UnENVerse Find a guide: importing, command line, nodes

UnENVerse features

UnENVerse is a self-hosted secrets manager: a desktop app, the unv command-line tool and an optional unv-server over one encrypted vault. This page lists what it does, grouped by the job you are trying to get done. Each group links to the guide that goes deeper.

An encrypted vault on your own machine

  • SQLCipher database. The whole vault is one encrypted file. The key is derived from your master password with Argon2id (64 MiB memory, 3 passes) and is never written to disk.
  • No account, no cloud. There is no UnENVerse service. Nothing is uploaded, and there is no analytics.
  • One implementation. Storage, encryption, permissions and rendering live in one Rust library, vault-core, which the app, the CLI and the server all use.
  • Auto-lock after a period you choose, and an optional lock when the window is hidden.
  • Cards that stay masked until you reveal a value.

26 kinds of secret

Each type has its own form and knows its own shape: API keys, passwords, certificates, SSH and GPG keys, age keys, database connections, OAuth clients, signing keys, registry tokens, web sessions (cookies), recovery codes, licence keys, crypto wallets, Wi-Fi networks, secure notes, identity documents and more.

  • Tags, categories (nested with /), environments, scopes, expiry dates and rotation reminders.
  • A version history per entry and a lifecycle timeline.
  • Bundles group the credentials one service needs (a client id, a secret and a webhook key) and copy as one unit.
  • Key pools hold interchangeable credentials for one service and hand out the next one.
  • 2FA on the login. TOTP, HOTP and Steam Guard seeds show live codes next to the entry. Import from Aegis, 2FAS, andOTP, Ente, Bitwarden and Google Authenticator.
  • Generators for secrets, passwords, UUIDs, certificates and SSH keys.

The unv command line

Everything the desktop app can do, unv can do, and the reverse. Output is JSON with stable exit codes, so scripts can branch on the result.

  • Redacted by default. unv get prints a fingerprint and a length, not the value. A vault-wide export to the terminal is refused, not masked.
  • unv exec -- cmd runs a program with secrets in its environment. unv render template --out file fills ${Entry/field} references in a template.
  • unv describe prints the complete command tree, flags, exit codes and redaction rules as JSON.
  • unv doctor checks the vault: database integrity, file modes, audit chain and pools.
  • unv update updates a standalone install from a signed manifest, and verifies the archive before replacing the program.

Read the command-line guide.

Safe for AI agents and scripts

  • An agent that runs unv exec or unv render never reads the secret: it goes into a process or a file, not into the conversation.
  • Fingerprints let an agent notice drift and duplicates (equal fingerprints mean equal secrets) without seeing a value.
  • unv shield -- cmd replaces known vault values in a command's own output.
  • unv blast-radius names the credentials a machine saw and gives one command to rotate exactly those.

See the security page for what this does and does not protect against.

Config projects

A project holds the parts of a real configuration. Fields point at vault entries, so one rotation reaches every file built from them.

  • Eleven project types: WireGuard, Docker Compose, nginx, Kubernetes, Traefik, Apache, HAProxy, Ansible, Postgres, SSH config and generic .env.
  • A config checker finds mistakes across files, such as an nginx proxy_pass to a service that is not defined or two WireGuard peers claiming one address.
  • Projects nest, entries can belong to several, and the sidebar folds big trees shut.
  • The environment-variable name an entry will generate is shown live in the form, with a warning when another entry would collide.

Team server with real access control

  • unv-server serves one vault over HTTP or HTTPS with certificate pinning; self-signed certificates are pinned, never silently trusted.
  • Named users, classes (role templates), API tokens and optional two-factor login.
  • A permission language such as project:web AND NOT env:production, with a live count of the entries a rule matches.
  • Simultaneous edits merge per entry. An official Docker image is published for linux/amd64 and linux/arm64.
  • Calendar feeds for expiry dates and a registry of issued identifiers.

Nodes: deploy configs to your machines

  • An agent on another host watches a config file and reports when it drifts from the vault.
  • Only where you allow it does the agent apply a new file, transactionally, with validation and rollback.
  • Production pushes can require an approval signed on your own machine and bound to the exact bytes.

Read the nodes guide.

History, audit and checks

  • Hash-chained audit log. Every add, update, delete and read is recorded, and tampering breaks the chain. unv audit --verify checks it.
  • Config time machine. Every save snapshots each rendered config with secrets masked. A rotation shows as a changed fingerprint.
  • Health scan for weak, expiring, duplicated, stale or leaked secrets.

Import and export

  • Import .env, YAML, JSON, Bitwarden, 1Password, KeePass, Proton Pass, FIDO Credential Exchange and browser captures (cURL, HAR, cookies, Firefox cookies.sqlite).
  • Export .env, YAML, JSON, Kubernetes Secrets and Terraform variables, with references resolved on the way out.
  • Imports show a preview first and report everything skipped. Read the importing guide.

Backups and recovery

  • Encrypted .vaultbak backups readable by the desktop app.
  • Streamed, age-encrypted recovery packages to a local folder, a NAS or SFTP, with scheduled restore drills.
  • There is no recovery service. A forgotten master password cannot be recovered, so keep a backup and the password somewhere safe.

Platforms and distribution

  • Linux on x86_64 and arm64: AppImage, .deb and .rpm, plus static musl archives of unv and unv-server for Alpine and other distributions.
  • Windows on x64 and Arm: installer and CLI archives.
  • Docker image of unv-server for linux/amd64 and linux/arm64.
  • Every release file has a SHA-256 sum and a Sigstore signature. Download.
  • macOS builds are not published.
  • Free and open source under Apache-2.0.

Download 0.60.0 Read the quickstart