All your keys in one place, and on a new machine in a minute

Your credentials live in too many places

A new laptop means an evening of copying dotfiles. A new server means pasting keys over SSH. Old tokens linger in a notes app.

The job is one encrypted copy of everything, and a fast way to put any part of it on any machine.

Set it up once, use it everywhere

• A personal project for your own keys. Every member gets a personal project with an environment for files like ~/.aws/credentials.
• Drop in whole folders. Drag files or folders such as .aws or .cloudflare, up to 300 files at a time. Crunu guesses each file's path on your computer from the folder, name and contents, and you can correct it.
• Files edited the way they're written. .env files variable by variable, INI files such as ~/.aws/credentials section by section, flat YAML by field, anything else as plain text.
• Find anything with ⌘K. Search by variable name, service, path or action. Values are never searched and never shown in results. A copied value is cleared from the clipboard after a minute.
• A key generator. Generate a 40-character value in the editor.
• Know where to reissue. Twenty well-known services, AWS, Cloudflare, GitHub, Stripe and OpenAI among them, show a link to the page where you issue a new key.
• History for every file. The last 100 versions with what changed, and restore any of them as a new version.

Three ways to install your files

1. From the browser, no agent. Download an install script for an environment's files. It writes each file with 0600 permissions, keeps the previous version as .prev and checks SHA-256 before anything moves into place. Run it locally, or on a server over SSH without copying it there.
2. With the crunu command line. Sign in on the machine with your password, Secret Key and a second factor, then write your files to their paths. Replace dotfiles/laptop with your own project and environment; --dry-run prints the paths without writing anything.
3. Run a program with a project's variables. crunu run decrypts the environment in memory and starts the program with its variables.

ssh my-server sh -s < ~/Downloads/crunu-install-20261027-1430.sh && rm ~/Downloads/crunu-install-20261027-1430.sh

crunu login --server https://app.crunu.com --email you@example.com
crunu pull --env dotfiles/laptop --dry-run
crunu pull --env dotfiles/laptop

crunu run --env side-project/development -- npm run dev

crunu pull won't write to shell startup files, ~/.ssh/ or systemd directories unless you allow each path, and asks before writing a path it hasn't written before.

Leave whenever you like

• Offline copy. Download every environment you can read as one file that opens with your password and Secret Key, without the server.
• Exports. One environment as a single .env, as a file with its own password of at least 16 characters, or as an Ansible Vault file.

Before you rely on it

• Nobody can reset your password. The server never had it. Print your Emergency Kit and create a recovery code. Without your password, Secret Key and recovery code, no one can open your account.
• No Windows, no mobile apps, no browser extension. The crunu command line runs on Linux and macOS; the web app works in Chrome 113+, Safari 17+ and Firefox 129+.
• Files written to disk stay on disk. Crunu doesn't remove files that crunu pull or an install script wrote.
• No ${…} references between secrets. Each value is stored as written.

Each limit, with what to do about it, is on the limitations page.

Related docs and integrations

• Create your account
• Files and variables
• Emergency Kit and Secret Key
• Sign in from the terminal
• crunu pull
• Export and offline copy
• AWS credentials files
• Ansible Vault