Skip to content
1Claw Academy
Curriculum/Foundations3 minBeginner · Lesson 6 of 13

Start local: a vault with no account

Encrypt secrets on your own machine with 1claw local, before you sign up for anything.

You do not need an account, a network, or a credit card to get value from 1Claw. The CLI ships a local encrypted vault that works entirely offline, and it is the right place for a developer to start: it solves the .env-file problem on your own laptop first, and everything you learn transfers to the hosted vault later.

  • The vault is a single encrypted file at ~/.config/1claw/local-vault.enc.
  • It is AES-256-GCM, with the key derived from your passphrase by scrypt.
  • The file is written with 0600 permissions, so only your user can read it.
  • Nothing leaves your machine unless you explicitly run a sync.
  1. 1

    Create the vault. You will be prompted for a passphrase twice; it must be at least 8 characters.

    bash
    1claw local init
  2. 2

    Add a secret. You are prompted for the value rather than passing it as an argument, which keeps it out of your shell history.

    bash
    1claw local add stripe/test-key
  3. 3

    List what is stored. Names only, never values.

    bash
    1claw local list
  4. 4

    Read one back.

    bash
    1claw local get stripe/test-key

# or masked, when someone is looking over your shoulder
1claw local get stripe/test-key --masked
  5. 5

    Check the vault's state at any time.

    bash
    1claw local status
  6. 6

    Remove a secret you no longer need.

    bash
    1claw local rm stripe/test-key
Tip

Unlocking is deliberately slow. scrypt is configured with a large work factor, so each command takes a moment while it derives the key. That cost is what makes a stolen vault file expensive to brute force.

Watch out

The passphrase cannot be recovered. There is no reset, no support path, and no escrow: if you forget it, the only option is 1claw local destroy, which deletes the vault so you can start over. Put the passphrase in your password manager before you add anything you care about.

This is the whole local story, and for a solo developer it may be all you ever need. The next two lessons cover the two things it cannot do: share a secret with a teammate, and give an agent scoped access. Both are what the hosted vault is for.

Check your understanding

3 questions
1

Where does the local vault store its data?

2

You forget your local vault passphrase. What are your options?

3

Why does each local command take a noticeable moment?