git-crypt is a transparent file encryption tool for git repositories that encrypts and decrypts files automatically during commit and checkout operations.
The tool solves the problem of storing sensitive material like keys and passwords alongside code without encrypting the entire repository. It works by using git attributes to mark which files should be encrypted, then applies AES encryption transparently whenever those files are committed or checked out. Developers without the decryption key can still clone and work with the repository, seeing encrypted file contents but unable to access the plaintext. This graceful degradation means teams can share repositories containing mixed public and private content without requiring universal access restrictions.
Teams should adopt git-crypt when they need to store secrets in version control without locking down the whole repository. It suits projects where some developers need access to sensitive configuration or credentials while others do not. The tool supports two key distribution methods: GPG-based sharing, which adds encrypted key files to the repository and leverages existing GPG infrastructure, or symmetric key export, which requires secure out-of-band key delivery but avoids adding files to the repository. The README does not compare git-crypt to alternative approaches.
The project acknowledges it has not yet reached maturity, with incomplete documentation and potential backwards-incompatible changes before a stable release. Development appears focused on reliability and correctness rather than rapid feature expansion, with the stated aim of being bug-free and avoiding crashes or data exposure.
