[GH-ISSUE #5873] [feature]: Encrypt locally stored secrets #2312

New issue

Open

opened 2026-03-16 23:55:28 +03:00 by kerem · 2 comments

kerem commented

2026-03-16 23:55:28 +03:00

Owner

Originally created by @thmbck on GitHub (Feb 12, 2026).
Original GitHub issue: https://github.com/hoppscotch/hoppscotch/issues/5873

Is there an existing issue for this?

I have searched the existing issues

Summary

In Hoppscotch desktop, secrets defined in environments, collections, or entered in the authorization section of a request, are stored in plain text at a well-known location in a world-readable file (hoppscotch.hoppscotch.store on macOS). This sensitive information should be protected by encryption with a key provided by the user. The Hoppscotch app should prompt the user for the key to decrypt the secrets when needed or upon startup.

Why should this be worked on?

According to the Hoppscotch documentation, "It is expected that the user will populate the value of the variable at runtime." However, it is impossible to enter a secret, such as an access token, without Hoppscotch storing it as plain text in a public file. This is especially concerning when a computer is shared. Encryption is an easy way to keep secrets more secure.

Originally created by @thmbck on GitHub (Feb 12, 2026). Original GitHub issue: https://github.com/hoppscotch/hoppscotch/issues/5873 ### Is there an existing issue for this? - [x] I have searched the existing issues ### Summary In Hoppscotch desktop, secrets defined in environments, collections, or entered in the authorization section of a request, are stored in plain text at a well-known location in a world-readable file (hoppscotch.hoppscotch.store on macOS). This sensitive information should be protected by encryption with a key provided by the user. The Hoppscotch app should prompt the user for the key to decrypt the secrets when needed or upon startup. ### Why should this be worked on? According to the Hoppscotch documentation, "It is expected that the user will populate the value of the variable at runtime." However, it is impossible to enter a secret, such as an access token, without Hoppscotch storing it as plain text in a public file. This is especially concerning when a computer is shared. Encryption is an easy way to keep secrets more secure.

kerem added the

feature

label

2026-03-16 23:55:28 +03:00

kerem commented

2026-03-16 23:55:39 +03:00

Author

Owner

@thmbck commented on GitHub (Feb 12, 2026):

Even more concerning is that the secrets are logged unmasked in the restHistory section in hoppscotch.hoppscotch.store.

@thmbck commented on GitHub (Feb 12, 2026): Even more concerning is that the secrets are logged unmasked in the restHistory section in hoppscotch.hoppscotch.store.

kerem commented

2026-03-16 23:55:44 +03:00

Author

Owner

@bittoby commented on GitHub (Feb 21, 2026):

@jamesgeorge007 @CuriousCorrelation Hi, I'm interested in this project. I'd like to contribute. Can I pick this up?
thank you

@bittoby commented on GitHub (Feb 21, 2026): @jamesgeorge007 @CuriousCorrelation Hi, I'm interested in this project. I'd like to contribute. Can I pick this up? thank you

kerem referenced this issue

2026-03-17 01:19:02 +03:00

[PR #2312] [CLOSED] chore(deps-dev): bump jest from 27.5.1 to 28.0.3 #3727