Backup and restore

Your secrets live in the OS keychain. Native keychain backups don't move between operating systems, so keymitt has its own: one encrypted file with the policy and every secret value, which restores on macOS, Windows or Linux.

Back up

keymitt backup keymitt-2026-10.age

1. keymitt asks for strong approval — Touch ID or your password, Windows Hello or polkit. Weak methods are never accepted here, whatever your settings say: a backup contains everything.
2. You choose a passphrase (at least 12 characters) and type it twice.
3. keymitt writes the file, refusing to overwrite an existing one.

Secrets that are in the policy but have no value in the keychain are listed and skipped.

The file is an ASCII-armored age file encrypted with your passphrase (scrypt). Store it the way you would store a password-manager export, and keep the passphrase somewhere else: without it the backup cannot be restored.

Restore

keymitt restore keymitt-2026-10.age
keymitt restore keymitt-2026-10.age --overwrite

keymitt asks for the passphrase, shows what the backup contains, and asks for strong approval (a backup can add policy entries). Then it:

• writes each secret to this machine's keychain, keeping values that already exist unless you pass --overwrite;
• merges the backup's policy entries into your policy, keeping existing entries unless you pass --overwrite.

Never for agents

Backup and restore are command-line only, require an interactive terminal, and are not exposed as MCP tools. If an agent could choose the passphrase, it could decrypt the backup — so exporting is something only you can start.

The policy on its own

policy.toml contains no secret values. Keep it in your dotfiles or a repository if you like, and use backups for the values.