Personal Sync: Your Vaults On Every Machine

You have a MacBook at your desk and a laptop for the couch. Both need your API keys. Personal sync solves this without team features, key slots, or any ceremony.

The Setup

Machine A (where your vaults already live)

# Log in (once)
localvault login YOUR_TOKEN

# Push your vaults
localvault sync push
localvault sync push production
localvault sync push x

Each vault uploads as an encrypted blob. The server stores only ciphertext — it never sees your passphrase or secrets.

Machine B (new machine)

# Install
brew install inventlist/tap/localvault

# Log in with the same InventList token
localvault login YOUR_TOKEN

# Pull your vaults
localvault sync pull
localvault sync pull production
localvault sync pull x

# Unlock with your passphrase
localvault show
# Passphrase: ••••••••
# Vault: default (12 secrets)

That's it. Same passphrase, same secrets. No key slots, no team init, no public keys.

How It Works

Personal sync uses SyncBundle v1 — the simplest format:

Upload (push):
  vault.enc → Argon2id(passphrase, salt) → encrypted blob → R2 storage

Download (pull):
  R2 storage → encrypted blob → your machine → enter passphrase → secrets

The blob is tied to your InventList account. Only you can push or pull it. The passphrase never leaves your machine.

Check What's Synced

localvault sync status
# Vault          Status        Synced At
# default        synced        2026-03-15
# production     synced        2026-03-15
# x              local only    —
# staging        local only    —

"local only" means the vault exists on this machine but hasn't been pushed. Push it:

localvault sync push x
localvault sync push staging

When You Change Secrets

Sync is manual — push after changes, pull to update:

# Machine A: add a new secret
printf '%s' "$NEW_SECRET" | localvault set NEW_KEY --stdin -v production
localvault sync push production

# Machine B: pull the update
localvault sync pull production

The per-vault sync push/pull commands are last-write-wins — they do exactly what you tell them. The bare localvault sync, though, tracks a per-vault baseline: it pushes only when local changed, pulls only when remote changed, records a baseline automatically when both sides are already identical, and stops with a CONFLICT if both sides diverged so nothing is silently overwritten. For solo use across machines, run localvault sync and let it pick the direction.

Personal Sync vs Team Sync

Start with personal sync. If you need to share a vault with someone else, upgrade it with team init.

Try It

The Getting Started tab in the interactive demo covers personal sync in steps 8-10.