# git-crypt

> Transparent file encryption for Git repositories using AES-256, encrypting files on commit and decrypting on checkout

Stars: 10.0k · Language: C++ · License: GPL-3.0 · Categories: Git

- Repository: https://github.com/AGWA/git-crypt
- Website: https://www.agwa.name/projects/git-crypt/
- Page: https://www.trmn.sh/tools/git-crypt

## Overview

git-crypt provides transparent file encryption within Git repositories, encrypting specified files when committed and decrypting them when checked out. Files are selected for encryption using .gitattributes patterns, allowing repositories to contain both public and private content. Developers without decryption keys can still clone and commit to repositories containing encrypted files, enabling secure storage of secrets alongside public code.

The tool supports two authentication modes: GPG-based multi-user access through `git-crypt add-gpg-user` commands that store encrypted keys in the repository, and symmetric key mode using `git-crypt export-key` for manual key distribution. After initial setup with `git-crypt init` or unlocking with `git-crypt unlock`, all encryption and decryption operations happen transparently during normal Git operations.

git-crypt uses AES-256 encryption in CTR mode with synthetic IVs derived from SHA-1 HMACs, providing semantic security under deterministic chosen-plaintext attacks. This approach ensures that while encryption is deterministic (required for Git to detect file changes), it reveals no information beyond file identity. The tool is designed for repositories where most content is public but specific files like API keys or certificates require encryption, rather than full-repository encryption scenarios.

## Alternatives

- [hunk](https://www.trmn.sh/tools/hunk.md): Terminal diff viewer for reviewing Git, GitHub, Jujutsu, and Sapling changesets, with inline agent annotations, split/unified layouts, and watch mode. (TypeScript, 9.7k stars)
- [onefetch](https://www.trmn.sh/tools/onefetch.md): Command-line tool that displays Git repository information and code statistics in terminal (Rust, 12.1k stars)
- [gitoxide](https://www.trmn.sh/tools/gitoxide.md): Pure Rust implementation of Git, offered as the gix library crate plus gix and ein command-line binaries for testing the API and running workflow tools. (Rust, 12.1k stars)
- [soft-serve](https://www.trmn.sh/tools/soft-serve.md): Self-hostable Git server with SSH-accessible TUI for command-line repository management and browsing. (Go, 7.3k stars)
- [gh-dash](https://www.trmn.sh/tools/gh-dash.md): Terminal UI for GitHub that lists configurable pull request and issue sections, with vim-style hotkeys, custom actions, and a YAML config file. (Go, 12.7k stars)

## Guides

- [Best CLI Tools for Encrypting Files and Configuration](https://www.trmn.sh/best/file-encryption-tools): Compare age, sops, git-crypt: workflows, strengths and tradeoffs.

---

Canonical: https://www.trmn.sh/tools/git-crypt