Moment-of-exposure detection
Detects newly revealed API keys in Chrome and offers to keep them when they appear.
Otter Vault
Otter Vault is a Chrome extension that detects API keys revealed in browser pages or copied in a terminal and stores them in an encrypted local vault. It is designed for developers who want device-local credential handling without an account or server storage.
Local API key capture for Chrome
Otter Vault is a Chrome extension for capturing API keys at the moment they appear in a browser or are copied in a terminal. It checks detected strings against known provider formats and offers to store matching keys in a local vault.
The vault is encrypted on the user's device rather than on a remote service. Access uses a passphrase, and retrieving a key requires entering that passphrase again before copying. The product is positioned for developers who need a way to retain short-lived or easy-to-miss credentials without creating an account or sending them to a server.
Features
Provider format checks
Recognizes key formats associated with OpenAI, Anthropic, Vercel, Cloudflare, Supabase, GitHub, and other providers.
Encrypted local vault
Stores secrets in a device-local vault protected with AES-256-GCM and a passphrase-derived key using 600,000 PBKDF2 rounds.
Protected retrieval
Requires the passphrase when copying a stored key and clears the clipboard after copying.
Copied-key detection
Can offer to retain API keys copied in a terminal, extending detection beyond browser pages.
Planned macOS companion
The planned macOS companion is described as a menu bar app with a click-through pointer-following otter; the site says it is coming soon rather than currently available.
Use cases
Saving a newly revealed provider key
When a provider displays a newly created credential only briefly or makes it easy to overlook, Otter Vault can offer to retain the detected key as it appears in Chrome.
Handling keys from terminal workflows
A developer working in a shell can copy a credential and use Otter Vault's copied-key detection instead of relying on a browser page to capture it.
Working across developer platforms
Developers using services such as OpenAI, Anthropic, Vercel, Cloudflare, Supabase, or GitHub can use the provider-format checks to identify likely keys from those ecosystems.
Keeping credentials on one device
A developer who wants local handling of credentials can use the vault without creating an account or sending stored keys to a remote server.
Pros and Cons
Pros
- Captures API keys when they are revealed in a Chrome page or copied in a terminal.
- Uses local encryption with AES-256-GCM and passphrase-derived key protection.
- Does not require an account and states that keys stay off the server.
- Supports format checks for keys from several named developer platforms.
- Adds a passphrase check before copying and clears the clipboard afterward.
Cons
- The currently available product is the Chrome extension; the macOS menu bar app is described as forthcoming.
- The source does not document shared-vault, team, operating-system coverage beyond the planned Mac app, or detailed pricing and plan limits.
- Users must remember the vault passphrase; the source does not describe a recovery or account-based reset process.
FAQ
Which platforms does Otter Vault support?
Otter Vault is currently available as a Chrome extension. The site says a macOS menu bar app is planned, but it is not yet available.
How do I start using Otter Vault?
Install the Chrome extension, create a vault with a passphrase known only to you, and let it watch for API keys as they appear. The product also offers to keep keys copied in a terminal.
How does Otter Vault protect stored keys?
The vault is encrypted on the device with AES-256-GCM. The encryption key is derived from the user's passphrase with 600,000 rounds of PBKDF2, and copying a stored key requires the passphrase again.
Does Otter Vault send keys to a server?
The site states that there are no servers, accounts, or analytics, and that the vault is local to the device. It also says the clipboard clears itself after copying, but does not specify the clearing interval.
How much does Otter Vault cost?
The Chrome call to action is marked free. The available pricing page does not provide additional plan, limit, or paid-tier details.
Quick Facts
- Category
- Developer tool; security and privacy
- Primary platform
- Chrome extension
- Storage model
- Encrypted locally on the device
- Account requirement
- No account required
- Availability
- Chrome extension available; macOS menu bar app planned
- Listed Chrome pricing
- Free
Альтернативы Otter Vault
ByteAsk
ByteAsk is a terminal-first AI coding agent for C and C++ that edits repositories and verifies changes with the real compiler, debugger, sanitizers, and tests before showing a diff. It offers a free tier plus paid plans, with editor connectors and zero-retention handling described in the source.
CreateOS Sandbox
CreateOS Sandbox is an isolated compute environment for running code and agent workloads inside Firecracker micro-VMs. It is designed for workflows that need machine-level isolation, private networking between sandboxes, and programmatic control through SDK, CLI, or MCP.
GitBot
GitBot is a local browser-based workspace for creating reusable coding bots powered by Claude Code, Codex, or OpenCode. It helps developers run those agents across repository folders with persistent threads and configurable permissions.
hob
hob is an independent workspace for coding agents that keeps agent sessions, terminals, history, and follow-up work organized around the tools and providers you already use. It is aimed at developers who want local control over routing, history, and workspace structure rather than a bundled model stack.
Ably Chat
Ably Chat is a chat API platform for building custom realtime chat applications. It supports room-based messaging, typing indicators, presence, reactions, and message updates, with usage-based pricing options for different deployment stages.
Manta AI
Manta AI is an autonomous web app testing tool for teams that want to map application behavior, catch regressions, and generate tests without writing scripts or maintaining selectors. It works from a URL and supports plain-English test flows, run results with screenshots, and scheduled or deployment-triggered checks.