KeyStack is a native macOS app that stores every environment variable and API key in the system Keychain, organized by project. When a tool needs a real .env file, activate the project from the menu bar. KeyStack writes it, then deletes it on a timer or the moment your Mac sleeps or locks.
Every project is listed in the menu bar with an Activate button. One click writes a real .env.local (or a filename you choose per project) into the project folder, so Next.js, Docker Compose, and Rails keep working. KeyStack remembers each project's environment and filename, and an optional global shortcut re-activates your most recent project.
Set a global timeout and override it per project. The menu bar shows a live countdown for every active project, and macOS sends a notification about a minute before the file is deleted. Launch at Login and Menu Bar Only mode keep it out of your way.
Active files are removed when your Mac sleeps, the display sleeps, or the screen locks. Quitting with a project still active asks whether to deactivate first. An activity log records every activation and deactivation, and why it happened.
An activated project is a plaintext file for as long as it exists. If KeyStack is force-quit or your Mac loses power while a project is active, the file stays until the next launch, when KeyStack removes it. Version 1.2.0 also writes files with owner-only permissions, warns before overwriting an existing file, and fixes a bug where deleting an active project could leave its file behind.
Read how self-expiring .env files work from the macOS menu bar →
Authenticate once with Touch ID or your Mac login password. Every subsequent reveal reads straight from the Keychain — no repeated prompts. The vault locks automatically the moment you switch to another app.
Organize variables by project and tag each one with Development, Staging, Production, or Custom. Link a shared DATABASE_URL to multiple projects — your API and worker process can both reference the same source of truth.
Point KeyStack at any project folder and it scans for .env, .env.local, .env.development, .env.staging, .env.production, and .env.test. Preview every variable before importing, with duplicates flagged automatically.
Activate a project from the menu bar for a self-expiring .env file, export a permanent file when you choose, generate a keys-only .env.example, or copy values with a 30-second clipboard auto-clear.
Compare your variables across environments side-by-side. Instantly see which keys exist in Development but are missing from Production — the most common source of 'works on my machine' bugs.
Spin up new projects fast with built-in templates for Next.js + Supabase, Next.js + Postgres, Django + Postgres, Rails + Postgres, Node.js/Express, and Firebase. Variable names, descriptions, and secret flags pre-populated.
Set a rotation interval on any secret (30, 60, 90, 180, or 365 days). Overdue variables get a red badge in the list, a 'Needs Rotation' filter surfaces everything due, and macOS notifications take you straight to the variable.
Select multiple variables and act on the whole group: copy as a .env block, export to file, link to another project, schedule rotation, or delete with confirmation. Useful for onboarding environments or cleaning up stale secrets.
Native SwiftUI with full support for macOS Sonoma and later. Keyboard-navigable, searchable, Dark Mode ready, and sandboxed for App Store security. No network requests. No telemetry. Your secrets never leave your machine.
Download from the Mac App Store and launch. Touch ID or your login password unlocks the vault for the session — no account required, no cloud sync, nothing to configure.
Point KeyStack at an existing project folder to scan its .env files, or pick a stack template (Next.js + Supabase, Django + Postgres, and more) to start a fresh project with the right variables pre-populated.
Sort variables by project, tag each one with its environment, mark secrets, and set rotation intervals on the ones that matter. Use the Diff View to confirm nothing is missing across Dev, Staging, and Production.
Activate a project from the menu bar to write a .env.local that deletes itself on a timer. You can also export a file, generate a keys-only .env.example for source control, or copy a KEY=value block that auto-clears in 30 seconds.
You're juggling four side projects, two client apps, and a day job. KeyStack becomes the durable source of truth in the Keychain. Pick a project from the menu bar when you start work, get the real .env.local your tools expect, and let it disappear on a timer or when the Mac locks.
Stripe keys, AWS credentials, Postgres passwords — every one of them should rotate on a schedule, but nobody actually tracks it. KeyStack flags overdue secrets in-app and surfaces them through macOS notifications. The 'Needs Rotation' filter is the dashboard you didn't know you needed.
