What's new.

Small fixes and reliability improvements across the app.

Custom key groups you build yourself.

• Drag one key onto another to group them, drag a key onto a group to add it, or drag it out (or onto the new drop zone) to remove it. Groups can be renamed or disbanded from their own menu, and show up to three favicons for the services inside, one per distinct service.
• Keys can now be manually reordered with a drag handle, and dragged straight onto Active or Archived to file them.
• The “Used by you” status now updates the instant you reveal a key, instead of waiting until you switch pages and back.

A more reliable menu bar icon.

• Fixed the menu bar icon occasionally failing to appear.

A native-feeling redesign: the menu bar popover, the full window, and Settings.

• Settings is rebuilt as a classic macOS settings pane: no cards, banners, or ALL-CAPS section headers, just right-aligned labels, left-aligned controls, and hairline dividers, matching Safari or Xcode’s own Settings.
• Connect is no longer a separate page — it’s folded into Settings as a “Claude Code” section, with the connection switch, “Check Claude Keychain first” switch, Test Connection, and Set Up Manually all in one place. “Fix Automatically” now only ever appears when the connection is actually broken.
• The full window’s sidebar (and the “Secured by macOS Keychain” card) is gone, replaced by a centered Secrets/Log/Settings segmented control in the window’s own title bar toolbar, with ⌘ 1/⌘ 2/⌘ 3 shortcuts and a live Claude Code status dot.
• The menu bar icon now shows a small red circle over its bottom-right square when Claude Code isn’t connected, in place of that square, with a Settings toggle to turn it off.
• Added a “Require Touch ID to reveal” toggle (on by default).
• Activity now opens inline inside the popover — a back arrow and an “Open in Full App” button, instead of always jumping to the full app. Never shows values.
• The manual setup command now correctly quotes the app’s path (it contains a space — “Claude Keychain.app”) and wraps instead of scrolling or getting cut off.
• Grouped keys (like Cloudflare’s Account ID + API Token) now show the same “last used” detail each key on its own already had.
• The clipboard-clear delay now offers 1 minute and 2 minutes alongside the existing options. “Anthracite” and “Dark” were two confusingly similar theme options; merged into one “Dark”.

Real one-click updates.

• Updating used to mean opening the website, downloading a DMG by hand, and reinstalling. Settings now has a single Install update button: it downloads, verifies, and installs the new version in place, then relaunches automatically. No browser trip.

A real dropdown, a tag system for grouped keys, and a calmer Settings tab.

• Every dropdown in Settings (theme, accent color, clipboard-clear delay) used the native macOS popup, which ignored almost all of the app's styling — wrong font, no spacing between items, moved on hover. Replaced with a custom-built dropdown that looks and behaves consistently everywhere.
• Two new theme options, Anthracite and Light Grey, plus Blue, alongside System/Light/Dark, and an accent color picker.
• Keys for the same app or service can now be grouped and tagged with the real credential-type name it uses (Publishable key, Secret key, Account ID, and so on), instead of all showing as flat, identically-styled rows. Covers 442 known services out of the box, with a general list for anything else.
• The About section and Danger zone were cramming a long description and a wide button into the same line. Restructured to a clearer stacked layout.
• The clipboard-clear setting was a number input next to a separate on/off toggle. Combined into one dropdown.
• The "Use a different key" flow now has a cancel button to back out without committing a new key.
• Settings' "Update available" banner used hardcoded colors that clashed with darker themes. It now follows the active theme.
• Restricting a key to specific projects moved out of a row-level lock icon and into the key's own detail panel, alongside the new app/tag fields.

Fixed a stale background process holding back your version number.

• After downloading a new version, Settings kept showing the old version number, and the app kept running the old build's server in the background indefinitely, since quitting or replacing the app never stopped it. Claude Keychain now detects a version mismatch against its own running server, replaces it automatically, and cleanly stops it on quit.

A working Download button, four real security features, and a cleaner Settings tab.

