About Crunu

Crunu is a team vault for environment variables and credentials: .env files, cloud credentials files, API keys. Everything is encrypted on your devices, and the server only ever stores ciphertext.

The problem it's for

Many teams pass secrets around the way they pass around everything else: in chat threads, shared notes and copied files. It works until someone leaves, a laptop goes missing, or nobody can say which version of the production .env is current. A central secrets store fixes the mess. But if the store can decrypt what it holds, it becomes one more place where every secret can leak from.

Crunu is built on a different assumption. The place that stores your secrets shouldn't be able to read them.

Why the server can't read your data

• Encryption happens on your devices. The browser app and the crunu agent encrypt and decrypt. The server keeps ciphertext, public keys and signed records, and it has no decryption key at any point in the protocol.
• Your account key has two halves. It is derived from your password and a Secret Key that is generated on your device. Neither is sent over the network. A full copy of the database is useless for guessing passwords, because each guess would also need the Secret Key.
• Access is signed, not just stored. Who may read an environment is written in a document signed by an admin, and every version is signed by its author. A server that has been taken over can't quietly add itself as a recipient or swap the data, because apps and agents check those signatures.
• Old state is rejected. Apps and agents remember the newest state they have seen and refuse anything older. A server can't silently roll an environment back on a device that has already seen the newer state.

The security overview explains the design in more depth. We also keep a list of known limitations: what this design can't protect against, such as a tampered web app served by a compromised server or malware on a device where your keys are in use.

Decisions that follow from that

• Every environment has its own key. Someone with access to development can't read production, because they never receive the production key. That's enforced by cryptography, not just by a permission check on the server.
• Leaving is handled as a security event. When a person is removed, the server stops delivering to them right away, the keys of the environments they had are rotated, and an exposure report shows which versions they received and when. Encryption can't erase what someone already saw, so Crunu also gives you a reissue checklist of the values to change at the providers that issued them. See offboarding.
• Machines and CI get exactly what they need. Each server you connect is enrolled as a machine and runs the crunu agent, which holds decrypted environments in memory only and keeps working through outages until its lease runs out. CI jobs use service tokens with a CI binding: through the CI provider's OIDC tokens, a token works only for a specific repository and branch. See machines and CI/CD.
• The audit log is tamper-evident. Entries are linked in a hash chain, so edits, deletions and insertions show up when the log is verified.
• Self-hosting is part of the design. Besides the hosted service at app.crunu.com, the same server can run on your own infrastructure: Docker, Cloudflare Workers, Vercel or Google Cloud Run. A self-hosted server moves between these platforms as a single archive that contains no readable values. The server isn't published as a public download, so write to support@crunu.com if you want to run it.
• Losing both keys is final. Because nobody else holds them, nobody can reset your password or recover your Secret Key, including us. Crunu gives you an Emergency Kit, an optional recovery code and organization-level recovery to reduce that risk. It can't remove it.

What Crunu doesn't do

Crunu doesn't generate short-lived database credentials on demand. That would require keys on the server, which is exactly what the design avoids. There is no Windows agent, no mobile app and no single sign-on. We'd rather say so here than let you find out later.

Where things stand

Crunu is in early access and free while it lasts; see pricing. The first release of the current platform shipped in October 2026, and the changelog lists every release since.

Questions or ideas are welcome. The contact page says where to write.