Locky: Don’t paste that key into the chat. Let the agent call kb run!
KeyBuddy is a friendly vault for your API keys, tokens, passwords and SSH keys, on Mac, iPhone and iPad. Your AI agent runs with the key after a Touch ID tap. It never sees the value.
macOS 15+ · iOS 18+ · iPadOS 18+ · English & Tiếng Việt · No account needed
Save it to KeyBuddy so you never paste it into a chat with an AI agent.
Keeps your secrets out of
A key pasted into chat is a leaked key: it sits in transcripts, logs and history files forever. With KeyBuddy, the agent only knows the name of a key. kb run injects the value straight into the process it starts, after you approve with Touch ID.
$ kb ls ANTHROPIC_API_KEY OPENAI_API_KEY GITHUB_TOKEN STRIPE_SECRET_KEY $ kb run OPENAI_API_KEY -- npm run dev KeyBuddy: kb wants OPENAI_API_KEY · Touch ID ✓ VITE ready in 412 ms ➜ Local: http://localhost:5173/ # The transcript only ever contains the name. # Tool insists on a file? Write a gitignored one: $ kb env STRIPE_SECRET_KEY > .env.local
Copy it from the provider’s dashboard and press ⌥ ⌘ K anywhere. KeyBuddy names it and picks the env var for you.
One click copies instructions for CLAUDE.md or AGENTS.md. Variable names only, never values.
keybuddy.kb runYou approve with Touch ID, and can let KeyBuddy remember the approval for 5, 15 or 60 minutes. Every request shows up in Recent access.
## Secrets (KeyBuddy) Never ask me to paste a key into the chat. - List available names: `kb ls` - Run with secrets as env vars: `kb run OPENAI_API_KEY -- npm run dev`
KeyBuddy reads your local AI-agent chat histories on your Mac and flags any key that ended up in a conversation. Nothing it reads ever leaves your Mac.
A curl command, a .env line, a JSON blob, a key that broke across two lines in the terminal. KeyBuddy pulls out the token, recognises 16 providers and suggests the name and env var.
On Mac, KeyBuddy notices when you copy a key or a strong password and offers to save it, with a little card and a sound. Items from password managers are left alone.
Quick save from anywhere.
The vault locks when you leave. Revealing a key asks again and hides it after 20 seconds. Locking wipes keys from memory.
Copied keys clear themselves after 30, 60 or 120 seconds, skip Universal Clipboard, and are marked so clipboard managers don’t keep a copy.
Generate 12 to 48 characters, with or without symbols, skipping look-alike characters.
Spots sign-up and login forms, suggests a strong password, offers to save it, and fills it after you approve with Touch ID. It talks only to KeyBuddy on your own Mac.
A glance tells you everything: green when your keys are safe, yellow when one is due for rotation, red when one has leaked.
AI agents leave gigabytes behind: browser recordings, old transcripts, editor caches. KeyBuddy explains what each item is and moves the ones you pick to the Trash, so you can always change your mind.
KeyBuddy encrypts everything on your device. If you turn on iCloud sync, only the encrypted vault goes to your own private iCloud database, where only your Apple devices can read it.
No sign-up, no email, no password to forget. Open it and start.
No trackers, no ads, no crash-report SDKs. We collect nothing.
The leak scan reads files on your Mac and stays on your Mac.
Encrypted by KeyBuddy, then stored as CloudKit encrypted fields.
The same vault on iPhone and iPad, synced through your iCloud. Built for every shape, from compact phones to iPad and wide foldable layouts with a list and detail side by side.
kb run?The agent only ever types the key’s name. KeyBuddy asks you for Touch ID, then hands the value directly to the command kb run starts, as an environment variable. It never appears in the chat, your prompt or the agent’s transcript.
Like any environment variable, the program you run can use it. That’s the point. So only run commands you trust.
In an encrypted file on your device (AES-256-GCM, via Apple CryptoKit). The encryption key lives in your iCloud Keychain. With iCloud sync on, the encrypted vault is also saved to your private iCloud database so your other Apple devices can read it. You can turn sync off in Settings.
No and no. KeyBuddy has no backend, no sign-in and no analytics. Sync uses Apple’s CloudKit with your own Apple ID.
After you choose your Home folder once, KeyBuddy for Mac reads the local history files of AI coding tools (Claude Code, Claude Desktop, Codex, Gemini CLI/Antigravity, Cursor, Windsurf/VS Code, Aider) and your shell history, and looks for your saved keys and well-known key formats. Everything happens on your Mac. Nothing is uploaded. Only the result (“this key was found in Claude Code”) syncs, encrypted, to your other devices.
The kb command, leak scan, clipboard nudges, the ⌥ ⌘ K hotkey, the menu-bar icon, disk cleanup and the browser extension. iPhone and iPad have the vault, smart paste, password generator, Face ID, Shortcuts quick save and leak alerts synced from your Mac.
Anthropic, OpenAI, GitHub, GitLab, Stripe, AWS, Google/Gemini, Slack, Shopify, Hugging Face, npm, SendGrid, Resend, Cloudflare, Vercel and SSH/PEM keys. Anything else still saves fine, as an API key, token, password or SSH key.
Your vault is encrypted, the app locks with Face ID or Touch ID, and with iCloud sync on your keys are waiting on your other devices. It’s still a good moment to rotate anything important. KeyBuddy links straight to each provider’s key page.
Set up in a minute. No account, no server, no more keys in chat.