BlindPass
BlindPass keeps secrets out of files.
A Mac app that keeps API keys, .env variables and recovery codes out of files. Free and open source.
Keys & Tokens
API keys and access tokens your software and AI tools use, with expiry dates and live-key warnings.
Projects
Each app’s .env variables for Local, Preview and Production, out of the project folder.
Recovery
Backup codes that cross themselves off, and recovery keys for the day you need them.
Add Item
Paste it once.
BlindPass files it.
Projects
Every project’s .env,
in one place.
Drop a project folder
BlindPass reads its .env files and sorts them into Local, Preview and Production. It never changes them.
Checks .gitignore
Files git could commit get a warning, before they end up in your repo.
Shows what’s missing
.env.example tells BlindPass what the project needs. Copy an environment as .env lines when your host asks.
Recovery
Backup codes
that keep count.
Only 4 codes left. Click one to copy it.
Quick Access
Your keys,
a shortcut away.
⌥⌘K, from anywhere
Find a key by name and press Return. Try it here: type “stripe” or “codes”.
Private copies
Clipboard history apps skip what BlindPass copies, and it clears itself after a minute.
Shortcuts too
Add to BlindPass, Copy from BlindPass with Touch ID, Quick Access and Lock, right in the Shortcuts app.
Return copies this item. The clipboard clears in 60 seconds.
Locking
Locked unless
you’re using it.
BlindPass
BlindPass wants to unlock your vault.
Touch ID or enter your password to allow this.
Try the lock switch at the top right
BlindPass Recovery Key
You need this key to open your vault on another Mac, or if Touch ID stops working. BlindPass doesn’t keep a copy.
Keep it somewhere safe, away from your Mac.
AI agents
Agents use your keys.
They never see them.
blindpass run
Claude Code, Cursor and Codex start your app through blindpass run. You approve each command with Touch ID, and the keys never reach the chat.
Names, never values
Connected agents can list names and ask for what’s missing. Live keys stay out, and so do shells and tools that send things off your Mac.
Paste it here, not in the chat
When an agent needs a key BlindPass doesn’t have, BlindPass opens with the name filled in, for you to paste.
BlindPass
BlindPass wants to let Claude Code run “npm run dev” with 4 secrets from Acme.
Use Password…Features
Also in BlindPass
Import
Bring keys from 1Password, Apple Passwords, Bitwarden or a CSV. Passwords stay behind.
A 5 MB download
Native Swift and Apple frameworks only. No web views, no dependencies.
5MB
Updates in place
One click, and only if the update is signed by BlindPass’s developer.
Health
Finds your saved keys where they shouldn’t be, with one-click fixes and a check before each commit.
The blindpass command
Run your app with a project’s variables after Touch ID, with no .env on disk. For you and your agents.
Apple developer files
App Store Connect .p8 keys, certificates and service accounts, in the vault. Save a notarytool profile without the .p8 lying around.
Make a new key, send it where it runs
“Make New Key on GitHub…” opens the right page and replaces it everywhere it’s used. Send a project’s variables to Vercel, Netlify, Cloudflare or Fly through their own tools.
Free and open source
MIT licensed, made by Joe LeBoube. Read every line on GitHub.
Compare
Where BlindPass fits
Apple Passwords is great for logins. BlindPass is for everything else you’re told to keep safe.
| BlindPass | Apple Passwords | 1Password | .env files | Doppler or Infisical | Keychain Access | |
|---|---|---|---|---|---|---|
| Made for API keys and tokens | Yes | No | Yes | Partly: Plain text | Yes | Partly: Generic items |
| A project’s .env, per environment | Yes | No | Partly: With its CLI | Yes | Yes | No |
| A command that runs your app | Yes | No | Yes: op run | No | Yes | Partly: Prints values |
| AI agents use keys without seeing them | Yes | No | Partly: With op run | No: In the clear | Partly: Infisical’s proxy | No |
| Recovery codes that cross themselves off | Yes | No | No | No | No | No |
| Stays on your Mac | Yes | Partly: iCloud | No: Their cloud | Partly: Unencrypted | No: Their servers | Yes |
| Opens with Touch ID | Yes | Yes | Yes | No | No | Partly: Password |
| Price | Free, open source | Free | Subscription | Free | Free tier, then paid | Free |
Yes Partly No As of October 2026.
Give your secrets a home.
Free, about 5 MB, and nothing leaves your Mac.
Privacy
Your things, in plain English
Where they live
- One encrypted file on your Mac.
- Opened by your Mac’s Secure Enclave with Touch ID, or your printed Recovery Key.
- Locked means the key isn’t in memory at all.
What leaves your Mac
- Nothing about you or your vault.
- Once a day, a check with GitHub for a newer version. You can turn it off.
- Only if you turn it on, a request to each saved website for its icon.
- When you choose Send to Host, the values you pick go to that host, through its own tool.
- No account, no analytics in the app, no server.
Questions
Good to know
Is BlindPass free?
Yes. BlindPass is free and open source under the MIT License, made by Joe LeBoube.
Where are my things stored?
In one encrypted file on your Mac. The key that opens it is protected by your Mac’s Secure Enclave and opened with Touch ID. A printed Recovery Key is the backup.
Should I keep passwords in BlindPass?
No. Website passwords belong in Apple Passwords. BlindPass is for the other things: API keys, tokens, .env variables, backup codes and recovery keys.
Is there an account or sync?
No account, no server and no sync. BlindPass goes online for a daily check with GitHub for a newer version, which you can turn off, and, only if you turn it on, to ask each saved website for its icon. Time Machine backs up the encrypted file like any other.
What if I lose my Mac?
Restore your backup on a new Mac and open BlindPass with your Recovery Key. BlindPass then sets up Touch ID on that Mac.
Does BlindPass change my project files?
No. It reads your .env files and .gitignore to set things up. It only writes a file when you choose Save .env.example, which has names and no values.
What about clipboard history apps?
Everything BlindPass copies is marked private, so Raycast, Paste, Maccy and others skip it, and the clipboard clears itself after 60 seconds.
Can I bring my keys from another app?
Yes. Import a 1Password export or a CSV from Apple Passwords, Bitwarden or a spreadsheet. BlindPass picks out keys, tokens and codes, and leaves passwords behind.
Will it work with AI coding tools?
Yes. Connect Claude Code, Cursor, Codex or Claude in Settings. Agents see names, never values: they run your app through blindpass run, you approve each command with Touch ID, and live keys stay out. Holding back keys this way keeps them out of the model, not out of a determined program; BlindPass isn’t a sandbox.
Does BlindPass read my files?
Only to help, and only on your Mac. Health looks for exact copies of your saved values in linked projects and their git history, AI tools’ saved conversations and your shell history, and reports names and places. Nothing is sent anywhere.
Can it send my variables to Vercel or Cloudflare?
Yes, when you choose Send to Host in a project. BlindPass uses the host’s own command-line tool, signed in as you: Vercel, Netlify, Cloudflare Workers or Pages, or Fly.io. You see the names first, and Touch ID confirms it.
Does it help with App Store Connect and notarization?
Yes. Keep your App Store Connect .p8 key in BlindPass, add its Issuer ID, and save a notarytool profile from it, so the key isn’t lying in a folder. App-specific passwords are recognised when you paste them.