Local encryption
Secrets are encrypted in your browser before they leave your device.
Public beta · 100% free
The secrets managerthat keeps your keys under control.
MOTI stores your passwords, API keys, and .env variables in encrypted vaults. Everything is encrypted in your browser before leaving your device; the server never receives your plaintext credentials.
✓Client-side encryption · No plaintext on the server
MOTI / ENCRYPTION LAYER
PRIVATEBY DEFAULT
01PASSWORD
02KEY ENCRYPTION(KEK)
03DECRYPTION KEY(DEK)
01 CLIENT-SIDE FIRST
02 ZERO-KNOWLEDGE ARCHITECTURE
03 BUILT FOR DEVELOPERS
Security by design
The API stores data.You control the keys.
Each vault has its own data key. Your password only unlocks its envelope; values never reach the backend in plaintext.
Separate keys
One decryption-key key per vault keeps each space isolated and makes protection rotatable.
Controlled recovery
Recover access with a recovery file that only you can custody.
Trust boundary
What the server sees.And what it never will.
MOTI is designed to minimize what the backend needs to know to operate your account.
+
The server can see
- Ciphertext
- IV and authentication tag
- Encrypted decryption-key key
- Account metadata
×
The server never sees
- Your plaintext secrets
- Your password
- The decrypted decryption-key key
- Your variable values
The model
Protect your secretswithout handing over the keys.
Your password protects the encryption key. That key protects each vault. The server only receives the encrypted result.
// NO PLAINTEXT LEAVES THE BROWSERYOUR PASSWORD
Only unlocks your encryption key.
KEY-ENCRYPTION KEY
Your password creates a key that protects the other keys. (KEK)
DECRYPTION-KEY KEY
One independent key protects each space. (DEK)
ENCRYPTED DATA
AES-256-GCM protects every value.
Workflow
From your .envto an encrypted vault.
Import your existing variables and encrypt every value in the browser before uploading it.
Your .env file
DATABASE_URL=postgres://...STRIPE_SECRET_KEY=sk_...JWT_SECRET=...
MMOTI vault
DATABASE_URL ••••••••STRIPE_SECRET_KEY ••••••••JWT_SECRET ••••••••
✓ Encrypted before uploadRecovery
Forgot your password?The server cannot open your vault either.
We cannot reset your keys from the backend. That limitation is part of the model: use your recovery file to restore the hierarchy and set a new password.
!Keep your recovery file like a physical key: MOTI cannot replace it.
01Password lost→
02Server cannot decrypt the vault→
03Recovery file→
04New password
Public beta · Free while we build
Fewer secrets scattered around.More operational control.
A quiet workspace for the credentials that keep your product moving, without handing the keys to the server.
01
Contextual vaults
Separate production, staging, and development without mixing their keys.
02
Import your .env
Bring existing variables in and encrypt every value in the browser.
03
Optional recovery
Choose when to add a recovery path to each vault.
+
Coming next
Teams, without giving upcontrol.
Secure collaboration for sharing context without handing your secrets or their keys to the server.
You're early
Help shape Moti.
Tell us what feels confusing, missing, or broken. Do not include passwords, recovery keys, API keys, or other secrets.
M
Public beta · Free
Infrastructure deserves privacy too.
MOTI is now available so you can protect your credentials with real control over your keys.