Transparently encrypts specific files in git repositories, allowing secure storage of secrets alongside public code.
git-crypt is a command-line tool that enables transparent encryption and decryption of files within git repositories. It solves the problem of securely storing sensitive data like API keys, passwords, or certificates alongside public code by encrypting only specified files while maintaining normal git workflows.
Developers and teams who need to store secrets in git repositories while allowing partial public access, particularly those working with mixed public/private codebases or infrastructure-as-code projects.
Unlike full-repository encryption solutions, git-crypt allows selective encryption of specific files, enabling seamless collaboration where most repository content remains public while sensitive files are protected with strong AES-256 encryption.
Transparent file encryption in git
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Allows encrypting only specified files via .gitattributes rules, enabling mixed public/private repositories without locking down the entire codebase, as highlighted in the README's use case examples.
Automatically handles encryption on commit and decryption on checkout for authorized users, so git operations remain normal without manual intervention, as described in the basic usage section.
Developers without the secret key can still clone and commit to repositories with encrypted files, facilitating partial access and teamwork on public portions, a key feature mentioned in the description.
Uses AES-256 in CTR mode with synthetic IVs for semantically secure encryption, providing robust protection against data leaks, as detailed in the Security section.
Lacks support for revoking user access or rotating keys, making it unsuitable for scenarios where permissions need to change, as admitted in the Limitations section with no del-gpg-user command.
Does not encrypt file names, commit messages, or other metadata, which could leak sensitive information, a noted limitation in the README.
Does not work reliably with some third-party git GUIs, such as Atlassian SourceTree, potentially leaving files unencrypted, as warned in the Limitations section.