MyConfig
English
Download
macOS first · iPhone, iPad and Android coming soon

Keep the file.
Lock the secrets.

MyConfig is an editor that encrypts individual values, such as passwords and API keys, inside config files and notes. Everything else stays readable and shows up in git diff. Even in the app, a value shows only briefly, when you click it.

Download for macOSHow it works

macOS 13.5 or later · Runs on your device, no account

application.yaml
1# Payment service config
2server:
3 port: 8080
4db:
5 host: db.internal.example
6 user: admin
7 password:
8payment:
9 api-key:
10 webhook:
YAML · UTF-8 · LF2 keys · 3 tokens

Click a token to open the action bar, just like in the app. Press Show and the value appears for 30 seconds, then hides itself. All sample values are fake.

AES-256-GCM
Authenticated encryption for every value (default)
Argon2id
128 MiB of memory to slow down guessing
25+
File formats with syntax highlighting
0
Accounts or servers required
  • YAML
  • .env
  • JSON
  • TOML
  • properties
  • Shell scripts
  • 20+ formats
Why encrypt only values

Encrypt the whole file and nobody can read it

Whole-file encryption is safe, but you can no longer see what changed or open it with other tools. MyConfig replaces only the secret values with tokens.

Whole-file encryption
  • git diff cannot show what changed
  • Decrypt everything just to change a port
  • Editors and linters cannot read it
MyConfig (values only)
server:
  port: 8080
db:
  user: admin
  password: mycfg:e:1:prod.a1b2c3d4:Qk3x…Zp9w:end
  • Structure and ordinary values stay readable
  • diff shows only changed lines, and which key locked them
  • Still valid YAML when opened without the app
Reading a token

One line left in your file

An encrypted value becomes a token shaped like the one below. Its fixed prefix and suffix make it obvious, even outside the app, that a secret lives here.

mycfg … end

Start and end of a MyConfig token. If a line gets cut off, the missing end marker gives it away.

e : 1

Mode and format version. e means a Vault key, p means password mode.

prod

Optional human-readable key hint, so people without the app can tell which key it is.

a1b2c3d4

Key ID. The app uses it to find the data key that decrypts this value.

Qk3xVb7c…

Ciphertext, encrypted with AES-256-GCM by default. Change a single character and it will not decrypt.

Getting started

From zero to your first revealed value

  1. Create a Vault

    Set a master password and the app shows a recovery key once. Lose both and nothing can be recovered, so keep the recovery key somewhere safe.

  2. Add files

    Drag files or folders into the sidebar. Files are edited right where they are.

  3. Encrypt a value

    Put the cursor on a value and press ⌘E. The app finds the value on that line and turns it into a token.

  4. Save

    ⌘S. Line endings, BOM and text encoding of the original file are preserved.

  5. Reveal when needed

    Click a token to reveal it, or copy it without looking. It hides itself after 30 seconds.

Features

A capable editor, too

Highlighting and syntax checks

Colors 20+ formats including YAML, JSON, TOML, .env, XML, shell, Dockerfile and Nginx. YAML, JSON, TOML, .env, INI, XML and shell scripts also get syntax checks, with errors and duplicate keys underlined. 81 editor themes.

Library and tabs

Gather scattered config files in virtual folders, or link a real folder as a whole. Tabs and their state come back after restart.

⌘P Quick Open

Library-wide search

Find and replace across the library. Tokens are never touched, and you can filter by key, like key:prod.

⌘⇧F

Secret candidates

Highlights values that look like passwords or tokens but are not encrypted yet, so you can pick them and encrypt in one go.

Multiple keys, key colors

Mix production and development keys in one file. Each key has a color, so you can tell at a glance which value uses which key.

Password-mode tokens

Tokens that decrypt with just a password, no Vault needed. Handy for handing a single value to a colleague without sharing your keys (they decrypt it with MyConfig too).

Insert and change values

Generate and insert a random secret, change a value, or re-encrypt with another key. Every step can be undone with ⌘Z.

⌘⇧I Insert secret

Decrypted export

Decrypt a whole file to a new file or the clipboard, with format-aware quoting. The original stays untouched.

Key handoff

Export a single key as one password-wrapped line (mycfgkey:1:…). The recipient checks the fingerprint and imports it. No server involved.

How keys are managed

Open one lock, get the whole keyring

The Vault is a safe for your keys. Open it with your password or Touch ID, and the data keys inside decrypt your tokens.

Ways to open
Master password
Touch ID
Recovery key
The safe
Vault master keyWraps keys, never encrypts data directly
Data keys (keyring)
dev#5e6f7a8b
Personal#a1b2c3d4
prod · independent lock#9c0d1e2f

Change your password, keep your files

Only the way you open the Vault changes. Data keys stay the same, so encrypted files never need re-encrypting.

Extra lock for critical keys

An "independent lock" key must be unlocked separately even when the Vault is open, and its values stay revealed for 10 seconds at most.

Hard to brute-force

The master password is stretched with Argon2id (128 MiB of memory), making guess-by-guess attacks very slow.

Security

What it protects against, and what it does not

Here is what MyConfig can and cannot do.

