GitLocker writes selected paths as ciphertext into Git remotes and new commits, so a host cannot scan their plaintext blobs, and a copied repository does not expose those files without the project key. Existing history is not rewritten by default, and plaintext already checked out is not protected. Start with the free CLI and Personal Provider; add SaaS later for hosted keys and grants.
Install the free CLI
$npm install -g gitlocker@latestRequires Node.js and npm. Personal Provider needs no GitBraints account.
Initialize, encrypt selected paths, then keep using git add, commit, and push. Filters run for Git; they are not daily user commands.
Initializing GitLocker for this repository... ✔ Git filters registered. ✔ Generated local project key in the personal key store. ✔ Wrote .gitlocker/config. GitLocker is initialized. Encrypt selected paths next.
GitLocker always encrypts Git content. The Personal Provider keeps keys on your machine. The Server Provider is an optional SaaS convenience for hosted keys and grants.
Designed for individual developers and offline use. Project keys stay in a local store. GitBraints does not receive those keys. This is the default way to start.
Optional key custody for many repositories. GitBraints can host usable project keys so you can grant fetch access. This is not zero-knowledge, and it does not replace Git hosting ACL.
Encrypted Git objects use AES-256-GCM. If ciphertext is truncated or tampered with, decryption fails closed instead of emitting plaintext or partial output.
One encryption model with two key sources: a local Personal Provider, and an optional Server Provider for SaaS custody and grants. There is no Cloud HSM or Team KMS product.
A new project key can protect new commits. Older Git objects stay encrypted with the key version that created them unless you re-encrypt separately.
Compared with leaving source in plaintext on a Git host, or with tools that only wrap files without a hosted grant path.
| Capability | GitLocker | Plain Git remote | Typical git-crypt / GPG file crypto |
|---|---|---|---|
| What the Git host stores | Ciphertext blobs for encrypted paths | Readable source blobs | Ciphertext if you configure it |
| Integrity on decrypt | AES-256-GCM, fail-closed | Not applicable | Varies by tool and configuration |
| Key location | Local Personal Provider, or optional SaaS custody | No project key | Usually local keys only |
| Team access | Git ACL first; SaaS Grant for hosted keys | Git ACL only | Manual key sharing |
| Revoke / rotate | Emergency controls; no instant cache wipe; no history rewrite | Not applicable | Usually requires key redistribution or history rewrite |
GitBraints SaaS is a convenience vault for project keys across repositories. It is not zero-knowledge, not a Cloud HSM, and not a replacement for Git hosting access control. Start with the free CLI; add SaaS when you want hosted keys and Grant.
Keep project keys in the GitBraints account that owns the vault instead of copying key files between machines. SaaS can hold usable keys so fetch works after login.
Invite teammates, then grant fetch access to repositories already bound on the vault account. Members keep using their personal gitl login. Team is not a second CLI tenant.
Get answers to common questions about GitLocker
Install the GitLocker CLI globally with npm: npm install -g gitlocker@latest. Node.js and npm are required. On Linux or macOS, a global install may need extra permissions unless your npm prefix points to a user directory; on Windows, run the command in PowerShell or Command Prompt. After installation, gitl is available on your PATH. Start with gitl init using the Personal Provider; no GitBraints account is required for that path.
GitLocker encrypts selected files before they are stored in Git. Remotes and history keep ciphertext. After a successful checkout, your working tree is plaintext so editors and builds work as usual. Daily commands remain git add, git commit, and git push. Filter plumbing is not a daily user command.
Install gitl, initialize with the Personal Provider, and encrypt selected paths on the Git host you already use. Add GitBraints SaaS later if you want hosted keys and team grants.
Revoke stops future key fetches. Rotate issues a new active key for new work. Neither instantly clears cached keys, and neither rewrites Git history. Prefer Git ACL for ordinary offboarding.
SaaS can record who fetched a hosted project key. This is operational visibility, not a certified compliance report and not a claim of SOC 2, ISO 27001, HIPAA, or FIPS.
No. The Personal Provider keeps project keys on your machine, so GitBraints never sees those keys. GitBraints SaaS is not a zero-knowledge service: it can host usable project keys so you can grant access and fetch them from other machines. GitLocker also does not hide a working tree after checkout.
The host sees ciphertext blobs plus normal Git metadata: commit hashes, authors, timestamps, paths, and approximate sizes. It should not see readable contents of encrypted files. GitLocker does not hide repository structure.
Yes. Initialize GitLocker, then encrypt selected paths. Encryption applies going forward. gitl encrypt does not rewrite older Git history into ciphertext by default.
With the Personal Provider, GitBraints cannot recover a lost local key. Keep an offline backup. With SaaS Server Provider, recovery depends on still being able to sign in to the account that holds the hosted key. SaaS hosting is a convenience, not a second copy of Git history.
No. SaaS revoke stops future key fetches for that project key. It does not instantly erase keys already cached on a machine, and it does not rewrite Git history. For private repositories, remove Git hosting access first. Use revoke or rotate when ciphertext is widely cloneable or a key is known to be leaked.
No. Rotation replaces the active project key for new work. Older commits encrypted with a previous key version may remain decryptable until you run a separate re-encryption workflow. Rotation limits future exposure; it is not an automatic history rewrite.
No. Encryption and routine collaboration depend on Git hosting permission plus the project key (local, or a SaaS grant). Product seats are billing and plan-limit containers. They are not a required encryption layer.