{"slug": "secretive", "name": "Secretive", "category": "security", "category_name": "Security and passwords", "description": "Open-source macOS app that stores SSH keys in the Mac's Secure Enclave.", "recommenders": 5, "commenters": 5, "warners": 0, "score": 4.496, "rising": 1.02, "first": "2025-11-23", "latest": "2026-10-21", "why": "Recommended for Mac users who want to know exactly when their SSH key is used, with long-time users preferring it to physical key and card setups.", "why_is_quote": false, "has_verdict": true, "sentiment": {"recommend": 5, "neutral": 0, "compare": 0, "warn": 0}, "spark": [2, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 2], "listed": true, "loved": ["Long-term use", "Key-use visibility"], "caveat": "Native alternative", "short_quote": "If you're on a Mac, I can highly recommend you to check out Secretive", "icon": true, "domain": null, "github_repo": "github.com/maxgoedjen/secretive", "official_url": "https://github.com/maxgoedjen/secretive", "pricing": "open source", "aliases": ["Secretive"], "verdict": [{"text": "Recommended for Mac users who want to know exactly when their SSH key is used,", "cites": [{"id": 769683873, "item_id": 48105242, "url": "https://news.ycombinator.com/item?id=48105242", "by": "Myzel394", "date": "2026-05-12", "stance": "recommend", "quote": "If you're on a Mac, I can highly recommend you to check out Secretive", "excerpt": "I'm not a huge fan of 1Password, there have been way too many issues in the past with it. If you're on a Mac, I can highly recommend you to check out Secretive https://github.com/maxgoedjen/secretive", "context": "", "use_case": "SSH key storage on Mac", "switched_from": "", "story": "TanStack NPM Packages Compromised"}, {"id": 736415008, "item_id": 46025938, "url": "https://news.ycombinator.com/item?id=46025938", "by": "epistasis", "date": "2025-11-23", "stance": "recommend", "quote": "I've been using Secretive for years", "excerpt": "Whoa, that is pretty cool. I've been using Secretive for years, and prefer it to all the physical key/card based systems I've tried to get going over the years. I know exactly when my SSH key is used for any operation, because I need to hit a button or do a fingerprint scan. I can keep ssh-agent tunnels to remote boxes so that I can sign git commits remotely without having to worry about a rogue system getting comple", "context": "", "use_case": "Secure Enclave SSH keys", "switched_from": "", "story": "Native Secure Enclave backed SSH keys on macOS"}, {"id": 736830448, "item_id": 46051903, "url": "https://news.ycombinator.com/item?id=46051903", "by": "n0ot", "date": "2025-11-25", "stance": "recommend", "quote": "I use Secretive and would like to switch to this native solution.", "excerpt": "This seems really cool. I use Secretive and would like to switch to this native solution. The one thing holding me back is that I like that Secretive allows you to create keys that don't require TouchID, yet still notifies you when they are used. I use an external keyboard, so reaching for the fingerprint reader isn't as easy as it would be if I just used the internal keyboard. Fine, ControlMaster is a good compromis", "context": "uses external keyboard, signs every commit", "use_case": "Secure Enclave SSH keys, git signing", "switched_from": "", "story": "Native Secure Enclave backed SSH keys on macOS"}]}, {"text": " with long-time users preferring it to physical key and card setups.", "cites": [{"id": 736415008, "item_id": 46025938, "url": "https://news.ycombinator.com/item?id=46025938", "by": "epistasis", "date": "2025-11-23", "stance": "recommend", "quote": "I've been using Secretive for years", "excerpt": "Whoa, that is pretty cool. I've been using Secretive for years, and prefer it to all the physical key/card based systems I've tried to get going over the years. I know exactly when my SSH key is used for any operation, because I need to hit a button or do a fingerprint scan. I can keep ssh-agent tunnels to remote boxes so that I can sign git commits remotely without having to worry about a rogue system getting comple", "context": "", "use_case": "Secure Enclave SSH keys", "switched_from": "", "story": "Native Secure Enclave backed SSH keys on macOS"}, {"id": 