Local Secret Vault

Local Secret Vault stores API keys, tokens, SSH keys, passwords, and other credentials in an encrypted vault inside Obsidian. It is an Obsidian desktop-only community plugin; the runtime user interface is in Traditional Chinese (繁體中文).

Features

• Store API keys, tokens, cloud service keys, account passwords, authorization JSON, and SSH keys.
• Add tags and custom properties, then search by name, type, account, tag, or property.
• Copy a Markdown note link to an entry. The link contains only the vault name and entry ID; it does not contain the secret, title, or properties.
• Import JSON or SSH text from a file selected by you. Export an encrypted JSON backup through a file download.
• Save an SSH key as a plaintext file with permission mode 600 on Unix (Windows access is governed by ACLs); the save uses exclusive creation and will not overwrite an existing file.
• Automatically lock after five minutes without activity and when the application loses focus or becomes hidden.
• After copying a secret, attempt to clear the clipboard after 30 seconds only when the clipboard still contains the copied value. Clipboard cleanup is best effort and may be unavailable on the host system.
• Store the encrypted envelope in the plugin's Obsidian data.json and keep data.previous.json before writes.

Quick start（快速開始）

1. 安裝並啟用外掛，從功能區鑰匙圖示或命令面板開啟「密鑰保管庫」。
2. 建立至少 12 字元的主密碼。主密碼遺失後無法復原。
3. 新增密鑰、帳號、標籤與自訂屬性；需要時複製密鑰或複製筆記連結。
4. 定期按「加密備份」下載日期版本，並將備份保存在安全位置。

已發布於 Obsidian 社群目錄。0.2.1 自動審核完成，沒有錯誤；頁面揭露檔案系統與剪貼簿存取。也可使用 GitHub Release 手動安裝。

Manual installation

Download the release assets for v0.2.1 and place main.js, manifest.json, and styles.css in:

<your-vault>/.obsidian/plugins/local-secret-vault/

Reload Obsidian, enable Local Secret Vault in Community plugins, and open the vault from the ribbon or command palette. If you use a custom Obsidian configuration folder, substitute it for .obsidian. The community listing is live. The 0.2.1 automated review completed with no errors; filesystem and clipboard access remain disclosed. Automated checks are not an independent security audit.

Encryption and data model

Each vault is an authenticated encrypted envelope using AES-256-GCM with a 128-bit authentication tag. The encryption key is derived from the master password with PBKDF2-HMAC-SHA-256 using 600,000 iterations, a random 16-byte salt, and a random 12-byte IV for each write. Vault payloads are limited to 5 MiB. Version 0.2.0 and newer read the earlier entry format without rewriting existing data. Older releases cannot read the new tags and properties: update every device before saving metadata.

There is no password recovery. Keep the master password and independent encrypted backups safe. Changing the master password does not change the password of older backups.

Obsidian Sync and concurrency

Optional Sync support uses Obsidian Sync's separate paid service. On every device, install the same plugin version, enable community-plugin list, installed community plugins, and community-plugin settings in Obsidian Sync, then unlock the synchronized ciphertext with its existing master password. Do not create a separate vault on the receiving device. The plugin stores only ciphertext in its data.json.

When an external encrypted update is detected, the plugin locks and discards unsaved edits before the new ciphertext is loaded. There is no multi-writer merge and no cross-process consistency guarantee. Concurrent edits can produce conflicting latest ciphertext, so use dated encrypted backups as an independent recovery path and avoid editing on two devices at once.

Recovery

Use 從加密備份還原 (restore encrypted backup) on the locked screen. The backup password is checked before replacement. If the current data.json is damaged or missing, the recovery-only screen remains available; an existing damaged file is preserved as data.recovery-<time>-<id>.bak before replacement. Wrong passwords or a changed source file abort recovery. The recovered vault starts locked.

data.previous.json holds only the previous write, not a history. Keep dated encrypted exports in a separate backup location. A file recovery archive may contain whatever bytes were in the original damaged file: treat it as sensitive, and do not commit it or assume a sync service will copy it.

Privacy and security boundaries

The plugin itself has no network service, telemetry, account, or payment flow. File import and export happen only through files you explicitly select or save outside the vault.

This project has not undergone a formal security audit. Encryption does not make the system unbreakable: an untrusted Obsidian plugin, compromised operating system, or other process that can inspect the running application may read decrypted values. JavaScript cannot guarantee memory wiping. Protect the operating system, Obsidian profile, backups, and master password accordingly.

See SECURITY.md for reporting and deployment guidance.

Development

Requirements: Node.js 22 or newer. Runtime dependencies are not bundled; the plugin uses Obsidian and platform APIs at runtime. For local checks:

npm ci --ignore-scripts
npm run check

npm run check runs linting, the repository test suite, and the production build. Do not put real credentials in tests, examples, issues, or pull requests.

License

MIT. See LICENSE.