DevKeep finds the SSH keys, cloud credentials, .env files and config that live in forgotten corners of your machine, then backs them up — encrypted — and restores them on a fresh Mac.
Free while in beta · runs entirely on your Mac · nothing uploaded · no account.
You don't lose the things you back up. You lose the ~/.aws/credentials you forgot about and the API key that lived only in one project's .env. DevKeep is the checklist you didn't know you needed.
Coverage
Everything developer-related falls into three buckets — and each one needs a different kind of rescue. DevKeep knows the difference.
.env files, .netrc.p8 keyspass vault, mkcert CAHow it comes back: an AES‑256‑GCM encrypted bundle, unlocked by your passphrase. Never plain git.
.zshrc, .bashrc)~/bin scripts, AlfredHow it comes back: copied to a backup and restored to its exact original path on the new Mac.
How it comes back: a Brewfile + manifests + a per‑app reinstall guide, including the apps no tool can fetch for you.
Workflow
Three steps. The first one is the part nobody else does.
DevKeep scans known hiding spots and shows every item by tier and severity. Crucially, it flags config that's on disk but not safely committed to any git repo — the things you'd silently lose. Search and filter to focus on what matters.
Pick exactly what to include, down to the individual file. Secrets are sealed with AES‑256‑GCM behind a passphrase only you know (portable to any Mac) or a random key with a recovery code. Re-runs are incremental, and every run is kept in a history.
On the new Mac, point DevKeep at your backup. See a line-by-line diff of exactly what each file would change before anything is written. Choose how conflicts are handled, and DevKeep snapshots anything it overwrites so a restore is fully reversible.
Why DevKeep
One engine, tested and auditable, doing the unglamorous work you'd otherwise do by hand.
AES‑256‑GCM with a passphrase (portable) or a random key + recovery code. Zero‑knowledge.
Flags config present on disk but not safely committed to any repo.
Choose exactly which files go into a backup, down to the individual file.
See line‑by‑line what a restore would change before a single byte is written.
Every installed app classified by how to reinstall it — App Store, Homebrew, or manual download.
Conflict policy + a snapshot of anything overwritten, so a restore is reversible.
Re-runs skip unchanged files; every backup run is recorded.
A gentle nudge when it's been too long since your last backup.
A real Mac app and a scriptable CLI sharing one tested engine.
Trust
Because a backup of your secrets might end up on an external drive or in iCloud, it has to be useless to anyone but you.
AES‑256‑GCM via Apple's CryptoKit. Your passphrase is stretched into the key with PBKDF2‑HMAC‑SHA256 (600k iterations). The key is never stored in the backup.
No servers, no analytics, no network calls of its own. The only network use is when you click a reinstall link.
Your passphrase is the recovery — derived locally, never transmitted. An optional Keychain copy stays on this device only.
Get it
Same engine, same encryption, same privacy promise — and backups are interchangeable. They differ only in how macOS lets each one reach your files.
/opt/homebrew, broad ~/Library)..dmg and drag it to Applications.Not sure? Start with the direct download for the full zero-effort experience. Either way, a backup made by one opens in the other.
It's a free public beta — found a rough edge? Tell us, we read everything.
FAQ
The things people ask before trusting a tool with their secrets.
Yes — that's the whole point. Secrets are encrypted on your Mac with AES‑256‑GCM before they're written anywhere, using a key derived from a passphrase only you know. The backup file is useless to anyone without it. Nothing is uploaded; see the security model.
The encrypted secrets are unrecoverable — there is no reset and no backdoor (that's what makes it secure). Store your passphrase in a password manager. If you'd rather not manage a passphrase, the alternative mode gives you a one-time recovery code to save, plus an optional copy of the key in this Mac's Keychain for same-machine restores.
Only in the folder you choose — a local disk, an external drive, or a synced folder like iCloud Drive or Dropbox if you point it there. Since secrets are already encrypted, putting the backup in a cloud folder is safe; the cloud only ever sees ciphertext.
No. DevKeep has no servers, no analytics, and makes no network connections of its own. The only time the network is touched is when you click a reinstall link in the Apps screen, which opens the App Store or your browser.
Apple requires App Store apps to run sandboxed, so they can't silently read your home folder. You grant access once via a standard macOS prompt. The direct-download build isn't sandboxed (it's notarized instead), so it can scan everything with zero setup. Both produce identical, interchangeable backups.
It's built to avoid that. Restore defaults to a dry run that only previews changes; you pick a conflict policy (overwrite, skip, or write-beside); and when overwriting, DevKeep first snapshots the existing file so the restore is reversible.
The plan is to open-source the core engine (the scanning and encryption), so the security‑critical code is auditable and the "nothing leaves your device" promise is verifiable, while the polished app is the product.
No servers, no analytics, no network calls of its own. Scanning, encryption, backup and restore all happen locally, and the backup is useless to anyone without your passphrase. That's not a setting — it's the architecture.
Read the privacy policy