Secretive: Protect your SSH keys with your Mac's Secure Enclave (9.1k stars)
What it does
All text below is quoted directly from the project README.
>Secretive is an app for protecting and managing SSH keys with the Secure Enclave.
Why?:
- Safer Storage: The most common setup for SSH keys is just keeping them on disk, guarded by proper permissions. This is fine in most cases, but it's not super hard for malicious users or malware to copy your private key. If you protect your keys with the Secure Enclave, it's impossible to export them, by design.
- Access Control: If your Mac has a Secure Enclave, it also has support for strong access controls like Touch ID, or authentication with Apple Watch. You can configure your keys so that they require Touch ID (or Watch) authentication before they're accessed.
- Notifications: Secretive also notifies you whenever your keys are accessed, so you're never caught off guard.
- Support for Smart Cards Too!: For Macs without Secure Enclaves, you can configure a Smart Card (such as a YubiKey) and use it for signing as well.
- Auditable Build Process: Builds are produced by GitHub Actions with an auditable build and release generation process. Starting with Secretive 3.0, builds are attested using GitHub Artifact Attestation.
- Backups and Transfers to New Machines: Because secrets in the Secure Enclave are not exportable, they are not able to be backed up, and you will not be able to transfer them to a new machine. If you get a new Mac, just create a new set of secrets specific to that Mac.
>brew install secretive
Repository
maxgoedjen/secretive
Repository stats
|Metric|Value|
|:-|:-|
|Stars|9,094|
|Forks|221|
|Last release|v4.0.0 (2026-09-21)|
|Languages|Swift 99.5%, Shell 0.5%|
|Contributors|41|
|AI contributor accounts (Claude / Codex / Cursor / Copilot)|None|
|AI co-authored commits|None|
Main contributor
|Field|Value|
|:-|:-|
|Name|Max Goedjen|
|GitHub|@maxgoedjen|
|Commits to this repo|416 (top contributor)|
|Company / Location|Los Angeles, CA|
|Followers|241|
──────────────────────────────
📌 How many great GitHub repos have you discovered and completely forgotten about?
Don't let another useful tool disappear into your Reddit feed. Get the community's best repos, organized by category, plus key takeaways from real developer discussions, delivered to your inbox twice a week.
📬 Never lose track of great repos again. Subscribe free.
2 points
Mentions
@bcomnes @dhkleung There is an open source app that already implemented it The only issue is the fact that by design you can’t make a backup. Same reason why you store them in the Secure Enclave in the first place. maxgoedjen/secretive
This is from Secretive's README but also applies to the setup described in the article: > Because secrets in the Secure Enclave are not exportable, they are not able to be backed up, and you will not be able to transfer them to a new machine. If you get a new Mac, just create a new set of secrets specific to that Mac. For me, the inability to back up my keys is a dealbreaker.
Secretive: Protect your SSH keys with your Mac's Secure Enclave (9.1k stars) What it does All text below is quoted directly from the project README. >Secretive is an app for protecting and managing SSH keys with the Secure Enclave. Why?: - Safer Storage: The most common setup for SSH keys is just keeping them on disk, guarded by proper permissions. This is fine in most cases, but it's not super hard for malicious users or malware to copy your private key. If you protect your keys with the Secure Enclave, it's impossible to export them, by design. - Access Control: If your Mac has a Secure Enclave, it also has support for strong access controls like Touch ID, or authentication with Apple Watch. You can configure your keys so that they require Touch ID (or Watch) authentication before they're accessed. - Notifications: Secretive also notifies you whenever your keys are accessed, so you're never caught off guard. - Support for Smart Cards Too!: For Macs without Secure Enclaves, you can configure a Smart Card (such as a YubiKey) and use it for signing as well. - Auditable Build Process: Builds are produced by GitHub Actions with an auditable build and release generation process. Starting with Secretive 3.0, builds are attested using GitHub Artifact Attestation. - Backups and Transfers to New Machines: Because secrets in the Secure Enclave are not exportable, they are not able to be backed up, and you will not be able to transfer them to a new machine. If you get a new Mac, just create a new set of secrets specific to that Mac. >brew install secretive Repository maxgoedjen/secretive Repository stats |Metric|Value| |:-|:-| |Stars|9,094| |Forks|221| |Last release|v4.0.0 (2026-09-21)| |Languages|Swift 99.5%, Shell 0.5%| |Contributors|41| |AI contributor accounts (Claude / Codex / Cursor / Copilot)|None| |AI co-authored commits|None| Main contributor |Field|Value| |:-|:-| |Name|Max Goedjen| |GitHub|@maxgoedjen| |Commits to this repo|416 (top contributor)| |Company / Location|Los Angeles, CA| |Followers|241| ────────────────────────────── 📌 How many great GitHub repos have you discovered and completely forgotten about? Don't let another useful tool disappear into your Reddit feed. Get the community's best repos, organized by category, plus key takeaways from real developer discussions, delivered to your inbox twice a week. 📬 Never lose track of great repos again. Subscribe free.
Or you could just use Secretive. maxgoedjen/secretive