// the pock cli · v0.7.3
Your vault, in the terminal
One statically-linked binary. Read and write secrets, inject them into any process, and authorize CI, all with the same end-to-end encryption as the web vault. Your plaintext never leaves the machine.
macOS & Linux
Windows: run irm https://pock.sh/install.ps1 | iex in PowerShell.
Direct downloads
Verify what you ran
Every archive is published with its SHA-256 and logged in the tamper-evident release log. The installer checks the hash before it writes anything.
How verification works →First five minutes
Link the CLI to your vault, pull a secret, and wrap a process so its environment is decrypted only in memory.
Read the guides →Quickstart
pock run injects a project's secrets as environment variables for the wrapped command only; nothing is written to disk.