███████╗███████╗ ██████╗██████╗ ███████╗████████╗ ╚══███╔╝██╔════╝██╔════╝██╔══██╗██╔════╝╚══██╔══╝ ███╔╝ █████╗ ██║ ██████╔╝█████╗ ██║ ███╔╝ ██╔══╝ ██║ ██╔══██╗██╔══╝ ██║ ███████╗███████╗╚██████╗██║ ██║███████╗ ██║ ╚══════╝╚══════╝ ╚═════╝╚═╝ ╚═╝╚══════╝ ╚═╝
An encrypted terminal diary
One entry a day, kept in a single encrypted file that only you can open. No server, no account, no sync, no telemetry — there is nowhere for your writing to go.
uv tool install zecret
Zecret — 8 entries August 2026 · 5 entries Thu 13 Long walk once the rain stopped. The lane past the mill … Wed 12 Finished the book about lighthouse keepers. The last cha… Sun 09 Coffee with Sam. We talked about moving north again, and… Tue 04 Bread came out flat. Too impatient with the second prove… Sat 01 Quiet start to the month. Spent the evening fixing the g… July 2026 · 3 entries Wed 29 Swam before breakfast. Cold, then not. Rain came in by n… Fri 24 Turned the desk to face the window. Better already. Sat 18 Rain all day. Made soup, read, did not go out once.
A diary, not a note app
The date is the entry. Open a day you have already written and you continue it, rather than starting a second page about the same afternoon.
One entry a day
Each day is a page, named by its date. Reopening a day continues it; there is no way to file two entries against one afternoon.
The month at a glance
Choosing a day shows you the month it is in, with every day you have already written marked. Type the date if you know it, or walk the calendar to the one you mean.
Encrypted at rest
Argon2id key derivation and AES-256-GCM, with every day's entry encrypted independently under its own nonce.
Instant search
Your entries are already decrypted in memory for the session, so filtering happens as you type and nothing touches the disk.
One portable file
Back it up by copying it. Without your password it is useless to whoever ends up holding it.
Light and dark
Eight themes, chosen in settings and remembered — including the lock screen, before the diary is even open.
Locks itself
Walk away and the diary closes behind you, asking for your password again. A half-written entry holds it open rather than being thrown away by a timer.
Covers the page
Writing on a train? One key puts every word behind a bar except the one your cursor is touching. It hides what you have already written — the word you are typing is revealed as you type it — and the text underneath is untouched, so what you save is what you wrote.
Offline by design
No networking of any kind, in any code path. Nothing to opt out of, and nothing to audit for leaks.
Writing with someone behind you
ctrl + r puts every word behind a bar except the one the cursor is touching, so the page can be read over your shoulder and say nothing. The bars are drawn on the way to the screen and never written down: what you save is what you wrote, and the word you are typing is revealed as you type it.
Zecret — Thursday, 13 August 2026 ╭────────────────────────────────────────────────────────────────────╮ │ ▆▆▆▆ ▆▆▆▆ ▆▆▆▆ ▆▆▆ ▆▆▆▆ stopped. ▆▆▆ ▆▆▆▆ ▆▆▆▆ ▆▆▆ ▆▆▆▆ ▆▆▆ │ │ ▆▆▆▆▆ ▆▆▆▆▆ ▆▆▆▆▆▆ ▆▆ ▆ ▆▆▆▆ ▆▆ ▆▆▆ ▆▆▆▆ ▆▆▆▆▆▆▆ ▆▆▆ ▆▆▆▆▆ ▆▆ │ │ ▆▆▆▆▆▆▆ ▆▆▆▆▆▆ ▆▆▆▆▆ ▆▆ ▆▆ ▆▆▆▆▆▆▆▆ │ │ │ │ ▆▆▆▆ ▆▆▆▆ ▆▆▆ ▆▆▆▆ ▆▆▆▆ ▆▆▆▆▆ ▆▆▆ │ │ │ ╰────────────────────────────────────────────────────────────────────╯
Writing about another day
a asks which day. Type the date if you know it — the month below follows as you type — or step into the calendar and walk to the day you mean. The days you have already written are marked, so the month reads at a glance. Days that have not happened are not on offer: a diary records what did.
Zecret — 8 entries Which day? ╭────────────────────────────────╮ │ 2026-08-05 │ ╰────────────────────────────────╯ Type a date, or tab to the calendar. August 2026 Mo Tu We Th Fr Sa Su 1• 2 3 4• 5 6 7 8 9• 10 11 12• 13• 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 • a day you have written
What protects it
The parts worth checking before you trust anything with a diary.
