LLM Secrets

Does Claude Code read my .env file?

Yes. Claude Code automatically loads .env files without asking permission. Your API keys, database passwords, and tokens are silently loaded into memory. LLM Secrets encrypts these files so Claude can use secrets without ever seeing the actual values.

How do I protect API keys from AI assistants?

LLM Secrets encrypts your .env file with a master key derived from your phone, laptop, or security key. Secrets stay encrypted at rest and are only decrypted inside isolated subprocesses at runtime — preventing AI coding assistant secrets exposure.

Is tap-to-unlock really secure?

Yes. LLM Secrets uses AES-256-GCM authenticated encryption with a master key derived from your hardware-backed passkey — iPhone Face ID, Android Google passkey, Touch ID, Windows Hello, or a hardware security key. The key never leaves the device, so the encrypted vault is useless on any other machine.

What platforms does LLM Secrets support?

LLM Secrets supports macOS, Linux, and Windows via WSL. You unlock with whatever passkey you already use: iPhone Face ID, Android Google passkey, Touch ID, Windows Hello, or a YubiKey. All platforms are free with full-featured encryption and encrypted Google Drive backup.

Can Claude Code deploy to Vercel and configure DNS with my API keys?

Yes. LLM Secrets lets Claude Code use your Vercel tokens, GoDaddy API keys, AWS credentials, and other deployment secrets without exposing them. Claude can deploy websites, configure DNS, push to cloud providers, and deploy smart contracts—all while your secrets remain encrypted.

How do I protect my private key when deploying smart contracts with Foundry or Hardhat?

LLM Secrets encrypts your private key in your .env file with AES-256-GCM, keyed to your phone or laptop. When you run forge script or hardhat deploy, your key is decrypted only at runtime in an isolated subprocess. Claude Code can deploy your contracts without ever seeing your private key—preventing the #1 cause of crypto theft (43.8% of all stolen funds in 2024 came from private key compromise).

Is it safe to put my crypto private key in a .env file?

Plain text .env files are risky—they can be accidentally committed to git, read by AI assistants, or exposed through misconfiguration. LLM Secrets encrypts your .env file with AES-256-GCM, keyed to your phone, laptop, or security key. Your private keys are encrypted at rest and only decrypted inside isolated subprocesses at runtime — safer than Foundry keystores or Hardhat keystore plugins, because encryption is automatic and tied to a hardware-bound passkey only you can tap.