How to generate an SSH key with Safe?

Use 'safe ssh 2048 secret/path' to generate a 2048-bit SSH keypair stored directly in Vault at the specified path, with private and public keys added securely without local files.

Safe vs standard Vault CLI: which is better for password management?

Safe excels with features like auto-generated passwords, interactive entry, and formatting (e.g., crypt-sha512), while the standard Vault CLI is more minimal. Choose Safe for enhanced security and convenience in workflows.

How to migrate secrets between Vault instances using Safe?

Pipe 'safe export' from one target to 'safe import' on another, e.g., 'safe -T old-vault export secret/subtree | safe -T new-vault import'. Ensure exports are handled securely to avoid leaks.

Can Safe handle SSL certificate renewal automatically?

Safe supports manual renewal via 'safe x509 crl --renew path', but it doesn't automate renewals; you'll need to script it or use Vault's native features for full automation.

What authentication methods does Safe support?

Safe supports token, LDAP, GitHub, and Okta backends, as per the README. It doesn't yet support other methods like AWS or Azure, which might limit integration in some environments.

How to use Safe in a CI/CD pipeline?

Leverage targets and auth tokens with environment variables, chaining commands for batch operations. However, ensure secure token handling and avoid exposing credentials in logs.

Safe — HashiCorp Vault CLI

What is Safe?

Safe is a command-line interface for HashiCorp Vault that enhances secret management with secure generation of SSH/RSA keys, random passwords, and streamlined credential operations. It solves problems like securely providing credentials without files, auto-generating passwords, and managing multiple Vault paths efficiently, especially for BOSH deployments using Spruce.

Target Audience

DevOps engineers, platform operators, and security professionals who use HashiCorp Vault for secret management and need enhanced CLI tools for secure credential generation and automation.

Value Proposition

Developers choose Safe over the standard Vault CLI for its specialized features like interactive password entry, credential formatting, and X.509 certificate management, which simplify secure workflows and reduce the risk of credential exposure.

A Vault CLI

Use Cases

Best For

Generating SSH key pairs securely within Vault
Auto-generating random passwords for new accounts
Managing X.509 TLS/SSL certificates and revocation lists
Migrating secrets between different Vault instances
Securely entering passwords without saving to disk
Formatting passwords into hashed or encoded formats

Not Ideal For

Projects requiring GUI-based secret management tools for non-technical users
Environments using Vault authentication backends not supported by Safe (e.g., AWS, Azure, or custom methods)
Simple Vault use cases where the native CLI's basic get/set operations are sufficient
Teams needing extensive third-party integrations or plugins beyond Safe's core features

Pros & Cons

Pros

Secure In-Vault Key Generation

Generates SSH and RSA key pairs directly within Vault without local file exposure, as shown with the 'ssh' and 'rsa' subcommands, reducing credential leakage risks.

Interactive Credential Safety

Provides double-confirmation prompts for sensitive inputs without writing to disk, enhancing security during manual password entry, as described in the 'set' command usage.

Flexible Credential Formatting

Supports reformatting passwords into base64, bcrypt, or crypt-sha512 hashes and storing them as new keys via 'safe fmt', useful for system integrations like htpass files.

Batch and Chained Operations

Allows chaining commands with '--' and additive updates to multiple paths, streamlining complex workflows, such as generating keys and setting metadata in one go.

X.509 Certificate Management

Offers tools to issue, revoke, validate, and renew TLS/SSL certificates through the 'x509' subcommands, integrating certificate lifecycle management directly with Vault.

Cons

Limited Authentication Support

Only supports token, LDAP, GitHub, and Okta backends, missing other Vault authentication methods like AWS or Azure, as admitted in the README under 'Authentication'.

Homebrew Installation Hassles

The Homebrew formula in core is outdated and incorrect, forcing MacOS users to rely on a custom tap, which adds setup complexity and potential maintenance issues.

CLI-Only Interface Limitation

Lacks a graphical user interface, making it less accessible for non-technical users or teams preferring visual tools for secret management and auditing.

Export Security Concerns

Exports are not encrypted and storing them on-disk is discouraged due to credential leakage risks, as noted in the 'import' command documentation, requiring careful handling.

What is Safe?

Target Audience

DevOps engineers, platform operators, and security professionals who use HashiCorp Vault for secret management and need enhanced CLI tools for secure credential generation and automation.

Value Proposition

Use Cases

Best For

Generating SSH key pairs securely within Vault
Auto-generating random passwords for new accounts
Managing X.509 TLS/SSL certificates and revocation lists
Migrating secrets between different Vault instances
Securely entering passwords without saving to disk
Formatting passwords into hashed or encoded formats

Not Ideal For

Projects requiring GUI-based secret management tools for non-technical users
Environments using Vault authentication backends not supported by Safe (e.g., AWS, Azure, or custom methods)
Simple Vault use cases where the native CLI's basic get/set operations are sufficient
Teams needing extensive third-party integrations or plugins beyond Safe's core features

Pros & Cons

Pros

Secure In-Vault Key Generation

Generates SSH and RSA key pairs directly within Vault without local file exposure, as shown with the 'ssh' and 'rsa' subcommands, reducing credential leakage risks.

Interactive Credential Safety

Provides double-confirmation prompts for sensitive inputs without writing to disk, enhancing security during manual password entry, as described in the 'set' command usage.

Flexible Credential Formatting

Supports reformatting passwords into base64, bcrypt, or crypt-sha512 hashes and storing them as new keys via 'safe fmt', useful for system integrations like htpass files.

Batch and Chained Operations

Allows chaining commands with '--' and additive updates to multiple paths, streamlining complex workflows, such as generating keys and setting metadata in one go.

X.509 Certificate Management

Offers tools to issue, revoke, validate, and renew TLS/SSL certificates through the 'x509' subcommands, integrating certificate lifecycle management directly with Vault.

Cons

Limited Authentication Support

Only supports token, LDAP, GitHub, and Okta backends, missing other Vault authentication methods like AWS or Azure, as admitted in the README under 'Authentication'.

Homebrew Installation Hassles

The Homebrew formula in core is outdated and incorrect, forcing MacOS users to rely on a custom tap, which adds setup complexity and potential maintenance issues.

CLI-Only Interface Limitation

Lacks a graphical user interface, making it less accessible for non-technical users or teams preferring visual tools for secret management and auditing.

Export Security Concerns

Exports are not encrypted and storing them on-disk is discouraged due to credential leakage risks, as noted in the 'import' command documentation, requiring careful handling.

Safe

What is Safe?

Overview

Use Cases

Best For

Not Ideal For

Pros & Cons

Pros

Cons

Frequently Asked Questions

Related Projects

Found a gem we're missing?

Safe

What is Safe?

Overview

Use Cases

Best For

Not Ideal For

Pros & Cons

Pros

Cons

Frequently Asked Questions

Related Projects

Found a gem we're missing?