Getting started

GitVaulty keeps complete encrypted files in Git while each person retains their own private identity. Start inside an existing Git repository; there is no hosted service or shared team key to set up.

Install GitVaulty

On macOS—or Linux with Homebrew—install the CLI and its runtime dependencies from the official tap:

brew install divB0/tap/gitvaulty

For Node.js projects, Windows, and CI, install the package globally or run a pinned version with npx. Direct npm use requires Node.js 20 or newer.

npm install --global gitvaulty
npx gitvaulty@latest --version

For a project dependency that every contributor can keep on the same version:

npm install --save-dev gitvaulty

Encrypt your first file

Run create with the logical plaintext path. GitVaulty prepares the repository automatically, creates or restores your private identity when necessary, and opens a private temporary file in your editor.

npx gitvaulty create .env

When the editor closes, GitVaulty encrypts the exact bytes to .env.gitvaulty, verifies the result, and removes the temporary plaintext. Commit the encrypted repository state—not .env itself.

git add .gitvaulty .sops.yaml .agents .env.gitvaulty
git commit -m "chore: initialize GitVaulty"

If .env already exists, use gitvaulty import instead. Import encrypts the existing file, verifies an exact round trip, and excludes the plaintext only in the current clone.

What to do next

• Learn how identities, groups, and encrypted files fit together in core concepts.
• Follow the common development paths in workflows.
• Add teammates safely with the access-control guide.
• Browse every option in the command reference.