• Settings' "Update available" Download link (and every other link that opens in a new tab, anywhere in the app) did nothing when clicked. Same root cause as an earlier fix for alert/confirm/prompt dialogs: WKWebView silently drops target="_blank" links unless the host app explicitly handles them. It now opens in your default browser.
• Revealing and copying a secret now marks the clipboard entry as concealed and transient, so clipboard managers (Paste, Maccy, macOS's own clipboard history) skip it instead of keeping a permanent copy.
• The redaction safety net now also catches partial fragments of a secret (a truncated copy shown in a log line or error message), not just an exact full match.
• Secrets can now be restricted to specific project folders. A command run from outside those folders is refused, instead of any project being able to use any stored key.
• A command that hardcodes a stored secret's literal value directly, instead of using secretNames injection, is now refused before it runs, not just redacted after the fact.
• Settings: refined spacing, section headers, card depth, and hover states.

A real way to start over, and a fixed version number.

• Settings → Danger zone: Delete everything wipes every stored secret and all local data, including the parts that used to survive deleting the app itself (the macOS Keychain and the app's own local storage are never touched by dragging an app to Trash, on any Mac app, not just this one). Use it before uninstalling.
• Settings showed a hardcoded, out of date version number regardless of which build you were actually running. It now shows the real one.

A real safety net if a command echoes a secret back out.

• Claude Keychain now scans a command's output before it's returned and redacts any exact, unmodified copy of the secret it finds, so a command that carelessly prints its own environment (env, echo $VAR) gets [REDACTED] instead of leaking the value. This is a safety net, not a sandbox, and it doesn't catch everything. Full breakdown here.

Faster with a lot of secrets, and a menu bar icon you can pick.

• The Secrets list re-read the whole Keychain index on every keystroke in Search. It now filters in memory, so search stays instant past a few hundred secrets.
• Settings → General: choose the menu bar icon color, from five options, with a live preview.
• Tabs slide in and their hover glides, the secrets list draws itself in, rows sit lighter. The menu bar popover closes when it opens the full window, and the toolbar no longer jumps or hides the gear.

Much less CPU with the window open.

• The Log tab was re-reading its whole history from disk every second, even while you were looking at Secrets. It now does less than a tenth of the work, so Claude Keychain stays out of its own way.

Long secret values, truer logs, and fixes across every tab.

• Secret values over a few hundred characters no longer got cut off in the reveal view.
• The Log tab no longer shows a use from before a secret was renamed as a use of the new name.
• Every tab lays out correctly at the smallest window size, and figures read correctly in every language.
• Smaller fixes across Connect and Settings.

Keep Claude Keychain in the Dock, and a new installer.

• Turn on Settings → General → Show in Dock, and Claude Keychain stays in the Dock, so you can choose Keep in Dock and open it from there. The menu bar item stays either way.
• The download now opens on a proper install window: drag Claude Keychain to Applications and you're done.

Deleting a secret that won't delete, and connecting from a fresh Terminal.

• Deleting a secret now offers Delete and Force Delete, for the rare Keychain entry that won't remove when asked, verified against both the Keychain and the local index either way.
• claude mcp add now works the first time from a Terminal opened right after install, instead of needing a restart.

Importing a .env file with quoted values.

• .env files that wrap values in single or double quotes, or that use export before the key, now import cleanly instead of keeping the quotes as part of the secret.

A way to tell us how Claude Keychain is working for you.

• A week after you start using Claude Keychain, the menu bar panel asks once how it's going. You can also write to us any time from Settings → About.

A quicker way to reconnect after moving to a new Mac.

• Settings → About now has a single Reconnect Claude Code button, instead of needing to remove and re-add the MCP server by hand.

The first public build, for Apple silicon and Intel.

• Runs natively on Intel Macs as well as Apple silicon.
• A welcome screen that explains how Claude Keychain works, in three steps, before it asks you to add a secret.
• A new app icon, in five colors.

The first release.

• Add, reveal and delete secrets, stored in the macOS Keychain, not a database. Secret names only are tracked locally so the app can list them; values live in the Keychain alone.
• Import a .env file at once, instead of adding secrets one at a time.
• Connect to Claude Code in one click. It ships its own MCP server, exposing a tool to list secret names and a tool to run a command with a chosen secret injected as an environment variable.
• A log of when each secret was last used by Claude.
• A menu bar item, with a compact view of your secrets behind it.