███████╗███████╗ ██████╗██████╗ ███████╗████████╗ ╚══███╔╝██╔════╝██╔════╝██╔══██╗██╔════╝╚══██╔══╝ ███╔╝ █████╗ ██║ ██████╔╝█████╗ ██║ ███╔╝ ██╔══╝ ██║ ██╔══██╗██╔══╝ ██║ ███████╗███████╗╚██████╗██║ ██║███████╗ ██║ ╚══════╝╚══════╝ ╚═════╝╚═╝ ╚═╝╚══════╝ ╚═╝
An encrypted terminal diary
One entry a day, kept in a single encrypted file that only you can open. No server, no account, no sync, no telemetry — there is nowhere for your writing to go.
uv tool install zecret
August 2026 · 5 entries Thu 13 First frost on the windscreen. Scraped it off with a librar… Wed 12 Notes on rereading Bachelard: the drawer chapter still does… Tue 11 Kitchen notes. The sourdough finally behaved — less water,… Mon 10 A letter I did not send. Wrote it out anyway, which is most… Sun 09 Tuesday. Nothing happened and I am writing that down on pur… July 2026 · 3 entries Fri 31 Walked the long way back along the canal. The herons have w… Tue 28 Finished the tax forms, badly. Rewarded myself with an appl… Sat 25 Rain all day. Read two chapters and slept like something hi…
A diary, not a note app
The date is the entry. Open a day you have already written and you continue it, rather than starting a second page about the same afternoon.
One entry a day
Each day is a page, named by its date. Reopening a day continues it; there is no way to file two entries against one afternoon.
Encrypted at rest
Argon2id key derivation and AES-256-GCM, with every day's entry encrypted independently under its own nonce.
Instant search
Your entries are already decrypted in memory for the session, so filtering happens as you type and nothing touches the disk.
One portable file
Back it up by copying it. Without your password it is useless to whoever ends up holding it.
Light and dark
Eight themes, chosen in settings and remembered — including the lock screen, before the diary is even open.
Locks itself
Walk away and the diary closes behind you, asking for your password again. A half-written entry holds it open rather than being thrown away by a timer.
Covers the page
Writing on a train? One key puts every word behind a bar except the one your cursor is touching. It hides what you have already written — the word you are typing is revealed as you type it — and the text underneath is untouched, so what you save is what you wrote.
Offline by design
No networking of any kind, in any code path. Nothing to opt out of, and nothing to audit for leaks.
What protects it
The parts worth checking before you trust anything with a diary.
- Key derivation
- Argon2id — time_cost 3, 64 MiB, parallelism 4 — with a random 16-byte salt per diary. Your password is never stored; the derived key never touches disk.
- Encryption
- AES-256-GCM with a fresh random nonce for every single encryption. Each day is encrypted independently, so editing one never re-encrypts the others.
- Integrity
- Tampering with a stored entry, or a wrong password, fails authentication and is reported as an error — never as an empty or partial diary. The header carries an encrypted verifier, so that holds even for a diary with no entries yet.
- Durability
- Saves are atomic: temp file, fsync, then rename over the original. An interrupted save cannot leave a half-written diary, and the file is created 0600.
- Two windows open
- A second Zecret on the same file is detected before anything is written, so one session cannot silently overwrite what the other just saved. Creating a diary claims the path in the same indivisible step that writes it, so two first runs cannot land on top of each other either.
- Plaintext
- Never written to disk — not as temp files, not as logs, not for crash recovery.
Two things it does not do. Anyone holding the file can see which days you wrote on, though not a word of what they say — the dates are the index, and indexes have to be readable to be used. And there is no password recovery, by design: nobody, including you, can open the file without the password.
Install
Zecret needs Python 3.13 or newer. uv installs a suitable interpreter for you, so nothing depends on what your system happens to ship.
As a tool
$ uv tool install zecret $ zecret
uv fetches a suitable Python along with it. pipx install zecret and pip install zecret work too, on 3.13 or newer.
From a checkout
$ git clone https://github.com/kfurtak1024/zecret $ cd zecret $ uv sync $ uv run zecret
Where the diary lives
$ zecret --path /some/where.enc
By default ~/.zecret/diary.enc, overridable with --path or ZECRET_DIARY_PATH. On first launch Zecret asks you to choose a master password and creates the file. Settings follow you rather than the diary, so a second diary keeps your theme — unless you give that run preferences of its own with --config. zecret --help lists both flags and both environment variables; zecret --version says which Zecret you have without opening the diary.
Keys
Press ? in the app for the same list, always current.
| Key | Where | Does |
|---|---|---|
| n | entry list | Write about today |
| a | entry list | Write about another day |
| enter | entry list | Open the selected day |
| d | entry list | Delete the selected day's entry |
| r | entry list | Re-read the file, picking up another Zecret's writing |
| / | entry list | Search |
| s | entry list | Settings: theme, locking, master password |
| ctrl + l | entry list, editor | Lock the diary without quitting — saves the day you are writing first |
| ? | entry list | Help |
| q | entry list | Quit |
| ctrl + s | editor | Save, and carry on writing |
| ctrl + r | editor | Cover the writing, leaving only the word you are on |
| esc | anywhere | Back |
ctrl + q quits from anywhere, including a screen with a password box on it where a bare q would only be typed. It asks first if you are part-way through writing a day, exactly as backing out of that day does — and either question offers to save the day on the way out, so the choice is never between losing the last paragraph and staying put.
Getting around a long diary: j and k or the arrow keys move a day at a time, g and G (or home and end) jump to the newest and oldest entries, and the page keys move a screenful. None of these crowd the bar at the bottom; all of them are listed under ?.
Inside a day, the editor answers to the usual text-editing keys — ctrl + home and ctrl + end for the two ends of the entry, ctrl + a to select all of it, and the rest of what your fingers already know. Those are the one thing ? does not list: it is a page about the diary, and these mean here exactly what they mean everywhere else.