DOCS
How Dotkeep works
Everything about projects, secrets, sharing, settings and how your data is kept safe.
What Dotkeep is
Dotkeep is a vault for the secrets your projects depend on: API keys, access tokens, webhook URLs, database URLs and environment variables. You keep them in one place, organised by project and environment, instead of scattering them across chat messages, notes and loose .env files.
- Organise secrets into projects, each with local, staging and production values.
- Values are encrypted before they are stored, and never shown in lists.
- Every view, change, import and export is written to an audit log.
- Share a project with teammates as an editor or a viewer.
Projects and secrets
A project is a folder for one app or service. Each project holds secrets. A secret has:
| Field | What it is |
|---|---|
| Name | Something like DATABASE_URL, up to 80 characters. |
| Environment | Local, Staging or Production. |
| Type | API key, Access token, Webhook URL, Database URL, Environment variable or Other. |
| Value | The secret itself. Encrypted, up to 10,000 characters. |
| Description | Optional notes, up to 500 characters. Not encrypted, so never put a value here. |
The same name can exist once per environment, so DATABASE_URL can have a local, a staging and a production value, but not two production ones. In a project, the Environments view shows one row per secret name with a column for each environment, and marks the gaps so you can add what is missing.
Limits: 100 projects and 1,000 secrets per account.
How your data is protected
| Protection | How it works |
|---|---|
| Encrypted at rest | Each value is encrypted with AES-256-GCM before it reaches the database. Only ciphertext is stored. |
| Unique per value | Every value gets its own random IV, so the same secret saved twice looks different in the database. |
| Tamper-proof | If anyone edits the stored ciphertext, decryption fails instead of returning wrong data. |
| Bound to its owner | The encryption is tied to your account and the secret. A ciphertext copied onto another secret will not open. |
| Hidden by default | Lists never contain values. A value is fetched only when you press Reveal or Copy, and it hides again after a short time. |
| Private to you | Every query is filtered by owner. Someone else’s ids return “not found”. |
| Abuse limits | Reveal, export and sign-in attempts are rate limited. |
End-to-end encryption
When you turn on end-to-end encryption in Settings, your browser makes a vault key and encrypts each secret value with it before anything is sent. The server stores only ciphertext and a copy of the vault key that is locked by your vault passphrase and by a recovery key. It never receives your passphrase, your recovery key or the vault key, so stored ciphertext and wrapped keys alone do not reveal your browser-encrypted values. This protection depends on your browser receiving trusted application code; a compromised server could send altered code that captures values or keys.
| Topic | How it works |
|---|---|
| Passphrase | Separate from your login password, at least 12 characters. It is asked for once per page load, to unlock the vault in that tab. It never leaves your browser. |
| Recovery key | Shown once when you turn it on. If you forget the passphrase, the recovery key lets you choose a new one. Keep it somewhere safe, away from this browser. |
| Existing secrets | “Encrypt existing secrets” in Settings moves secrets you saved before, version history included, to end-to-end encryption. |
| Reveal, copy, history, export | Work as before. The server hands over ciphertext and your browser opens it. Exports and backups include end-to-end secrets in plain text, like any export. |
What it does not cover
- Lose both, lose the data. If you lose the passphrase and the recovery key, nobody, including us, can recover your secrets.
- Shared projects keep server-side encryption. A teammate has no key to your vault, so a project with end-to-end secrets can’t be shared yet, and an end-to-end secret can’t be moved into a shared project.
- Importing a .env file and restoring a backup are not available while it is on, because they would show the server the values. Export still works.
- Names, environments, types and notes are not encrypted. Only values are. The activity log records that a secret was viewed, never its value.
- The web app has to trust the page it loads. Your browser runs the encryption code that Dotkeep’s server sends, so a compromised server could send altered code. A command-line tool or browser extension would close that gap, and neither exists yet.
- It can’t be turned off yet.
- Your passphrase protects your keys against someone who copies them, so choose a long one. Short ones can be guessed offline.
Working with secrets
| Action | What happens |
|---|---|
| Reveal | Shows the value for the time set in Settings (15 seconds by default), then hides it again. Logged as “Viewed”. |
| Copy | Copies the value to the clipboard without having to show it on screen. |
| Edit | Change the name, environment or type. Leave the value empty to keep the current one. You can also move a secret to another project you own. |
| Bulk edit | Tick several rows to move them, change environment or type, or delete them together, up to 200 at a time. |
| Version history | When a value changes, the old one is kept encrypted (last 20). You can reveal, copy or restore any earlier version. |
| Delete | Asks for confirmation. Deleting a project also deletes every secret inside it. |
Import, export and backup
One environment at a time
Use the import / export menu on the Vault page. Both .env and JSON ({ "NAME": "value" }) are supported. Pick a project and environment, then paste text or choose a file. “Replace” overwrites existing values and keeps the old ones in history. Lines that can’t be read are reported rather than silently skipped.
Whole-vault backup
Back up whole vault downloads all of your own projects and secrets as one JSON file, and Restore backup loads it again. Projects are matched by name and created if missing. Secrets that already exist are skipped, unless you choose to overwrite. Projects shared with you are not included, because they belong to someone else.
Activity log
The Activity page is an audit log of your secrets: created, viewed, edited, value changed, moved, restored, imported, exported and deleted. It records what happened and when, never the value itself, and it stays even after a secret is deleted. The latest 200 events are shown, and each secret also has its own history.
Settings
Settings controls your account and how the vault behaves for you.
| Section | What you can do |
|---|---|
| Profile | Change your display name. Your email is shown but can’t be changed. |
| Password | Enter your current password and choose a new one (8 to 128 characters). Every other device is signed out, and you get an alert email about the change. |
| Vault | Choose how long a revealed secret stays visible: 5, 15 (default), 30 or 60 seconds. It saves as soon as you pick. |
| Where you’re signed in | See your active sessions, sign out a single device, or choose “Sign out everywhere else”. |
| Two-factor authentication | Add a second step to sign-in. See below. |
| End-to-end encryption | Encrypt values in your browser with a passphrase only you know. See “End-to-end encryption” above. |
| Protect secret values | Ask for a code before values are shown. See below. |
| Delete account | Permanently deletes your account, projects, secrets and history. Needs your password and can’t be undone. |
Where you’re signed in
Each session shows a short label such as “Chrome on Windows” and when it started. Dotkeep does not store your IP address or the full browser string. Sessions expire on their own after 7 days.
Two-factor authentication
- Enter your password, then scan the QR code with an authenticator app such as Google Authenticator, Authy or 1Password.
- Type the 6-digit code to switch it on.
- Save the 8 recovery codes shown. They appear only once, and each works a single time if you lose your phone.
After that, signing in needs your password (or Google) and then a code from the app or a recovery code. Five wrong codes in a row cancel the attempt and you start again. A code can’t be reused. Turning 2FA off or generating new recovery codes needs your password and a current code, so a stolen session can’t remove it.
Protect secret values
Available once 2FA is on, and off by default. When enabled, Reveal, Copy and Export ask for a code first. After one correct code you aren’t asked again for 10 minutes. The server enforces it, not just the screen. This is useful on a shared computer where a browser might be left signed in. Turning it off needs your password and a code, and turning 2FA off turns it off too.
Deleting your account
Your sessions, secrets, version history, projects and activity are removed, and your account last. If you are the only admin, make someone else an admin first. You can sign up again later with the same email, but nothing comes back.
Not available yet
These are things Dotkeep doesn’t do today. They’re ideas we’re considering, not promises or dates.
- Changing your email. Your email is fixed for now.
- Dark mode. There is only a light theme.
- Custom tags for organising secrets beyond projects, environments and types.
- Terminal (CLI) access. Pull and push secrets from the command line, for example to load a project’s environment into your shell or CI. For now, use the web app with .env import and export.
- Teams and organisations. Sharing works per project today, with an owner, editors and viewers.
Good to know
- Lost your phone? Sign in with a recovery code, then set up 2FA again.
- Forgot your password? Use “Forgot password” on the sign-in page. A reset email is sent, and you’re alerted when the password changes.
- Used a secret by mistake in a description? Descriptions aren’t encrypted. Edit the secret to remove it.
- Moving to another machine? Use the whole-vault backup, and restore it there.