git-crypt

git-crypt command [options]

git-crypt enables transparent encryption of files in a Git repository. Configured files are encrypted when committed and decrypted when checked out, allowing sensitive data to be stored securely alongside regular code.Encryption is configured via .gitattributes patterns. Users with the symmetric key or authorized GPG keys can unlock the repository to view and edit protected files.

init [-k keyname]

Generate a key and prepare the repository to use git-crypt.

Add GPG user(s) who can unlock the repository. -n, --no-commit skips auto-committing the change; --trusted skips the GPG web-of-trust check.

Decrypt the repository. Uses GPG-encrypted keys by default, or a symmetric key file if given.

Re-encrypt files and remove the cached key. -a, --all locks every key instead of just the default; -f, --force locks even if the working directory is unclean.

Export the symmetric key to file.

Show encryption status of files. -e shows only encrypted files, -u only unencrypted files, -f, --fix encrypts files that should be encrypted but weren't.

.gitattributes

Defines which files are encrypted using filter and diff attributes.

$ secrets/** filter=git-crypt diff=git-crypt
*.key filter=git-crypt diff=git-crypt
.env filter=git-crypt diff=git-crypt

Encrypted files appear as binary. File names are not encrypted. Requires GPG for multi-user access. History contains encrypted versions. Not for large files (use git-lfs).

git-crypt was created by Andrew Ayer to solve the problem of storing secrets in git repositories. It provides simpler setup than alternative approaches like git-secret.

git(1), gpg(1), git-secret(1)

Source code