Vaultlet

A minimal local secret vault CLI for developers, built natively on Deno.

Features

• Encrypted secrets at rest (AES-256-GCM)
• Password-based key derivation (scrypt)
• Clean, minimal ASCII logging
• Native cross-platform clipboard support out of the box (pbcopy, clip, wl-copy, xclip)
• Zero dependencies aside from the Deno Standard Library

Commands

• vaultlet init [--vault <path>] [--force]
• vaultlet set <key>
• vaultlet get <key> [-c|--copy] [--raw]
• vaultlet list
• vaultlet delete <key>
• vaultlet destroy

Installation

From Binary (Recommended for non-Deno users)

Download the latest binary for your platform from the Releases page.

From JSR (Recommended for Deno users)

deno install --global -A -n vaultlet jsr:@mohxmd/vaultlet

Usage

Initialize a new vault:

deno run --allow-env --allow-read --allow-write --allow-run main.ts init

Store a secret:

deno run --allow-env --allow-read --allow-write --allow-run main.ts set github_token

Retrieve a secret directly:

deno run --allow-env --allow-read --allow-write --allow-run main.ts get github_token

Copy a secret to your clipboard:

deno run --allow-env --allow-read --allow-write --allow-run main.ts get github_token -c

Securely wipe the entire vault and config:

deno run --allow-env --allow-read --allow-write --allow-run main.ts destroy

Compilation

You can compile Vaultlet into a standalone executable using Deno:

deno task compile

This will produce a vaultlet binary in the bin/ directory.

Security & Permissions

Vaultlet employs Deno's secure-by-default runtime. The CLI does not use the --allow-all (-A) flag. Network access is completely disabled.

When compiling or running, Vaultlet strictly requires:

• --allow-env: To locate HOME and USERPROFILE for paths.
• --allow-read / --allow-write: To generate and read the local vault.enc and config.toml files.
• --allow-run: To interface with system clipboards (pbcopy, xclip, etc.).

File Locations

• Config: ~/.config/vaultlet/config.toml
• Default vault: ~/.local/share/vaultlet/vault.enc