How DevOpsPad stores passwords and keys
DevOpsPad keeps secrets in your operating system’s credential store, under the service name devopspad. That covers database passwords, SSH passwords, SSH key passphrases and the AI provider’s API key. Everything else about a connection (name, host, port, user, options) is written to a local workspace.json file that contains no secrets.
If the keychain cannot be used, saving fails with an error. DevOpsPad never falls back to storing a secret in a file.
What goes where
| Item | Stored in |
|---|---|
| Database password | OS keychain, keyed by connection ID |
| SSH password | OS keychain, <connection ID>:ssh-password |
| SSH private key passphrase | OS keychain, <connection ID>:ssh-passphrase |
| AI API key | OS keychain, ai-api-key |
| SSH private key | Stays in the key file you selected; DevOpsPad stores the path |
| Kubernetes token or client certificate | Stays in your kubeconfig; DevOpsPad stores the path and context name |
| Connection metadata | workspace.json in the app’s config folder |
| Saved queries, query drafts | The app’s local web storage, unencrypted |
On macOS, workspace.json is at ~/Library/Application Support/DevOpsPad/workspace.json. See Where connections are stored.
Secrets never travel back to the interface
Once saved, a password or key is not returned to the app’s user interface. Connection dialogs show an empty field; leaving it blank keeps the saved secret. The Go backend reads the secret from the keychain only at the moment it opens a connection.
Kubeconfig credentials are handled the same way: when DevOpsPad lists contexts, it reads names and namespaces only, and never runs authentication plugins.
Changes are all-or-nothing
Saving a connection can touch several secrets and the metadata file. DevOpsPad applies them together: if writing workspace.json fails, keychain changes are rolled back to their previous values.
Other clean-ups happen automatically:
- Switching SSH authentication from password to key, or disabling SSH, removes the SSH secrets that are no longer used.
- Deleting a connection deletes its keychain entries.
- Changing the AI provider’s base URL without entering a new key deletes the old key, so it cannot be sent to a different provider.
The metadata file
workspace.json is written atomically: DevOpsPad writes a temporary file in the same folder, syncs it to disk and renames it over the old one. The temporary file is created with owner-only permissions (0600), so other users on the machine cannot read it. A workspace.json.backup copy is written the same way.
What is not encrypted
- Saved queries and, if you turn it on, restored query drafts are plain text on your device. Do not put secrets in query text.
- Files you export with Export CSV are ordinary files.
Platform notes
The signed macOS build uses the macOS Keychain. Builds for Windows and Linux use their platform credential stores through the same library, but those builds have not been verified yet.
Frequently asked questions
Does DevOpsPad ever save passwords in plain text?
No. Secrets are written only to the OS keychain. If the keychain is not available, saving fails instead of falling back to a file.
Can I see a saved password again in DevOpsPad?
No. After saving, secrets are never returned to the app's interface. Leave the field blank to keep the saved value, or type a new one to replace it.