802852592, "item_id": 50178287, "url": "https://news.ycombinator.com/item?id=50178287", "by": "ulimn", "date": "2026-10-21", "stance": "recommend", "quote": "I've been using Secretive for years", "excerpt": "I've been using Secretive for years because I didn't bother looking it up how to do it without. I think this is worth doing without an additional third party, especially since it's only a few commands.", "context": "", "use_case": "SSH keys with Touch ID", "switched_from": "", "story": "Setting Up SSH Keys on macOS with Touch ID"}]}, {"text": " The main caveats are that the same setup can now be done natively without a third-party tool,", "cites": [{"id": 802852592, "item_id": 50178287, "url": "https://news.ycombinator.com/item?id=50178287", "by": "ulimn", "date": "2026-10-21", "stance": "recommend", "quote": "I've been using Secretive for years", "excerpt": "I've been using Secretive for years because I didn't bother looking it up how to do it without. I think this is worth doing without an additional third party, especially since it's only a few commands.", "context": "", "use_case": "SSH keys with Touch ID", "switched_from": "", "story": "Setting Up SSH Keys on macOS with Touch ID"}, {"id": 736830448, "item_id": 46051903, "url": "https://news.ycombinator.com/item?id=46051903", "by": "n0ot", "date": "2025-11-25", "stance": "recommend", "quote": "I use Secretive and would like to switch to this native solution.", "excerpt": "This seems really cool. I use Secretive and would like to switch to this native solution. The one thing holding me back is that I like that Secretive allows you to create keys that don't require TouchID, yet still notifies you when they are used. I use an external keyboard, so reaching for the fingerprint reader isn't as easy as it would be if I just used the internal keyboard. Fine, ControlMaster is a good compromis", "context": "uses external keyboard, signs every commit", "use_case": "Secure Enclave SSH keys, git signing", "switched_from": "", "story": "Native Secure Enclave backed SSH keys on macOS"}]}, {"text": " and that the Tahoe version is reported as buggy.", "cites": [{"id": 736415008, "item_id": 46025938, "url": "https://news.ycombinator.com/item?id=46025938", "by": "epistasis", "date": "2025-11-23", "stance": "recommend", "quote": "I've been using Secretive for years", "excerpt": "Whoa, that is pretty cool. I've been using Secretive for years, and prefer it to all the physical key/card based systems I've tried to get going over the years. I know exactly when my SSH key is used for any operation, because I need to hit a button or do a fingerprint scan. I can keep ssh-agent tunnels to remote boxes so that I can sign git commits remotely without having to worry about a rogue system getting comple", "context": "", "use_case": "Secure Enclave SSH keys", "switched_from": "", "story": "Native Secure Enclave backed SSH keys on macOS"}]}], "praise": [{"label": "Long-term use", "summary": "Commenters report using it for years and recommend it outright.", "quotes": [{"id": 802852592, "item_id": 50178287, "url": "https://news.ycombinator.com/item?id=50178287", "by": "ulimn", "date": "2026-10-21", "stance": "recommend", "quote": "I've been using Secretive for years", "excerpt": "I've been using Secretive for years because I didn't bother looking it up how to do it without. I think this is worth doing without an additional third party, especially since it's only a few commands.", "context": "", "use_case": "SSH keys with Touch ID", "switched_from": "", "story": "Setting Up SSH Keys on macOS with Touch ID"}, {"id": 736415008, "item_id": 46025938, "url": "https://news.ycombinator.com/item?id=46025938", "by": "epistasis", "date": "2025-11-23", "stance": "recommend", "quote": "I've been using Secretive for years", "excerpt": "Whoa, that is pretty cool. I've been using Secretive for years, and prefer it to all the physical key/card based systems I've tried to get going over the years. I know exactly when my SSH key is used for any operation, because I need to hit a button or do a fingerprint scan. I can keep ssh-agent tunnels to remote boxes so that I can sign git commits remotely without having to worry about a rogue system getting