Say Goodbye To ENV Files Forever For Desktop & Server

Credential ManagementFor The Agentic Engineer

All Credentials Automatically Rotated & Selectively Shared

  1. Get Member Email To Download
  2. Migrate, Install Phone & Browser Extension
  3. Never Think About Credentials Again

Designed so your master password never touches our servers — not even hashed (OPAQUE)Designed so there is nothing to steal — the cloud holds only ciphertextDesigned for post-quantum — ML-KEM-768 hybrid encryptionDesigned on named, audited primitives — Argon2id · XChaCha20-Poly1305 · Ed25519Built for scheduled rotation — every key carries a deadline, and the agent rotates it when you say goKill the .env — secrets injected at runtime, never plaintext in your repoBuilt to fill your forms for you: logins and 2FA codes, in your browser and on your phoneExcellent usability: set up in 15 minutes, then it works quietly in the backgroundEvery subscription on one screen: plans, prices and renewal dates, with a warning the day before

ICOSAHEDRON

Security Ecosystem:
Mythos-Grade Resilience

local channelSSH ·Ed25519-pinned bundleTLS · metadataguardianalarm pushTLS 1.3 ·post-quantum hybridTLS 1.3 · post-quantum hybridDEVICE · DESKTOPDecaapp shell + secure coreholds the file keyagent worker · agent-access serverPROCESS · BROWSEROctabrowser extensionstores nothinglocal link to DecaDEVICE · PHONEHexa + Dodecafull local encrypted vaultcredential-provider extensionsecure app containerDEVICE · ENROLLED SERVERTetralocal daemonhardware-bound keyno network listenerNODE · RELAYRelayheartbeats · alarmsmetadata onlyavailability onlyNODE · ICO CLOUDDimanaged cloud + object storeciphertext blobs onlyone command: mark lost

Every Credential You Own

Handled, Not Managed

DAEMON (TETRA)

Decoys, canaries, kill & dead switches, rhythms & other tricks to keep your server bulletproof.

PW & SSO

Generated, filled, rotated on a schedule. You never type one again.

LISTS (CUBES)

A teammate gets the vault, not a copy. Leave, and everything rotates.

SUBSCRIPTIONS

Every token, charge and renewal date read from your vendors, not your memory.

SERVER & SSH

A vault with no login on every host. Secrets arrive when the process asks.

MCP

Talk to ICO, get suggestions, clean up entries, batch process & CLI remote control.

KEYS & TOKENS

Issued fresh, old one revoked, injected at runtime. Nothing on disk.

REMOTE WIPE

Laptop stolen? Guaranteed instant encryption & deletion with phone.

USABILITY

Setup in 15min & truly enter a new era of simplicity, efficiency, and automation. We thought of everything.

PASSKEYS

Icosahedron is the provider. One touch on the phone signs in everywhere.

INDEXING

As you create a new entry of any type, relevant tags can be tapped to make searching lightning fast.

2FA

Scan the export QR once. Codes sync to every surface and fill themselves.

DAEMON (TETRA)

Decoys, canaries, kill & dead switches, rhythms & other tricks to keep your server bulletproof.

PW & SSO

Generated, filled, rotated on a schedule. You never type one again.

LISTS (CUBES)

A teammate gets the vault, not a copy. Leave, and everything rotates.

SUBSCRIPTIONS

Every token, charge and renewal date read from your vendors, not your memory.

SERVER & SSH

A vault with no login on every host. Secrets arrive when the process asks.

MCP

Talk to ICO, get suggestions, clean up entries, batch process & CLI remote control.

KEYS & TOKENS

Issued fresh, old one revoked, injected at runtime. Nothing on disk.

REMOTE WIPE

Laptop stolen? Guaranteed instant encryption & deletion with phone.

USABILITY

Setup in 15min & truly enter a new era of simplicity, efficiency, and automation. We thought of everything.

PASSKEYS

Icosahedron is the provider. One touch on the phone signs in everywhere.

INDEXING

As you create a new entry of any type, relevant tags can be tapped to make searching lightning fast.

2FA

Scan the export QR once. Codes sync to every surface and fill themselves.

Passwords
SSO
Passkeys
2FA Codes
TOTP Seeds
Crypto Wallets
API Keys
OAuth Tokens
SSH Keys
Database URLs
Root Passwords
Licence Keys
Wi-Fi
Recovery Codes
Webhook Secrets
Signing Keys
Cloud Credentials
Service Accounts
Payment Cards
Addresses
Env Vars
Certificates
Notes
Zero-Knowledge Proofs
Argon2id
XChaCha20-Poly1305
Ed25519 Signatures

The .ENV File

Abolished, Not Managed

ICO doesn’t store your .env — it dissolves it. Every line becomes a real, typed entry: STRIPE_SECRET_KEY becomes an API key, GITHUB_TOKEN a token, SUPABASE_DB_URL a database credential. Your scripts and agents carry handles — {{ico:API KEY/Stripe#key}} — and ICO fills the real value at the moment of use, in-process. Secrets are injected at runtime. Nothing is ever written back to disk.

Cheaper, Better & Beautiful

Simple Subscriptions For Peace Of Mind

$11

Per month

Tetra Daemon

$11

Per month

Everything Else

Stripe
Supabase
Sentry
PostHog
Figma
Claude
Wrangler
Devin
Tauri
ChromeDev

In The Cloud

Nothing To Steal, Not Even By Its Guardians

Locked Before It Leaves

A breach, an insider or a subpoena gets noise, never your passwords.

We Can Read Nothing, Only Wipe

The one thing the cloud can do to your data is delete or lock a device you marked lost. That is the feature.

Your Master Password Stays Yours

Designed so it never has to reach our servers.

On Your Machines

Locked At Rest, Proven Without A Password

Locked At Rest

The vault is encrypted on disk, with its keys tied to your device’s hardware.

Quick To Lock

Idle, or your computer locks: the vault locks and the keys leave memory.

Server Identity

A Tetra server proves who it is from its own hardware, not a password.

Honestly Framed

Not unhackable. Nothing is. Encrypted, hardware-bound, fast to lock.

When It Goes Wrong

Nothing Of The Old Identity Survives

Identity Revoked

Its place in your vault is dead, and nothing can revive it.

Access Keys Pulled

Gone from every machine that trusted it.

Credentials Reset

Reset at the provider, never on the machine.

Machine Rebuilt

Wiped and rebuilt clean again before it is allowed back.

Before You Download

The Six Questions Everyone Asks

If You Have A User’s Email Address

You Can Unlock The Download

No Credit Card Required

Setup In Less Than 3 Minutes