Vaultix Docs

Documentation

Vaultix is an encrypted secret and password manager for modern teams. Manage environment variables and a shared password vault, inject secrets with the CLI, and autofill passwords with the browser extension — all with passwordless login.

Passwordless login

Sign in with an email magic code. Your password vault is zero-knowledge, protected by a master password.

CLI Driven

Inject secrets directly into your processes. No more .env files on disk.

🚀 Key Features

  • Encrypted Vaults & Passwords

    Content is encrypted with per-vault / per-entry keys (Libsodium XChaCha20-Poly1305); the database only stores ciphertext.

  • Developer-First CLI

    Standalone tool to inject secrets into your dev environment or CI/CD pipelines at runtime.

  • Role-Based Team Sharing

    Share vaults and individual passwords via public-key cryptography. Owners, moderators, and read-only members are enforced server-side.

  • Browser Extension

    Autofill logins on any site and save new passwords from the page, straight from the Chrome extension.

📦 CLI Installation

1macOS / Linux

curl -fsSL https://raw.githubusercontent.com/tsiresymila1/vaultix/main/cli/install.sh | sh

2Windows (PowerShell)

iwr -useb https://raw.githubusercontent.com/tsiresymila1/vaultix/main/cli/install.ps1 | iex

🛠 Basic Usage

1. Authenticate

Log in to link your local CLI with your Vaultix account.

$vaultix login

2. Initialize Project

Navigate to your project folder and link it to a vault.

$vaultix init

3. Run with Secrets

Inject secrets directly into your application command. Variables are only available in memory.

$vaultix run -- npm start

4. Export .env (Optional)

If you need a traditional .env file for legacy tools.

$vaultix export --env Production > .env

🔐 Security Model

How encryption works

Vaultix uses two models — server-managed vaults (like Infisical) and a zero-knowledge password manager (like 1Password):

  • Login (magic code)

    Passwordless email magic code. Vaults decrypt immediately with a server-managed identity key — ideal for CLI/CI.

  • Vaults (X25519)

    Each vault has a symmetric key (XChaCha20) sealed to each member's identity key. The identity private key is wrapped by the server app key (AES-256-GCM).

  • Password vault (zero-knowledge)

    A master password (Argon2id) unlocks a separate, client-only keypair. Password entries are sealed to it — the server can never decrypt them.

  • Access control

    Role-based permissions (owner / moderator / read-only member) are enforced server-side on every write.