The JitPass mark: a green dot inside a soft ring

JitPass

You have API keys and tokens in plaintext on your Mac.
Use JitPass to protect them.

Download for Mac · brew install jitpass/tap/jitpass · Docs · jitpass.com

_{Free for personal and internal company use · Source-available · No account · No telemetry · Nothing leaves your Mac · Secure Enclave ready · Every change can be undone}

_{What's the number on your Mac? The scan only reads, and changes nothing until you say so.}

Get started The problem · Three steps · Install · The menu bar
Protect Findings and decoys · Your tools keep working · Undo anything
Approve Two Touch ID moments · Grants · The audit
AI agents Built for AI agents · AI jobs · A grant or an AI job?
More How it compares · How it works · What it does not do · Docs

Your secrets are in plain files. Anything you run can read them.

API keys in .env, cloud credentials in ~/.aws/credentials, tokens in .npmrc, exports in ~/.zshrc, your shell history, the MCP configs your agents read. Nothing has to be hacked for them to leak. A compromised npm package, a trojanized IDE extension or a prompt-injected agent runs as you, so it can simply open the file.

JitPass moves each secret into a local vault that opens with Touch ID, and leaves a decoy where the plaintext was.

Three steps, about two minutes

The Findings window: 18 secrets in your vault, 4 still have plaintext copies, 2 files jit can protect, 9 flagged lines in Claude Code's transcripts, each with the one thing to do.

1. Find

Setup scans your Mac and changes nothing. It recognises 100+ token formats (OpenAI, Anthropic, AWS, GitHub, Stripe and more), plus private keys and database URLs.

Setup, done: 78% protected, 18 of 23 secrets in the vault, with options to save a recovery file, open at login, and get notified of decoy reads.

2. Protect

One click moves each secret into the vault and leaves a decoy in its place. Every file is backed up first, and your tools keep working.

The macOS Touch ID dialog: JitPass is trying to let aws use your aws credential, via claude. Use Password or Cancel.

3. Approve

When a program reaches for a real key, JitPass names it and what launched it in the Touch ID dialog. Touch to allow, or cancel.

No terminal needed: open JitPass and setup walks you through steps 1 and 2.

Prefer the terminal? The same three steps as commands

jit scan                 # read-only: every exposed secret, file and line
jit migrate --dry-run    # preview the whole fix plan
jit migrate              # apply it: shows the plan, asks [y/N], one Touch ID
jit audit                # afterwards: every request, and what you answered

jit scan with no path sweeps your home folder; point it somewhere to go faster (jit scan ~/.aws). Everything the app does is one of these commands.

Download for Mac · brew install jitpass/tap/jitpass
_{Free · No account · Every change can be undone}

jit

Most Popular