A local-first secrets manager, on the premise that secrets belong next to the repository that uses them. Per-repo vaults, AEAD encryption bound at rest to the device through the TPM, Secure Enclave, or Linux keychain. Export is a portable file, passphrase or public-key encrypted.

Secrets belong next to the repository that uses them, not in a service you have to be online to reach. Synccl keeps them local, encrypts them at rest against the machine’s own hardware, and makes moving them somewhere else an explicit, single-file act rather than a sync.

What it does

• Per-repo multi-vault support, so a machine working across several projects does not put all of them behind one key.
• AEAD vault encryption (XChaCha20-Poly1305), bound at rest to the device through the Windows TPM, the macOS Secure Enclave via a native bridge, or the Linux keychain.
• Transport-agnostic export: a vault leaves as a single portable file, protected either by an Argon2id passphrase or by X25519 public-key encryption to a named recipient.

What was interesting

Hardware binding and portability pull against each other. A vault sealed to a TPM is exactly what you want on a laptop and exactly what you cannot email to a colleague, so the export path had to be a separate cryptographic story rather than a decryption of the first, which is why export is public-key encryption to a recipient rather than “unlock, then re-lock elsewhere”.