Otter Vault

Product Introduction

1. Definition: Otter Vault is a local-first, privacy-focused browser extension and macOS menu bar application designed for API key management and secret detection. It falls under the technical categories of developer security tools, credential management, and local encryption software.
2. Core Value Proposition: It exists to prevent accidental API key exposure by automatically detecting and securely storing secrets directly on a user's device, eliminating the risk and complexity associated with cloud-based password managers or manual secret handling for developers and technical teams.

Main Features

1. Real-time Secret Detection: Otter Vault passively monitors browser activity and system clipboard for the appearance of new API keys and secrets. It uses pattern-matching algorithms to detect credentials from major providers like OpenAI, Anthropic, Vercel, Cloudflare, Supabase, and GitHub the moment they are generated or copied.
2. Local Encrypted Vault: All detected secrets are encrypted locally using AES-256-GCM encryption. The encryption key is derived from a user-supplied passphrase using 600,000 rounds of PBKDF2 key derivation. No data, encrypted or otherwise, is ever transmitted to an external server, ensuring zero-trust security.
3. Native macOS Menu Bar Companion: The companion application provides system-level access to the encrypted vault from the macOS menu bar. It features a click-through, cursor-following interface that remains accessible without obstructing workflow, allowing for quick secret retrieval and copying with automatic clipboard clearing.

Problems Solved

1. Pain Point: Accidental secret leakage in developer workflows, such as committing API keys to public GitHub repositories, pasting them into insecure notes, or losing track of them across multiple projects and terminals.
2. Target Audience: Software developers, DevOps engineers, AI/ML engineers, and technical founders who regularly work with multiple API keys, cloud service credentials, and need a frictionless way to manage secrets locally without SaaS account overhead.
3. Use Cases: Securely storing a new OpenAI API key generated in the developer console; capturing a temporary Vercel access token from the CLI output; managing project-specific Supabase anon keys during local development; providing a secure, offline alternative to team password managers for development secrets.

Unique Advantages

1. Differentiation: Unlike cloud-based password managers (1Password, LastPass) or developer secret stores (HashiCorp Vault), Otter Vault operates entirely offline with no account, subscription, or network dependency. It prioritizes passive detection and local encryption over centralized storage and sharing features.
2. Key Innovation: Its "set-and-forget" detection engine that works across browser tabs and the terminal, combined with a publicly documented threat model and a rigorous testing regimen (including 86 tests, seeded fuzzing, and weekly end-to-end provider console tests), offers a uniquely transparent and automated local-first security model.

Frequently Asked Questions (FAQ)

1. Is Otter Vault a cloud service or password manager? No, Otter Vault is neither. It is a local application that performs all encryption and storage exclusively on your device. No data, including encrypted vaults or analytics, is sent to any server.
2. How does Otter Vault detect API keys securely? The extension uses client-side pattern matching to identify common API key formats (like those from OpenAI or GitHub) directly in your browser's memory. The actual key value is only processed locally for encryption and is never sent over the network for validation.
3. What happens if I forget my Otter Vault passphrase? Your passphrase is the only key to your locally encrypted vault. The application uses strong derivation (PBKDF2) and does not have a recovery mechanism. If you forget your passphrase, the encrypted data cannot be decrypted, by design, to ensure security.
4. Can Otter Vault sync secrets across my devices? The current version does not support syncing, as it is designed as a local-only vault to eliminate attack vectors associated with data transmission and cloud storage. Secrets are managed per-device.
5. Is the Otter Vault Chrome extension safe to use? The extension is open for review in the Chrome Web Store and operates with minimal permissions required for its detection function. Its code and security model are publicly documented, and it undergoes regular automated security testing.