Kluis

Version 0.2.1, notarised by Apple

Your secrets,
on your Mac only.

A password vault for the terminal and the desktop. Keys in the Secure Enclave, Touch ID for every read, a backup that survives the Mac, and a page for the people you trust.

Download Kluis How it works

macOS 14 or later · Apple silicon

  • Keys never leave the Secure Enclave
  • No account, no server
  • Open file format
  • Inheritance built in
Vault
All entries14
Servers5
Sudo password3
Database1
Accounts2
Access keys1
Recovery codes6
web.example.orgSudo password · deploy
db-prodDatabase password · app
aws/prodAccess key · AKIA…ZFUG
github.comRecovery codes · 8 left
office wifiNote
web.example.org Server · sudo
Secret
••••••••••••••••
User deploy
Host web.example.org
Agents allowed for ssh
Touch ID · unlock web.example.org for the clipboard
Copied. The clipboard clears in 20 s.
~ $
[kluis] Touch ID · web.example.org for sudo on web
[sudo] password for deploy: ••••••••••••
● nginx.service restarted
~ $
Not on the screen, not in the history, not in a file. Kluis types it into sudo -S on the other side.
claude $
[kluis] agent claude · aws/prod → aws s3 ls
2026-10-26 09:12 backups
2026-10-26 09:12 uploads
[kluis] output masked, 0 secrets shown
The agent never sees the key. Kluis hands it to the command and masks the output. Recovery codes and notes are off limits by default.
Am I backed up?
Vault copy in iCloud Drive, 14 entries
Key file next to the copy
Key in iCloud Keychain
Restore tested
Trusted people
Anna de Vries page 1
Bram Jansen page 2
Chris Bakker page 3
Any 2 of 3 pages and the vault copy open the vault. Nothing less does.

What it does

Built for the Mac, and for the terminal.

One vault, two keys in the Secure Enclave, and nothing that leaves the machine without you.

  • Touch ID for every read

    Secrets are encrypted to a key in the Secure Enclave. Names and descriptions use a second, silent key.

  • Terminal and ssh

    The kluis command reads the same vault. It fills sudo passwords over ssh and answers key passphrases.

  • Backup and inheritance

    A ciphertext copy in iCloud Drive, the key in iCloud Keychain, and printed pages for the people you trust.

  • Safe for AI agents

    Agents run commands with a secret, but never read it. A policy says which entries and commands are allowed.

In the terminal

Same vault, no window needed.

Add, run, ssh. Every read of a secret asks for Touch ID, with the entry and the purpose in the prompt. The vault is a folder of age files, so nothing is locked into Kluis.

$
[kluis] saved hosts/web/sudo
$
[kluis] Touch ID · api/github for gh
✓ Logged in to github.com
$
● nginx.service restarted
$

Trusted people

A page for the day you are gone.

Kluis splits the backup key between two to five people with SLIP-39, a public standard. Each gets one printed page with the words, a code and the steps. Enough pages and the vault copy open the vault. One page alone opens nothing.

Anna
Chris
A printed Kluis recovery page with 33 words and a QR code
Bram
Any 2 of 3 pages open the vault

How it works

Four keys, one of which can leave.

Everything rests on a small set of keys. Here is where each one lives.

  1. Two keys in the Secure Enclave

    One for secrets, with Touch ID. One for names and descriptions, silent, so the app can show them without a prompt. Neither can leave the Mac.

  2. One backup key that can

    Protected by a passphrase in a file, and kept in iCloud Keychain for your other Macs. A new Mac restores from the vault copy with this key alone.

  3. Files, not a database

    Every entry is an age file in a folder. Without Kluis, age and the backup key open them, on any computer.

  4. Pages for trusted people

    The backup key is split into printed pages. Enough pages and the vault copy open the vault after you, nothing less does.

Install

One minute, no account.

DownloadOne archive, signed and notarised.
Move to ApplicationsOpen it. macOS checks the signature.
Four stepsKeys, backup key, Touch ID. Done.

Kluis checks for updates once a day and installs them only when you say so.

Keep your secrets where they belong.

Free for Macs with Apple silicon and macOS 14 or later.

Download Kluis