by introducing a service that can read every secret you own in plaintext. MeowPass came from wanting the developer-first version of the fix without making that trade: one place that is authoritative, and a server that cannot read what it holds.
How it works
The master password never leaves the device. It's run through Argon2id to derive a local encryption key, each secret is sealed with AES-256-GCM before it ever touches the network, and the server stores only the resulting ciphertext, a leak yields meaningless bytes. Pulling secrets onto any machine fetches that ciphertext and decrypts it locally, in memory or to a standard .env file.
Features
mp init, one-command setup that imports existing.envfiles, creates a vault, and writes a.meowpass.yamlthat is safe to commit.mp pull, team sync: clone, pull, and the right secrets are in place in seconds.- Multi-environment support, so
.env,.env.local, and.env.productionare each their own environment. mp diff, drift detection that shows what's out of sync per environment, with an--exit-on-driftflag that can block a bad deploy in CI.mp run, in-memory secret injection into a process without writing.envto disk.mp history, versioned changes with one-command rollback to any prior value.- An MCP server exposing 14 tools, so AI coding assistants can deploy with secrets they never see in plaintext.
- An audit log recording who accessed what, when, and from where, built with SOC 2 readiness in mind.
Technology
The CLI is a single static Go binary, cross-platform. The cryptography layer uses Argon2id for key derivation, AES-256-GCM for authenticated encryption, and X25519 for key sharing between team members. A TypeScript SDK (@meowlabs/meowpass) wraps the CLI for Node.js projects, a Next.js dashboard and the MCP server provide the web and AI-assisted surfaces, and the backend is a serverless, ciphertext-only API on AWS Lambda.
Where it stands
MeowPass is open source and built, but early. The cryptography, the CLI, the SDK, the dashboard and the MCP server all work, and the design has not yet been through validation with external users, teams sharing a vault in anger, or real projects beyond my own. Treat the capabilities above as what it does, not as what it has been proven to do at scale.
What's next
Exploring hardware-key (YubiKey / WebAuthn) unlock for the vault and a Terraform provider and Kubernetes operator. Planned: a self-hosted vault option for regulated teams, and secret scanning with pre-commit hooks to catch leaks before they're committed.