jit
Find the plaintext secrets on your Mac and move them behind Touch ID, injected just in time without breaking the tools that read them. Free and local-first.
What is it?
What it is
A command‑line tool that stores your development secrets in an encrypted, Touch‑ID‑protected vault and injects them into processes only when needed, replacing plaintext files with decoys.
Why it exists
Because secrets are often stored in plaintext across files, shell configs, and tool configurations, making them vulnerable to accidental exposure, malicious scripts, or AI agents; jit mitigates this risk by keeping credentials encrypted and delivering them just‑in‑time.
Who should use it
Developers and DevOps engineers on macOS (Apple Silicon) managing scattered secrets across .env, AWS credentials, Terraform, Docker, and AI agents, who want just-in-time credential access via Touch ID.
Who should avoid it
Users on Intel Macs without building from source, those seeking absolute unbreakable security (the tool has deliberate limits), individuals unable to use Touch ID, non-macOS environments, and users requiring kernel-level filesystem protection.
How it works
A quick walkthrough in plain English
How jit works
Step 1 of 3
You interact with it
Open jit, send a request, or connect it to your stack.
Features
Advantages
- Keeps secrets encrypted locally with no plaintext on disk
- Biometric authentication (Touch ID) required to access vault secrets
- Non-destructive - migrates credentials without losing them
- Backward compatible - tools continue working after migration
- Supports a wide range of popular tools and platforms
- Audit logging provides complete visibility of who accessed what and when
- Works with AI agents and MCP servers through dedicated wrapping and granting
- Decoy values prevent unauthorized reads from leaking real secrets
- Reversible - every change can be undone with jit migrate undo
Disadvantages
- macOS-only (Apple Silicon) - not available on Linux or Windows
- Still in active development phase - not fully production-ready
- Does not protect already-compromised accounts or secrets in memory after retrieval
- Requires Touch ID/passcode for vault unlocking - not suitable for shared or headless environments
- Some legacy credential sources may require manual handling
- Limited to processes that can interact with the vault via supported protocols
- May need additional setup steps (jit wrap, jit migrate) for certain tools
Installation
native
download tarball, verify checksum, verify codesign, move binary; build from source with go install on Intel Macs
FAQ
What is jitpass and what problem does it solve?
jitpass is a just-in-time password manager for macOS that moves secrets from plaintext files into an encrypted vault gated by Touch ID. It prevents plaintext secrets from lingering on disk by keeping only decoys on disk while real values exist only in memory during authenticated processes.
How does jitpass protect credentials?
jitpass protects credentials by moving them into an encrypted vault. When a tool needs a secret, jit uses one of three mechanisms: replacing its own image with the target command (so the value lives in that single process), using the tool's native credential protocol (like AWS credential_process), or creating a POSIX FIFO mount where a background service writes decoys for ambient readers and real values only to authorized processes.
How do I install jitpass?
The recommended installation is via Homebrew: `brew install jitpass/tap/jitpass`. Alternatively, you can download the tarball from the releases page, verify the checksum and notarization, and install manually with `go install`. Homebrew provides better integration with shell completion and Gatekeeper notarization checks.
Does jitpass protect against AI agents accessing secrets?
Yes. jit has built-in support for AI agents. You can use `jit grant --process <agent-name>` to pre-approve an agent (like Claude) to access specific credentials for a bounded time window. Additionally, `jit wrap <tool>` can wrap CLI tools (gh, stripe, etc.) so their tokens are injected just-in-time through jit. By default, each tool still requires a Touch ID prompt, but grants allow unattended operation.
What are the deliberate limits of jitpass?
According to the README, jitpass does NOT make already-compromised accounts safe, and it does not protect a secret once it is in the memory of the process that asked for it. These are the deliberate limits stated plainly: it cannot protect secrets that are already exposed, nor can it prevent exposure in the memory of the requesting process.
Featured in Videos
YouTube tutorials and walkthroughs for jit
Alternatives
Similar projects ranked by category, topics, and text overlap.