comple", "context": "", "use_case": "Secure Enclave SSH keys", "switched_from": "", "story": "Native Secure Enclave backed SSH keys on macOS"}, {"id": 802696256, "item_id": 50168516, "url": "https://news.ycombinator.com/item?id=50168516", "by": "colesantiago", "date": "2026-10-20", "stance": "recommend", "quote": "Or you could just use Secretive.", "excerpt": "Or you could just use Secretive. https://github.com/maxgoedjen/secretive", "context": "", "use_case": "SSH keys with Touch ID", "switched_from": "", "story": "SSH Keys on macOS with Touch ID"}]}, {"label": "Key-use visibility", "summary": "Every SSH key operation requires a button press or fingerprint, or at least triggers a notification.", "quotes": [{"id": 736415008, "item_id": 46025938, "url": "https://news.ycombinator.com/item?id=46025938", "by": "epistasis", "date": "2025-11-23", "stance": "recommend", "quote": "I've been using Secretive for years", "excerpt": "Whoa, that is pretty cool. I've been using Secretive for years, and prefer it to all the physical key/card based systems I've tried to get going over the years. I know exactly when my SSH key is used for any operation, because I need to hit a button or do a fingerprint scan. I can keep ssh-agent tunnels to remote boxes so that I can sign git commits remotely without having to worry about a rogue system getting comple", "context": "", "use_case": "Secure Enclave SSH keys", "switched_from": "", "story": "Native Secure Enclave backed SSH keys on macOS"}, {"id": 736830448, "item_id": 46051903, "url": "https://news.ycombinator.com/item?id=46051903", "by": "n0ot", "date": "2025-11-25", "stance": "recommend", "quote": "I use Secretive and would like to switch to this native solution.", "excerpt": "This seems really cool. I use Secretive and would like to switch to this native solution. The one thing holding me back is that I like that Secretive allows you to create keys that don't require TouchID, yet still notifies you when they are used. I use an external keyboard, so reaching for the fingerprint reader isn't as easy as it would be if I just used the internal keyboard. Fine, ControlMaster is a good compromis", "context": "uses external keyboard, signs every commit", "use_case": "Secure Enclave SSH keys, git signing", "switched_from": "", "story": "Native Secure Enclave backed SSH keys on macOS"}]}, {"label": "Mac-friendly", "summary": "Highly recommended to Mac users, including as an alternative to 1Password.", "quotes": [{"id": 769683873, "item_id": 48105242, "url": "https://news.ycombinator.com/item?id=48105242", "by": "Myzel394", "date": "2026-05-12", "stance": "recommend", "quote": "If you're on a Mac, I can highly recommend you to check out Secretive", "excerpt": "I'm not a huge fan of 1Password, there have been way too many issues in the past with it. If you're on a Mac, I can highly recommend you to check out Secretive https://github.com/maxgoedjen/secretive", "context": "", "use_case": "SSH key storage on Mac", "switched_from": "", "story": "TanStack NPM Packages Compromised"}]}, {"label": "Beats hardware keys", "summary": "One user prefers it to the physical key and card systems they tried.", "quotes": [{"id": 736415008, "item_id": 46025938, "url": "https://news.ycombinator.com/item?id=46025938", "by": "epistasis", "date": "2025-11-23", "stance": "recommend", "quote": "I've been using Secretive for years", "excerpt": "Whoa, that is pretty cool. I've been using Secretive for years, and prefer it to all the physical key/card based systems I've tried to get going over the years. I know exactly when my SSH key is used for any operation, because I need to hit a button or do a fingerprint scan. I can keep ssh-agent tunnels to remote boxes so that I can sign git commits remotely without having to worry about a rogue system getting comple", "context": "", "use_case": "Secure Enclave SSH keys", "switched_from": "", "story": "Native Secure Enclave backed SSH keys on macOS"}]}, {"label": "Flexible auth", "summary": "Keys can skip Touch ID but still notify you when used, which helps with external keyboards.", "quotes": [{"id": 736830448, "item_id": 46051903, "url": "https://news.ycombinator.com/item?id=46051903", "by": "n0ot", "date": "2025-11-25", "stance": "recommend", "quote": "I