- Key derivation
- Argon2id — time_cost 3, 64 MiB, parallelism 4 — with a random 16-byte salt per diary. Your password is never stored; the derived key never touches disk.
- Encryption
- AES-256-GCM with a fresh random nonce for every single encryption. Each day is encrypted independently, so editing one never re-encrypts the others.
- Integrity
- Tampering with a stored entry, or a wrong password, fails authentication and is reported as an error — never as an empty or partial diary. The header carries an encrypted verifier, so that holds even for a diary with no entries yet.
- Durability
- Saves are atomic: temp file, fsync, then rename over the original. An interrupted save cannot leave a half-written diary, and the file is created 0600.
- Two windows open
- A second Zecret on the same file is detected before anything is written, so one session cannot silently overwrite what the other just saved. Creating a diary claims the path in the same indivisible step that writes it, so two first runs cannot land on top of each other either.
- Plaintext
- Never written to disk — not as temp files, not as logs, not for crash recovery.
Two things it does not do. Anyone holding the file can see which days you wrote on, though not a word of what they say — the dates are the index, and indexes have to be readable to be used. And there is no password recovery, by design: nobody, including you, can open the file without the password — which the app says in as many words, in red, on both of the screens where you choose one.
The full threat model — including what an encrypted file on your own disk cannot defend against, and how to report a flaw privately — is written down in SECURITY.md.
Install
Zecret needs Python 3.13 or newer. uv installs a suitable interpreter for you, so nothing depends on what your system happens to ship.
As a tool
$ uv tool install zecret $ zecret
uv fetches a suitable Python along with it. pipx install zecret and pip install zecret work too, on 3.13 or newer. To try it without installing anything, uvx zecret --path /tmp/try.enc runs it straight from PyPI against a diary you can delete afterwards.
From a checkout
$ git clone https://github.com/kfurtak1024/zecret $ cd zecret $ uv sync $ uv run zecret
That opens your real diary with whatever the checkout happens to contain, which is what you want from a release tag and not what you want from a branch you are changing. To work on Zecret, run ./zecret-dev.sh instead: it points the app at a throwaway diary and preferences of its own.
Where the diary lives
$ zecret --path /some/where.enc
By default ~/.zecret/diary.enc, overridable with --path or ZECRET_DIARY_PATH. On first launch Zecret asks you to choose a master password and creates the file. Settings follow you rather than the diary, so a second diary keeps your theme — unless you give that run preferences of its own with --config. zecret --help lists both flags and both environment variables; zecret --version says which Zecret you have without opening the diary.
Keys
Press ? in the app for the same list, always current.
| Key | Where | Does |
|---|---|---|
| n | entry list | Write about today |
| a | entry list | Write about another day |
| enter | entry list | Open the selected day |
| d | entry list | Delete the selected day's entry |
| r | entry list | Re-read the file, picking up another Zecret's writing |
| / | entry list | Search |
| s | entry list | Settings: theme, locking, and the way to change your master password |
| ctrl + l | entry list, editor | Lock the diary without quitting — saves the day you are writing first |
| ? | entry list | Help |
| q | entry list | Quit |
| ctrl + s | editor | Save, and carry on writing |
| ctrl + r | editor | Cover the writing, leaving only the word you are on |
| esc | anywhere | Back |
ctrl + q quits from anywhere, including a screen with a password box on it where a bare q would only be typed. It asks first if you are part-way through writing a day, exactly as backing out of that day does — and either question offers to save the day on the way out, so the choice is never between losing the last paragraph and staying put.
Getting around a long diary: j and k or the arrow keys move a day at a time, g and G (or home and end) jump to the newest and oldest entries, and the page keys move a screenful. None of these crowd the bar at the bottom; all of them are listed under ?.
Choosing a day has two halves, and the keyboard reaches both: type the date into the field, or press tab (or ↓) to step into the month below it, where the arrow keys walk a day at a time, the page keys move a month, home and end reach the ends of it, and enter takes the day the cursor is on. Whichever half you use, the other follows — and the calendar follows the typing as it happens, so the month you are aiming at is on screen before you have finished the date.
Inside a day, the editor answers to the usual text-editing keys — ctrl + home and ctrl + end for the two ends of the entry, ctrl + a to select all of it, and the rest of what your fingers already know. Those are the one thing ? does not list: it is a page about the diary, and these mean here exactly what they mean everywhere else.