Secretive is a macOS application that protects and manages SSH keys using the device's Secure Enclave.
Secretive solves the problem of SSH key theft by storing keys in hardware that makes them impossible to export, even by an attacker with full system access. The Secure Enclave is a dedicated security processor built into modern Macs that cryptographically isolates key material from the rest of the system. When you use Secretive, your private keys never exist on disk in plaintext form; instead, signing operations happen inside the Secure Enclave and only the signature is returned to your SSH client. The tool also integrates with macOS access controls, allowing you to require Touch ID or Apple Watch authentication before keys can be used, and it sends notifications whenever your keys are accessed so you can detect unauthorized use.
Secretive is designed for macOS users who want stronger protection for their SSH keys than traditional file-based storage offers. It works best for developers and system administrators who have Macs with Secure Enclaves and are willing to accept that keys cannot be backed up or transferred to new machines. For users without a Secure Enclave, the tool supports smart cards like YubiKey as an alternative. The README does not compare Secretive to other SSH key management tools, so no comparative guidance can be offered.
The project maintains an auditable build process through GitHub Actions with artifact attestations available for verification. The tool includes a documented security policy and accepts private vulnerability reports through GitHub's security advisory system.
