Secretive

About

Secretive is a Mac app for protecting and managing SSH keys with the Secure Enclave. Because keys stored in the Secure Enclave cannot be exported, they are much harder for malicious users or malware to copy than keys kept on disk. On Macs with a Secure Enclave, you can require Touch ID or Apple Watch authentication before a key is accessed, and Secretive notifies you whenever your keys are used.

For Macs without a Secure Enclave, Secretive supports Smart Cards, such as a YubiKey, for signing. Secretive can be installed from the GitHub Releases page or with Homebrew (brew install secretive). Its builds are produced by GitHub Actions and, starting with version 3.0, are attested using GitHub Artifact Attestation.

Keys cannot be backed up or transferred to a new machine, since Secure Enclave secrets are not exportable. If you get a new Mac, you create a new set of keys for that machine. Secretive also relies on Keychain APIs, which restrict key access to the app that created them, so builds from source should use a consistent bundle ID.