Keycat 🔑

Never lose your API keys again. Keycat encrypts and backs up all your .env files to your own GitHub Gist — zero servers, zero trust required.

Keycat Dashboard

What is Keycat?

Keycat is a zero-knowledge VS Code extension that helps developers manage, organize, back up, and sync their environment variables (.env files) across multiple projects and environments.

Built after a real problem: The creator lost all local .env keys for his startup when his laptop suffered hardware failure before deployment — requiring tedious manual re-sourcing of every API key and credential.

Features

🔐 Zero-knowledge encryption — AES-256-GCM + Argon2id. Keycat never sees your plaintext keys
📁 Auto-detects all .env files — .env, .env.test, .env.example, .env.production — one profile per file
🔄 Live sync — edit your .env file on disk, Keycat detects the change instantly
☁️ GitHub Gist backup — encrypted vault pushed to your own private Gist
🖥️ Cross-machine restore — new laptop? Connect GitHub, restore everything in seconds
🔑 Dual recovery — master password + 12-word BIP-39 recovery phrase
🌿 Branch-aware profiles — auto-switch .env files when you change git branches
🏢 Monorepo support — each sub-workspace tracked independently

How it works

Your .env files → Keycat reads them → Encrypts with your master password
                                    → Stores encrypted vault locally
                                    → Syncs to your private GitHub Gist

On a new machine:

Install Keycat → Enter master password → Connect GitHub → All projects restored ✓

Architecture

Keycat is a monorepo with 4 packages:

Package	Description
`@keycat/core`	Zero-dependency crypto, vault, parser, sync — runs in Node and browser
`@keycat/ui`	React webview — host-agnostic UI
`vscode-extension`	VS Code host layer — all crypto runs here
`@keycat/cli`	CLI tool (v2, scaffolded)

Security model:

AES-256-GCM encrypts the vault JSON
Argon2id (64MB, 3 iterations) derives keys from passwords — GPU brute-force resistant
Envelope encryption — one random DEK, encrypted twice (password slot + recovery slot)
Changing your password only re-encrypts the 32-byte DEK, not the entire vault
Keycat has zero servers — your encrypted vault goes directly to your own GitHub Gist

Installation

Search "Keycat" in the VS Code Extensions panel, or install via:

code --install-extension MichealPeter.keycat

Getting Started

After installing, look for 🔑 Keycat in the bottom status bar and click it — or press Ctrl+Shift+K (Cmd+Shift+K on Mac) to open the dashboard.

Open any project with a .env file in VS Code
Click the 🔑 Keycat button in the status bar — or press Ctrl+Shift+K (Cmd+Shift+K on Mac)
Set your master password and save your recovery phrase
Connect GitHub for cloud backup (optional but recommended)
Your keys are now encrypted, backed up, and synced

Recover .env* files

After installing, look for 🔑 Keycat in the bottom status bar and click it — or press Ctrl+Shift+K (Cmd+Shift+K on Mac) to open the dashboard.

GitHub session detected, finds backup → shows Restore Screen Page
User enters their original password → decrypts → all projects restored
If no backup found → normal onboarding ✓
"Start fresh" button → skips restore → normal onboarding ✓

Keyboard Shortcut

Action	Windows/Linux	Mac
Open Dashboard	`Ctrl+Shift+K`	`Cmd+Shift+K`

Development

# Install dependencies
pnpm install

# Build all packages
pnpm build

# Run tests
cd packages/core && pnpm test

# Package extension
cd packages/vscode-extension && pnpm package

Requirements: Node.js 20+, pnpm 8+

Contributing

Keycat is open source and welcomes contributions. Please open an issue before submitting a PR for significant changes.

License

MIT — see LICENSE

Built by Micheal Peter · VS Code Marketplace · GitHub