use Secretive and would like to switch to this native solution.", "excerpt": "This seems really cool. I use Secretive and would like to switch to this native solution. The one thing holding me back is that I like that Secretive allows you to create keys that don't require TouchID, yet still notifies you when they are used. I use an external keyboard, so reaching for the fingerprint reader isn't as easy as it would be if I just used the internal keyboard. Fine, ControlMaster is a good compromis", "context": "uses external keyboard, signs every commit", "use_case": "Secure Enclave SSH keys, git signing", "switched_from": "", "story": "Native Secure Enclave backed SSH keys on macOS"}]}], "caveats": [{"label": "Native alternative", "summary": "Some commenters say a built-in approach takes only a few commands and avoids a third-party tool.", "quotes": [{"id": 802852592, "item_id": 50178287, "url": "https://news.ycombinator.com/item?id=50178287", "by": "ulimn", "date": "2026-10-21", "stance": "recommend", "quote": "I've been using Secretive for years", "excerpt": "I've been using Secretive for years because I didn't bother looking it up how to do it without. I think this is worth doing without an additional third party, especially since it's only a few commands.", "context": "", "use_case": "SSH keys with Touch ID", "switched_from": "", "story": "Setting Up SSH Keys on macOS with Touch ID"}, {"id": 736830448, "item_id": 46051903, "url": "https://news.ycombinator.com/item?id=46051903", "by": "n0ot", "date": "2025-11-25", "stance": "recommend", "quote": "I use Secretive and would like to switch to this native solution.", "excerpt": "This seems really cool. I use Secretive and would like to switch to this native solution. The one thing holding me back is that I like that Secretive allows you to create keys that don't require TouchID, yet still notifies you when they are used. I use an external keyboard, so reaching for the fingerprint reader isn't as easy as it would be if I just used the internal keyboard. Fine, ControlMaster is a good compromis", "context": "uses external keyboard, signs every commit", "use_case": "Secure Enclave SSH keys, git signing", "switched_from": "", "story": "Native Secure Enclave backed SSH keys on macOS"}]}, {"label": "Tahoe bugs", "summary": "The Tahoe version is reported to frequently lock up on initial key requests.", "quotes": [{"id": 736415008, "item_id": 46025938, "url": "https://news.ycombinator.com/item?id=46025938", "by": "epistasis", "date": "2025-11-23", "stance": "recommend", "quote": "I've been using Secretive for years", "excerpt": "Whoa, that is pretty cool. I've been using Secretive for years, and prefer it to all the physical key/card based systems I've tried to get going over the years. I know exactly when my SSH key is used for any operation, because I need to hit a button or do a fingerprint scan. I can keep ssh-agent tunnels to remote boxes so that I can sign git commits remotely without having to worry about a rogue system getting comple", "context": "", "use_case": "Secure Enclave SSH keys", "switched_from": "", "story": "Native Secure Enclave backed SSH keys on macOS"}]}], "who": [{"by": "n0ot", "context": "uses external keyboard, signs every commit", "url": "https://news.ycombinator.com/item?id=46051903", "date": "2025-11-25"}], "tags": ["for Mac users", "for SSH keys", "for git commit signing"], "use_cases": ["ssh keys with touch id", "ssh key storage on mac", "secure enclave ssh keys, git signing", "secure enclave ssh keys"], "compared": [], "makers": [{"id": 786948464, "item_id": 49184279, "url": "https://news.ycombinator.com/item?id=49184279", "by": "radlad", "date": "2026-08-05", "stance": "neutral", "quote": "I was using software called \"Secretive\" which installed a Secretive Agent system service. I later patched and forked it", "excerpt": "> I don't get asked about access for Chrome at every update. Is it possible that you clicked \"Approve\" while the parent clicked \"Not now\"? One of my personal issues is that I was using software called \"Secretive\" which installed a Secretive Agent system service. I later patched and forked it, but reused the name. Despite the app bundle ID being different, and having a different signer, they show up collapsed in the \"", "context": "", "use_case": "SSH key management on macOS", "switched_from": "", "story": "\"Gravity is worth asking about.