Arca Vision · machine representation

No secrets in the prompt.

LOCAL VAULTS FOR HUMANS & AI AGENTS. The local secrets manager for humans and AI agents. Free vault. $0 forever. No cloud. No account. No subscription. Inject secrets into anything you run:

Free vault. $0 forever. Pro is $99, once.

Charges appear as ARCA VISION LABS · 14-day money-back on direct purchases.

Free: $0 forever Unlock, search, store. CLI · app sockets on macOS first. Shamir onboarding + recover-from-shares. Key Generator + Token Inspector. 5-minute inactivity lock. macOS & Windows.
Pro: $99 once. Everything in Free, for life. Inject environments into any process. env import (.env files into named vault environments). arca agent wrap and start (macOS app first). arca ssh add (macOS app first). Multiple vaults (work, personal, client-separated). Import + Vault Health Engine. Idle lock 10/15/30/60 min or Never. Block screenshots. Reissue recovery cards. Zero-trace purge. Power utilities + 12 extra themes.
Enterprise: $39 per seat / year · 5-seat minimum. Support and seats, not Pro updates. Priority support · Volume licensing · Deployment help.

Inject targets

Free download · macOS & Windows · Linux coming

The app ships on macOS and Windows. Linux GUI is coming. Not a date. arca agent and arca ssh need the running, unlocked app plus local CLI sockets (ctl.sock, agent.sock). Those sockets are not in the first Windows drop. Windows today is the full desktop vault (including Windows Hello) plus direct CLI. Direct arca inject works; the child sees secrets. CA Keychain auto-trust is macOS. A Windows trust store comes with app sockets later, not as a settings toggle.

terraform apply
docker compose up
npm run dev
pytest
cargo test
curl
…and many other CLIs

Commands

arca env import --item Stripe --branch production --from-file .env.production
arca inject --env-file @Stripe/production -- cargo test
arca agent --github GitHub --anthropic Anthropic --ttl 900 -- claude

Your agents need secrets. Not your vault password.

Wrap Claude, gh, or npm with arca agent. They keep calling real APIs. Dummy tokens stay in their environment; Arca attaches the real secret in the running app.

1Password and Bitwarden are built for human fingers. arca agent brokers credentials to local coding agents without putting the secret in the child process.

The child never sees vault fields. Needs the running, unlocked app. First shipping on macOS. Windows at launch is the vault plus inject — the child still sees secrets. Sets HTTPS_PROXY, dummy conventional env, and CA trust vars. Wrap and start are Pro. status and stop stay free.

Open ARCA CLI

Named environments. Secrets in the process. Never on disk.

Cloud secret managers sell you a dashboard and a SaaS. Arca keeps named environments in the vault you already own.

One Env item holds the same keys across default, staging, and production. Different values. Notes stay on the item; they are never injected. No .env files on disk.

arca inject starts one child process. Use @ITEM/ENV or --item and --branch. The parent shell is unchanged. Nothing lands on disk. Nothing goes in argv. Windows at launch uses this path. Do not sell it as agents never seeing secrets. When the app is open, wrap agents with arca agent instead.

Open ARCA CLI

Why ARCA

A cloudless secrets manager for you and the agents that work for you, plus the tools and fail-safes to live with it. Made with Rust and designed to run blazingly fast.

Your Vault, Your Rules: No account, no subscription, no cloud. Your secrets live in one encrypted file you own. The vault format is publicly auditable. Sync it anywhere, or nowhere.
More than Just a Vault: Generate strong passwords and inspect tokens from one toolbox. Inject is Pro.
Arca Agent: Wrap Cursor and Claude Code with arca agent. Dummy tokens in the child; Arca attaches the real secret on the wire. Needs the running macOS app first. Wrap and start are Pro. status and stop stay free.
Multi-line Secrets Editor: One Env item holds the same keys across default, staging, and production. Edit values in place, masked until you look, then inject that environment by name into a script. No .env files on disk. Editing Env items in the app is free.
Multiple Vaults: Keep work, personal, and client secrets in named vaults inside one encrypted file. Switch from the title bar; manage under Settings → Data → Vaults.
Vault Health Check: Spot weak, reused, and aging passwords at a glance. Arca grades every entry and tells you what to fix first.

Frequently asked questions

Do I need an account to use ARCA? No. ARCA is fully local: your secrets live in one encrypted file on your machine. No account, no cloud, no telemetry, no subscription for the core vault.
How does ARCA work with Claude Code, Cursor, or GitHub Copilot? You wrap them with arca agent on the macOS app. They keep calling real APIs. Dummy tokens stay in their environment; Arca attaches the real secret on the wire. Windows at launch is the vault plus inject: arca inject works, and the child sees secrets — that is not the broker. SSH keys use arca ssh (also needs the running app).
Is ARCA open source? The cryptographic core, vault format, and codec are open source as arca-core under AGPL-3.0. The desktop shell, CLI, ssh-agent, and licensing are proprietary.
Is there a free tier? Yes. Free vault. $0 forever. Unlock, search, store, CLI CRUD, local socket, and Shamir recovery. Inject, env import, agent wrap / start, and ssh add are Pro. status, stop, and ssh list / remove / flush stay free. One table: https://www.arca.vision/artifacts/arca/cli#free-vs-pro. Pricing: https://www.arca.vision/artifacts/arca#pricing. ARCA Pro is $99 once.
Where do my secrets live? In a single encrypted vault file on your machine, derived with Argon2id and sealed with XChaCha20-Poly1305. Sync it anywhere, or nowhere. Pro users can keep Multiple vaults (work, personal, client-separated) inside that same encrypted file.