You don't have a secrets manager because you don't have a platform team. The Environment Diff View shows you which keys exist in Development but are missing from Production — before they cause incidents at 2 AM. Stack templates get a new project running in minutes, not hours.
KeyStack stores all secret values in the macOS Keychain. A plaintext file exists only while a project is activated or after you export one, and activated files delete themselves. There is no sign-up, no cloud sync, and no analytics SDK linked into the binary. Your secrets never leave your machine.
The app is sandboxed, uses the keychain-access-groups entitlement for a single service name, and authenticates via LocalAuthentication (Touch ID or password) once per session.
No. A .env file holds plaintext secrets, and anything committed lands in the repository history, every clone, and every fork. Automated scanners watch public repos for exactly this. Add .env and .env.local to .gitignore before the first commit, and commit a keys-only .env.example so teammates know which variables to set.
Treat every value in it as compromised and rotate or revoke the keys first, because deleting the file in a later commit leaves it in git history. Then remove it from history with git filter-repo or BFG Repo-Cleaner, force-push, and ask collaborators to re-clone. Check each provider's logs for unexpected use of the keys. Rotation is the step that closes the exposure.
They are naming conventions that frameworks load depending on the environment. In Next.js and Vite, .env holds defaults, .env.development and .env.production apply in those modes, and .env.local holds machine-specific overrides that are meant to be git-ignored. Load order varies by framework, so check its docs. None of these files are encrypted, whatever they are called.
No. A .env file is plain text, readable by any process and any user account that can reach the folder, and by anyone who gets hold of the disk or a backup. Full-disk encryption such as FileVault protects a powered-off or locked Mac, but it doesn't stop software running as you. For stronger protection, keep values in an encrypted store such as the macOS Keychain and generate the file only when a tool needs it.
Owner read and write only, which is mode 600 (chmod 600 .env). That stops other user accounts on the machine from reading it. Permissions don't prevent the file from being committed, synced, or zipped, so also git-ignore it and keep project folders out of shared cloud sync directories.
Keep the values in the macOS Keychain instead of in files spread across project folders, turn on FileVault, use a strong login password, and require it after sleep. Write a .env file only for as long as a tool needs it. KeyStack automates that pattern: secrets live in the Keychain, and an activated project's file deletes itself.
Anything running with access to your project folder can read the files in it, including .env, and file contents can be sent to a model as context. Use your assistant's ignore or deny features (for example .cursorignore in Cursor or permission deny rules in Claude Code), keep secrets out of the working directory when you can, and never paste a .env file into a chat.
Don't send it over Slack, email, or chat, because those keep copies. Commit a keys-only .env.example, and share the real values through a password manager or a team secrets manager such as Doppler or Infisical, where each person's access can be revoked. KeyStack is single-user by design, so it isn't the tool for team sharing.
There's no universal interval. Keys that can move money or reach customer data deserve a shorter cycle, low-risk keys can go longer, and any key that may have been exposed should be rotated immediately. Set the reminder when you create the key, or you won't remember. KeyStack supports per-secret intervals from 30 to 365 days and a Needs Rotation filter.
Yes, on request. Activating a project from the menu bar or exporting from the main window writes a real file into the project folder, which is what dev servers and Docker Compose expect. Activated files are written with owner-only permissions and delete themselves. The secrets stay in the Keychain the rest of the time.
On sleep, display sleep, or screen lock, KeyStack deletes it immediately, and it also expires on the timeout you set for the project. If KeyStack crashes or the Mac loses power while a project is active, the file stays on disk until the next launch, when it is cleaned up. While active it is plaintext, so keep timeouts short for production credentials.
No. KeyStack is built for one developer on one Mac. It has no shared vaults and does not inject secrets into CI or servers, so use a cloud secrets manager for those jobs. It needs no account or internet connection, makes zero network requests, and runs on macOS Sonoma and later as a one-time purchase.
KeyStack is a one-time $9.99 purchase on the Mac App Store. No subscription, recurring fee, or account. Runs on macOS Sonoma and later.