LPM Vault Download for Mac

FreeOpen source · macOS

Every .env, one vault.

Local-first secrets manager for developers. Edit variables across environments, catch drift before it ships, use them from the CLI.

Download for Mac View on GitHub

Features

Built for the .env you actually have.

One matrix, every environment

Keys as rows, environments as columns. Edit a value where it lives, not in four tabs.

Drift, surfaced

Smart views flag values that differ between environments and keys missing from one of them.

Locked with ⌘L

Values stay masked until you reveal them. Press ⌘L to lock, and Vault locks itself after two idle minutes.

$ lpm env import --env=production .env.production
✓ imported 6 secrets from .env.production (production)
$ lpm run start --env=production
  Env: production (via --env · 6 vault secrets)

Same vault from the terminal

The signed lpm CLI reads the same Keychain items. lpm dev and lpm run load them into your scripts at startup. No account, no daemon, no SDK.

Plain .env in, plain .env out

Import existing files, export any environment. No proprietary format to migrate away from.

How it works

Three steps. No account.

Import what you have, edit in the matrix, and point the CLI at your vault. Your app reads normal environment variables.

  1. Import your .env files

    Create a project, add its environments, and import an existing .env file into each one.

  2. Edit across environments

    Change values in the matrix and spot keys that drift or go missing before you ship.

  3. Connect the CLI

    Copy the vault ID into lpm.json. Then lpm dev and lpm run load the right values for each script.

{  "$schema": "https://cli.lpm.dev/schemas/lpm.json",  "vault": "7f3a1e2c-5b9d-4a8f-b6c1-9b1d2e3f4a5b"}
$ lpm dev
  Env: default (6 vault secrets)
$

Security

Local-first. Your secrets stay in your Keychain.

Vault keeps values in the macOS Keychain on your Mac, shared with the signed lpm CLI. Sync with lpm.dev is optional, and values are encrypted on your Mac before they leave it.

Read the security model Audit the source
  • KeychainStored in the Data Protection Keychain on this Mac only, never in iCloud.
  • AES-256-GCMOptional sync is end-to-end encrypted before upload.
  • Touch IDUnlock with Touch ID or your Mac password. Locks after two idle minutes.
  • Signed updatesNotarized releases. Updates are signature-checked before install.
  • 0 app telemetryThe Mac app sends no analytics. Update checks ask first and send no system profile.
  • MIT / Apache-2.0Open source. Read every line that touches your secrets.

Stop grepping for secrets.

Download for Mac View on GitHub

macOS 14 or later · Apple silicon and Intel · Free, MIT or Apache-2.0