2Secret v1.10.0

Agent Access: AI tools use your vault, you stay in charge.

• AI agents in the desktop apps (Settings → Desktop app → AI agents,
  off by default). Claude Code, Claude Desktop, Cursor, Codex, Gemini CLI and
  any other tool that speaks the Model Context Protocol connect through
  2secret mcp. The first time a tool connects 2Secret asks whether it may,
  and shows the program behind it. A connected tool can search the titles,
  user names, websites and tags of your items; it never gets a password,
  one-time code or note without asking.
• Every secret needs your yes. Reading a field, getting a one-time code,
  saving or changing an item: 2Secret shows which tool asks, for which item
  and fields, and why. Allow it once, for these items until 2Secret locks, or
  for these items for 8 hours. Optionally 2Secret asks for Touch ID, Face ID
  or Windows Hello first. Deny is the default; Enter and Escape refuse.
• Programs get secrets, the model does not. The tool can run a program
  with 2s:// references in its environment (run_command): 2Secret asks
  once for all of them, the program gets the values, and in the output the
  tool reads the values are replaced by their references. A new login can be
  saved with a password 2Secret generates, so the tool never sees it.
• Agents, permissions and a log in the settings: which tools are
  connected (each with its own key), what they may do without asking, and
  every request with your answer. Revoke a tool there. Everything is
  encrypted with your account key and forgotten from memory when 2Secret
  locks, when open questions are refused.
• Command line: 2secret mcp (and --standalone for use without the app:
  only searching and generating), 2secret agent status. New crate
  twosecret-agent. See docs/AGENTS.md.

Downloads

File	What
2Secret_*_aarch64.dmg	macOS app for Apple silicon (M1 and newer)
2Secret_*_x64.dmg	macOS app for Intel Macs
2Secret_*_x64-setup.exe	Windows app (installs for your user and can update itself; removes an .msi version of 2Secret up to 1.7.0)
*.deb, *.rpm, *.AppImage	Linux app (x86_64)
2Secret_*_android-arm64.apk	Android app (Android 7 and newer) – allow installing from your browser when asked
2Secret_*_android-arm64.aab	Android app bundle for app stores
2secret-*-<platform>.tar.gz / .zip	2secret CLI and 2secret-server for Linux, macOS (Apple silicon and Intel) and Windows
2secret-web-*.tar.gz	Web vault – serve it with 2secret-server --web-dir
2secret-extension-*.zip	Browser extension for Chrome, Edge, Brave and Firefox (load unpacked)
SHA256SUMS, SHA256SUMS.sig	Checksums of all files, signed with 2Secret's update key (how to check)

Server image for x86_64 and ARM64 (e.g. Raspberry Pi 4/5 with a 64-bit OS):
docker pull ghcr.io/joostiphone/2secret:latest – see
self-hosting.

On macOS, drag 2Secret to Applications and open it. If macOS says it cannot
verify the app, open System Settings → Privacy & Security and click Open
Anyway (on macOS 14 and older you can also right-click the app and choose
Open).
On Windows, SmartScreen may ask you to confirm (More info → Run anyway).

FreeBSD, OpenBSD, NetBSD and iOS: build from source, see the
README.