Manifa

Your code folders and .env files, synced everywhere. Encrypted before they leave.

Manifa syncs secrets and working trees across every machine. The server stores ciphertext it can never read.

Get started freeRead the docs
Vaults › 7f3a-c1e9Unlocked
.env.production
# decrypted in your browser
DATABASE_URL=postgres://prod…
STRIPE_SECRET_KEY=sk_live_••••••4Q2f
SENTRY_DSN=https://…@o0…
VaultsRA
Ciphertext only
File names encrypted
Keys on your device
Historic snapshots
How it works

The manifest is cheap. The bytes are lazy.

Enroll a machine, edit anywhere, open a file. Content arrives only when you reach for it.

~ — mani
$ mani device enroll

  ✓ keypair generated · vault keys wrapped to this device


$ mani sync

  ↑ pushed 1 chunk · 4.2 KB


$ mani env pull apps/api

  ✓ decrypted to apps/api/.env
Secrets & folders

Everything in sync, byte-for-byte.

Encrypted before it leaves. Only the chunks that changed move.

api — zsh
$ mani env push --vault api --name prod .env

  ↑ encrypted .env (4.1 KB) → vault “api”


$ mani clone code ~/Code

  ✓ 1,284 files · identical layout · 38s
4 KB
moved on a 1-byte edit
0
node_modules synced
1
layout, every box
Zero-knowledge

We can't read your data. That's the point.

Encryption happens on your device. The server only ever holds ciphertext.

On your machine
  • DATABASE_URL=postgres://…
  • STRIPE_KEY=sk_live_…
  • app.tsx
  • schema.ts
What the server stores
  • a3f1c08e…
  • 9b27dd4a…
  • 1f0e6c52…
  • c84b91ff…
  • 70a2e3d9…
AES-256-GCM-SIVEncrypted file namesKeys only you holdNo recovery code, no access
Read how the crypto works
Built for many machines

Every machine, one root.

Enroll a box and your whole environment is there. Revoke one and its keys rotate.

Devices · 1 synced root
MacBook Pro
synced 2m ago · key 4b:19:c0
Active
Linux box
synced 1m ago · key d7:81:a3
Active
Cloud sandbox
syncing now · key 55f0:c1
Active
Old laptop
removed · keys rotated
Revoked
Revoking a device rotates the vault key. Your other machines keep working.
Up and running in a minute

One CLI. Everything in it.

Install, sign in, and sync your first vault.

getting started
$ curl -fsSL https://manifa.dev/install | sh


$ mani login


$ mani init


$ mani vault create code ~/Code


$ mani daemon start
Full command referenceCreate an account
Questions

The honest answers.

If it's zero-knowledge, what happens if I lose my password?

At signup you get a one-time recovery code that can unwrap your account key. As long as you have it, or another enrolled device, you can recover. If you lose every device and the recovery code, the data is unrecoverable. That's the honest cost of nobody-but-you encryption.

How is this different from Git?

Git is the system of record for committed history; Manifa syncs the working environment around it: uncommitted edits, .env files, and a uniform directory layout. It respects .gitignore and never touches your .git directory.

Won't it sync my node_modules and build artifacts?

No. Layered ignore rules skip node_modules, target/, .venv and friends by default. Manifa syncs the lockfile and a post-sync hook rebuilds native deps on the target OS, so a Mac and an Ubuntu box stay consistent without shipping platform binaries.

What does a stolen laptop mean for me?

Revoke the device with one command. Its wrapped keys are deleted and your vault keys rotate, so the lost machine can't read new content. Your other devices keep working uninterrupted.

What can the server actually see?

Structural metadata: vault existence, the number and size of encrypted chunks, when and from which device you sync, when a key rotates, and (because collaboration isn't anonymous) who shares a vault with whom and the emails involved. Only chunk sizes are padded; the rest is metadata we accept leaking. It never sees file contents, file or directory names, .env values, or any key material.

Boot a new box. Everything's already there.

Free for your first vault and two devices. No card required.

Get started free