The problem wasn't that I didn't have a password manager. I had Bitwarden. 200+ entries. Excellent for bank logins, Netflix, AWS console, family sharing.
The problem was the thirty or so dev secrets that also need to live somewhere — OpenAI API keys, Stripe secret + webhook secrets, GitHub personal access tokens, database URLs (with the password embedded), AWS deploy tokens, Resend keys, a dozen internal webhook secrets I wrote at 2am and can't remember the purpose of.
These thirty secrets have a different shape:
- They rotate more. Netflix password: years. Stripe live key: weeks if I'm disciplined, months if I'm not.
- The interaction is different. I type my Netflix password into a browser form once a year. I copy my OpenAI key into a terminal five times a day.
- The blast radius is 1000x. Stolen Netflix password = someone watches my shows. Stolen Stripe live key = they drain the account.
- I need audit trails. Not for Netflix. Absolutely for every API key — when did I last use it, when should it rotate, which production instance is it in.
- The mental model is opposite. Consumer password manager wants to be everywhere — phone, laptop, tablet, family shares, browser autofill. Dev secrets want to be scoped — one trusted context, never on the phone, never autofilling.
Bitwarden (and 1Password, LastPass, Dashlane) are built around the first mental model. Using them for dev secrets works but feels wrong. You end up with a 200-entry vault where your Stripe key is four folders deep next to your mom's Disney+ login.
So a lot of developers — including me before I fixed it — end up with dev secrets in iCloud Notes, in a text file named "keys", in a password-protected note, in a Signal chat with themselves. Easier to copy-paste from. Zero encryption or trivially-broken encryption. No audit. No rotation reminder.
After one too many "wait, which Stripe key is this" moments, I built a scoped tool:
- A single-page web app. No extension. No mobile app.
- Encrypted with WebCrypto native (AES-256-GCM, fresh IV per entry, PBKDF2-SHA256 at 600k iterations for key derivation).
- Data in browser localStorage only. Never transmitted.
- Master password is the key; lose it and the data is gone.
- Copy-to-clipboard with 30-second auto-clear.
- Export/import encrypted JSON for backup.
The trade-offs are real. No recovery flow. No multi-device sync. Not a third-party-audited package (crypto primitives are standard, but the wrapping is new code). If those are dealbreakers, keep using Bitwarden — or layer both, which is what I do.
This shipped as Septim Vault at septimlabs.vercel.app/vault. Free tier caps at 3 entries so you can verify the crypto flow before buying. $29 lifetime unlocks unlimited + export.
If you want to evaluate it against Bitwarden directly, I wrote out the positioning split: septimlabs.vercel.app/compare/vault-vs-bitwarden — honest comparison, including where Bitwarden is unambiguously better.
Tonight only: bundle with Septim Drills (25 Claude Code skills) for $39 vs $58 separate — septimlabs.vercel.app/tonight. Expires midnight ET.
Should dev secrets live in your password manager? Or do they deserve a separate tool?
If you're reading this and you've also been pasting API keys into iCloud Notes because opening Bitwarden was too many clicks — the answer is probably "separate tool." Whether that tool is mine, or some CLI you write yourself, or one of the three open-source self-hosted options (HashiCorp Vault, passwordstore.org pass, direnv + sops), the distinction is worth making.
Septim Labs builds small, opinionated developer tools — septimlabs.vercel.app. April 20, 2026.