zvault provides an interactive TUI and a scriptable CLI. run zvault with no arguments to launch the TUI, or use subcommands for automation.

zvault <command> [args]

commands:
  secret      manage secrets
  task        manage tasks
  export      export vault data
  completion  generate shell completions
  version     print version
  help        show help

create a new secret. you will be prompted for the secret value interactively.

zvault secret store -t <type> -n <name> [--tags tag1,tag2]

supported types: password, apikey, sshkey, note.

for notes, you can pipe content via stdin:

echo "my note" | zvault secret store -t note -n mynote

retrieve a secret by ID, name, or ID prefix. sensitive values are masked by default.

zvault secret get <id-or-name> [--show]

use --show to reveal sensitive values like passwords and API keys.

list all stored secrets. optionally filter by type or tag.

zvault secret list [-t <type>] [--tag <tag>]

delete a secret. prompts for confirmation before deleting.

zvault secret delete <id-or-name>

search secrets by name.

zvault secret search <query>

add a new task with optional priority, due date, and tags.

zvault task add [-p <h|m|l>] [-d <date>] [--tags tag1,tag2] <title>

due date formats: YYYY-MM-DD, today, tomorrow, next week, +3d.

list tasks. filter by status, priority, or tag.

zvault task list [--pending] [--done] [-p <h|m|l>] [--tag <tag>]

alias: zvault task ls

mark one or more tasks as complete.

zvault task done <id>
zvault task done <id1>,<id2>

rename a task.

zvault task edit <id> <new title>

delete one or more tasks.

zvault task rm <id>
zvault task rm <id1>,<id2>

delete all completed tasks.

zvault task clear

export vault data as markdown. by default exports both secrets and tasks.

zvault export [--tasks] [--secrets] [--pending] [--done]

use --tasks or --secrets to export only one category. use --pending or --done to filter tasks by status.

generate shell completion scripts.

# bash (add to ~/.bashrc)
eval "$(zvault completion bash)"

# zsh (add to ~/.zshrc)
eval "$(zvault completion zsh)"

# fish (add to ~/.config/fish/config.fish)
zvault completion fish | source

print the zvault version.

zvault version

zvault stores its encrypted vault in ~/.local/share/zvault/. the vault is initialized on first use via the TUI.

set the ZVAULT_PASSWORD environment variable to skip interactive password prompts (useful for scripting).

set NO_COLOR to disable colored output.