Repolode
Submit
maxgoedjen

maxgoedjen/secretive

A macOS app that stores SSH keys in the Secure Enclave so private keys cannot be exported, with Touch ID or Apple Watch access control.

View on GitHubWebsite
Stars
9,090
Forks
221
Open issues
177
Last commit
yesterday

What is it?

Secretive is a macOS app for creating and managing SSH keys that are stored in the Mac's Secure Enclave. Because the key material never leaves the enclave, a copy of the private key cannot be extracted from disk by malware or other users on the machine.

Keys can be configured to require Touch ID or Apple Watch authentication before each use. The app sends a notification whenever a key is accessed, so signing activity is visible. For Macs without a Secure Enclave, it can also use a Smart Card such as a YubiKey for signing.

Since Secure Enclave keys cannot be exported or backed up, moving to a new Mac means generating a new set of keys on that machine. Secretive can be installed from GitHub Releases or with Homebrew.

Key features

  • 01Stores SSH private keys in the Secure Enclave so they cannot be exported.
  • 02Requires Touch ID or Apple Watch authentication before a key is used.
  • 03Sends a notification each time a key is accessed.
  • 04Supports Smart Cards such as YubiKey on Macs without a Secure Enclave.
  • 05Installable via direct download or Homebrew.

Use cases

  • Protecting SSH keys for developers on macOS against malware that copies key files.
  • Requiring biometric confirmation for server logins or Git pushes over SSH.
  • Monitoring when SSH keys are used on a Mac.

Quick start

  1. 1

    Install via Homebrew

    brew install secretive
  2. 2

    Or download the latest release from the Releases page

Things to know

  • macOS only, and keys require a Mac with a Secure Enclave or a Smart Card such as a YubiKey.
  • Keys cannot be exported or backed up, so moving to a new Mac means creating new keys.

Topics

#ssh#macos#secure-enclave#security#keychain#touch-id#mac

FAQ

What is secretive?
A macOS app that stores SSH keys in the Secure Enclave so private keys cannot be exported, with Touch ID or Apple Watch access control. Secretive is a macOS app for creating and managing SSH keys that are stored in the Mac's Secure Enclave. Because the key material never leaves the enclave, a copy of the private key cannot be extracted from disk by malware or other users on the machine.
Is secretive free to use? What license does it have?
secretive is open source under the MIT license. Check the license terms before using it in commercial products.
Is secretive still maintained?
Actively maintained. The last commit to secretive was on Oct 18, 2026.
What can I use secretive for?
Protecting SSH keys for developers on macOS against malware that copies key files. Requiring biometric confirmation for server logins or Git pushes over SSH. Monitoring when SSH keys are used on a Mac.
How do I install secretive?
Install via Homebrew: brew install secretive Or download the latest release from the Releases page
Where can I get secretive?
The source code and installation instructions are on GitHub: https://github.com/maxgoedjen/secretive

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects