A file that says nothing
The whole SQLite database is sealed into one blob: salt ‖ nonce ‖ ciphertext. Nothing marks it as a secret store - not a header, not an extension, not a recognizable structure.
$ npm i -g sefy-cli $ cargo install sefy # then, once: $ export SEFY_VAULT=~/notes.bak $ sefy init $ sefy add note "bank card"
An inconspicuous encrypted vault
Notes, credentials and files in one encrypted file with no magic bytes, no header and nothing to recognize. Call it notes.bak and leave it anywhere.
A day in the life
Section titled “A day in the life”$ sefy add credential mail --login someone@example.com --url https://mail.example.comPassword for this item:added "mail" as 2
$ sefy get mailcopied password of "mail" to the clipboard; clearing in 45sclipboard clearedThe secret went to the clipboard and came back off 45 seconds later - and only because it was still the value sitting there. Anything you copied in the meantime is left alone.
What the file looks like
Section titled “What the file looks like”$ head -c 32 notes.bak | xxd00000000: 65b0 1375 a933 361d 89e2 9338 1b8d cb76 e..u.36....8...v00000010: 0749 7515 ad12 dd40 1c3e 3e93 9282 4b5a .Iu....@.>>...KZNo magic bytes, no header, no extension convention. Two saves of identical content share no prefix, because the salt and nonce are fresh every time.
What sefy does
Section titled “What sefy does”Notes, logins and files
Free-form notes, credentials with login, URL and TOTP, and files kept byte for byte. Tags across all of them, and search over titles and contents.
Nothing plaintext on disk
The decrypted database lives only in memory - SQLite is never given a path, so no page, journal or temporary file lands on disk.
Secrets leave one way
sefy get copies to the clipboard and clears it on a timer; show prints an item’s surroundings but never its secret. Printing is possible, but you have to ask.
Several machines, one vault
sefy sync moves the sealed file through a transport and folds what comes back in - both versions kept when both sides changed, nothing dropped on a timestamp. The transport never sees the password or an item.
Never a trap
sefy export writes everything back out as plain JSON so your data can move to another tool - after making you acknowledge exactly what that file is.
Honest about limits
Inconspicuous, not deniable. It hides from a passing glance and a cloud scanner, not from a forensic examiner or from anyone who can compel a password.