\""}], "threads": [{"url": "https://news.ycombinator.com/item?id=46025721", "title": "Native Secure Enclave backed SSH keys on macOS", "mentions": 2}, {"url": "https://news.ycombinator.com/item?id=50175882", "title": "Setting Up SSH Keys on macOS with Touch ID", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=50168435", "title": "SSH Keys on macOS with Touch ID", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=49105978", "title": "\"Gravity is worth asking about.\"", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=48100706", "title": "TanStack NPM Packages Compromised", "mentions": 1}], "sentiment_by_month": {"2025-11": {"recommend": 2}, "2025-12": {}, "2026-01": {}, "2026-02": {}, "2026-03": {}, "2026-04": {}, "2026-05": {"recommend": 1}, "2026-06": {}, "2026-07": {}, "2026-08": {}, "2026-09": {}, "2026-10": {"recommend": 2}}, "quotes": [{"id": 802852592, "item_id": 50178287, "url": "https://news.ycombinator.com/item?id=50178287", "by": "ulimn", "date": "2026-10-21", "stance": "recommend", "quote": "I've been using Secretive for years", "excerpt": "I've been using Secretive for years because I didn't bother looking it up how to do it without. I think this is worth doing without an additional third party, especially since it's only a few commands.", "context": "", "use_case": "SSH keys with Touch ID", "switched_from": "", "story": "Setting Up SSH Keys on macOS with Touch ID"}, {"id": 802696256, "item_id": 50168516, "url": "https://news.ycombinator.com/item?id=50168516", "by": "colesantiago", "date": "2026-10-20", "stance": "recommend", "quote": "Or you could just use Secretive.", "excerpt": "Or you could just use Secretive. https://github.com/maxgoedjen/secretive", "context": "", "use_case": "SSH keys with Touch ID", "switched_from": "", "story": "SSH Keys on macOS with Touch ID"}, {"id": 769683873, "item_id": 48105242, "url": "https://news.ycombinator.com/item?id=48105242", "by": "Myzel394", "date": "2026-05-12", "stance": "recommend", "quote": "If you're on a Mac, I can highly recommend you to check out Secretive", "excerpt": "I'm not a huge fan of 1Password, there have been way too many issues in the past with it. If you're on a Mac, I can highly recommend you to check out Secretive https://github.com/maxgoedjen/secretive", "context": "", "use_case": "SSH key storage on Mac", "switched_from": "", "story": "TanStack NPM Packages Compromised"}, {"id": 736830448, "item_id": 46051903, "url": "https://news.ycombinator.com/item?id=46051903", "by": "n0ot", "date": "2025-11-25", "stance": "recommend", "quote": "I use Secretive and would like to switch to this native solution.", "excerpt": "This seems really cool. I use Secretive and would like to switch to this native solution. The one thing holding me back is that I like that Secretive allows you to create keys that don't require TouchID, yet still notifies you when they are used. I use an external keyboard, so reaching for the fingerprint reader isn't as easy as it would be if I just used the internal keyboard. Fine, ControlMaster is a good compromis", "context": "uses external keyboard, signs every commit", "use_case": "Secure Enclave SSH keys, git signing", "switched_from": "", "story": "Native Secure Enclave backed SSH keys on macOS"}, {"id": 736415008, "item_id": 46025938, "url": "https://news.ycombinator.com/item?id=46025938", "by": "epistasis", "date": "2025-11-23", "stance": "recommend", "quote": "I've been using Secretive for years", "excerpt": "Whoa, that is pretty cool. I've been using Secretive for years, and prefer it to all the physical key/card based systems I've tried to get going over the years. I know exactly when my SSH key is used for any operation, because I need to hit a button or do a fingerprint scan. I can keep ssh-agent tunnels to remote boxes so that I can sign git commits remotely without having to worry about a rogue system getting comple", "context": "", "use_case": "Secure Enclave SSH keys", "switched_from": "", "story": "Native Secure Enclave backed SSH keys on macOS"}]}