// the pock cli · v0.7.3

Your vault, in the terminal

One statically-linked binary. Read and write secrets, inject them into any process, and authorize CI, all with the same end-to-end encryption as the web vault. Your plaintext never leaves the machine.

macOS & Linux

Windows: run irm https://pock.sh/install.ps1 | iex in PowerShell.

Direct downloads

macOSApple Silicon
f41eba5f24915a5806200cef
.tar.gz
macOSIntel
ef28422684f0d7d0725c1b1f
.tar.gz
🐧
Linuxx86-64
b381660bdabe3acedecf8cd4
.tar.gz
🐧
LinuxARM64
349633243eab4bd2508363be
.tar.gz
Windowsx64
45eb3e2345ed4e733e0c2b33
.zip

Verify what you ran

Every archive is published with its SHA-256 and logged in the tamper-evident release log. The installer checks the hash before it writes anything.

How verification works →

First five minutes

Link the CLI to your vault, pull a secret, and wrap a process so its environment is decrypted only in memory.

Read the guides →

Quickstart

pock run injects a project's secrets as environment variables for the wrapped command only; nothing is written to disk.