Protects againstCovered

  • Leaked config files

    Pushed to a public repo or sent over chat, tokens still cannot be decrypted without your Vault keys.

  • Screen sharing and shoulder surfing

    Values are hidden by default and hide again 30 seconds after you reveal them. A setting can block screen capture while values are revealed.

  • Stepping away

    The Vault locks after 5 minutes of inactivity, or right away on sleep or screen lock.

  • Secrets lingering in the clipboard

    Copied values are cleared after 30 seconds and marked so clipboard managers do not record them.

  • Copying plaintext by accident

    Selecting text and copying gives you the token (ciphertext). Plaintext leaves only through an explicit copy action.

Does not protect againstOut of scope

  • Malware on an unlocked device

    If it can read the screen and memory, no app can stop it. MyConfig offers a "my device may be compromised" guide and master key rotation instead.

  • Losing both password and recovery key

    By design, nothing can be recovered. Keep the recovery key somewhere safe when you create the Vault.

  • Values pushed to git before encryption

    Plaintext in history cannot be erased. Rotate such values when you encrypt them.

  • Guessing length from the token

    A longer token means a longer original value.

Command line

Run your dev server with secrets still encrypted

No need to leave a decrypted copy around. myconfig run decrypts values only at launch and passes them as environment variables.

$ myconfig run --env .env -- npm run dev
# 1. finds tokens in .env and sends them to the MyConfig app
# 2. approval dialog + Touch ID in the app
# 3. runs npm run dev with decrypted values as env vars
#    process.env.DB_PASSWORD → real value
  • Vault keys stay in the app. The CLI sends tokens to the app, which returns only decrypted values after an approval dialog and Touch ID.
  • No plaintext files on disk by default. Only entries that hold tokens become environment variables; your program reads everything else from the original file.
  • Works with most frameworks. Tools that read environment variables before files, like Spring Boot, Next.js, Vite and python-dotenv, need no extra setup.
  • Other commands: export (decrypt to another format), encrypt, set and gen (put values into files), rekey, lint (syntax check), lib (organize the app library), keys list, status.

The CLI is bundled with the app, so there is nothing else to download. How to set it up

Install the command-line tool

The CLI comes inside the app. Set it up once, and it updates to the same version whenever the app updates.

  • Installed with Homebrew? Nothing to do. brew install --cask myconfig sets up the command-line tool too.
  • Installed from the DMG? Set it up once. MyConfig > Install Command Line Tool… in the app menu creates a link to the bundled CLI in a folder you choose.
  • Runs on Apple silicon Macs. On Intel Macs, only the app is available for now.

If you installed from the DMG

  1. Move the app to Applications

    The link points inside the app, so moving the app later breaks it.

  2. MyConfig > Install Command Line Tool…

    Choose a folder on your PATH and press Install Here. It opens at ~/.local/bin the first time.

  3. Check in a new Terminal window
    myconfig status
  4. Add the folder to PATHOnly if not found

    If you chose ~/.local/bin, run this once, then check again in a new Terminal window.

    echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.zshrc

Skill for AI coding tools

Add the skill to Claude Code, and your agent runs services and encrypts plaintext secrets with the myconfig command. Decrypted values never enter the conversation. Codex and Gemini CLI support is on the way.

  • Never asks for a secret in the chat. You type a new value into the app (myconfig ask) or the app generates one (myconfig gen). Only tokens go into the file.
  • Nothing happens without your approval. Requests that decrypt values or change files go through an approval dialog and Touch ID in the app. When you approve, you can let the same work run for 15 minutes without asking again.
  • Install the app and set up the command-line tool first (see "Install the command-line tool" above), then turn on Settings > Security > Accept command-line requests.
  • Claude Code
    claude plugin marketplace add myconfig-app/myconfig-plugin
    claude plugin install myconfig@myconfig
Platforms

macOS first, more to follow

  1. Available
    • macOS13.5 or later
  2. Coming soon
    • iPhone · iPad
    • Android
  3. Later
    • Windows · Linux
FAQ

Questions

Do my values or keys go to a server?

No. The current version runs entirely on your device with no account and no server. Even when you hand a key to someone, you pass along a password-wrapped line yourself, so no server sits in between.

What do people without MyConfig see?

An ordinary config file, with mycfg:e:1:…:end tokens only where the secrets are. The format is unchanged, so other programs read it fine. Decrypting a value requires MyConfig with the right key.

What if I forget my master password?

Open the Vault with the recovery key you got when creating it, then set a new password. If you lose both, no one can recover your data.

How do I share files with my team?

Export a key as one mycfgkey:1:… line and hand it over. The recipient checks the fingerprint and adds it to their Vault. To share just a value without handing over a key, use a password-mode token; the recipient decrypts it with MyConfig.

Which languages does the app support?

The app is available in Korean, English and Japanese.

Commit config files with secrets, without the worry

Your file format stays the same. Only the values get locked.

Download for macOS

macOS 13.5 or later · Runs on your device, no account

Or install with Homebrew

  1. Set up the tapFirst time only
    brew tap myconfig-app/myconfig
    brew trust --tap myconfig-app/myconfig
  2. Install the app (CLI included)CLI on Apple silicon only
    brew install --cask myconfig