Slinky
Slinky keeps secrets out of files.
A free Mac app for API keys, .env variables and recovery codes. Encrypted on your Mac, opened with Touch ID. Free and open source.
Keys & Tokens
API keys and access tokens your software and AI tools use, with expiry dates and live-key warnings.
Projects
Each app’s .env variables for Local, Preview and Production, out of the project folder.
Recovery
Backup codes that cross themselves off, and recovery keys for the day you need them.
Add Item
Paste it once.
Slinky files it.
Projects
Every project’s .env,
in one place.
Drop a project folder
Slinky reads its .env files and sorts them into Local, Preview and Production. It never changes them.
Checks .gitignore
Files git could commit get a warning, before they end up in your repo.
Shows what’s missing
.env.example tells Slinky what the project needs. Copy an environment as .env lines when your host asks.
Recovery
Backup codes
that keep count.
Only 4 codes left. Click one to copy it.
Quick Access
Your keys,
a shortcut away.
⌥⌘K, from anywhere
Find a key by name and press Return. Try it here: type “stripe” or “codes”.
Private copies
Clipboard history apps skip what Slinky copies, and it clears itself after a minute.
Shortcuts too
Add to Slinky, Copy from Slinky with Touch ID, Quick Access and Lock, right in the Shortcuts app.
Return copies this item. The clipboard clears in 60 seconds.
Locking
Locked unless
you’re using it.
Slinky
Slinky wants to unlock your vault.
Touch ID or enter your password to allow this.
Try the lock switch at the top right
Slinky Recovery Key
You need this key to open your vault on another Mac, or if Touch ID stops working. Slinky doesn’t keep a copy.
Keep it somewhere safe, away from your Mac.
Features
Also in Slinky
Import
Bring keys from 1Password, Apple Passwords, Bitwarden or a CSV. Passwords stay behind.
A 5 MB download
Native Swift and Apple frameworks only. No web views, no dependencies.
5MB
Updates in place
One click, and only if the update is signed by Slinky’s developer.
Settings that matter
When to lock, how long until the clipboard clears, sounds, open at login.
AI agents, next
Coming in 1.1: tools like Claude Code run your app with the real keys while only ever seeing dots.
Free and open source
MIT licensed, made by Testament Made. Read every line on GitHub.
Compare
Where Slinky fits
Apple Passwords is great for logins. Slinky is for everything else you’re told to keep safe.
| Slinky | Apple Passwords | 1Password | .env files | Doppler or Infisical | Keychain Access | |
|---|---|---|---|---|---|---|
| Made for API keys and tokens | Yes | No | Yes | Partly: Plain text | Yes | Partly: Generic items |
| A project’s .env, per environment | Yes | No | Partly: With its CLI | Yes | Yes | No |
| Recovery codes that cross themselves off | Yes | No | No | No | No | No |
| Stays on your Mac | Yes | Partly: iCloud | No: Their cloud | Partly: Unencrypted | No: Their servers | Yes |
| Opens with Touch ID | Yes | Yes | Yes | No | No | Partly: Password |
| Price | Free, open source | Free | Subscription | Free | Free tier, then paid | Free |
Yes Partly No As of October 2026.
Give your secrets a home.
Free, about 5 MB, and nothing leaves your Mac.
Privacy
Your things, in plain English
Where they live
- One encrypted file on your Mac.
- Opened by your Mac’s Secure Enclave with Touch ID, or your printed Recovery Key.
- Locked means the key isn’t in memory at all.
What leaves your Mac
- Nothing about you or your vault.
- Once a day, a check with GitHub for a newer version. You can turn it off.
- No account, no analytics in the app, no server.
Questions
Good to know
Is Slinky free?
Yes. Slinky is free and open source under the MIT License, made by Testament Made, LLC, the same people behind Dinky and Binky.
Where are my things stored?
In one encrypted file on your Mac. The key that opens it is protected by your Mac’s Secure Enclave and opened with Touch ID. A printed Recovery Key is the backup.
Why does macOS say it can’t check Slinky?
Slinky is signed but not notarized yet. The first time, open System Settings › Privacy & Security and click Open Anyway. You only do this once; updates install without asking again.
Should I keep passwords in Slinky?
No. Website passwords belong in Apple Passwords. Slinky is for the other things: API keys, tokens, .env variables, backup codes and recovery keys.
Is there an account or sync?
No account, no server and no sync. The only time Slinky goes online is a daily check with GitHub for a newer version, which you can turn off. Time Machine backs up the encrypted file like any other.
What if I lose my Mac?
Restore your backup on a new Mac and open Slinky with your Recovery Key. Slinky then sets up Touch ID on that Mac.
Does Slinky change my project files?
No. It reads your .env files and .gitignore to set things up. It only writes a file when you choose Save .env.example, which has names and no values.
What about clipboard history apps?
Everything Slinky copies is marked private, so Raycast, Paste, Maccy and others skip it, and the clipboard clears itself after 60 seconds.
Can I bring my keys from another app?
Yes. Import a 1Password export or a CSV from Apple Passwords, Bitwarden or a spreadsheet. Slinky picks out keys, tokens and codes, and leaves passwords behind.
Will it work with AI coding tools?
That’s next. Slinky 1.1 adds a slinky command and an MCP connection, so tools like Claude Code can run your app with the real keys while only ever seeing dots.