git-crypt

git-crypt is a command-line tool that enables transparent encryption and decryption of files within a git repository. Files designated for protection are automatically encrypted upon commit and decrypted upon checkout, allowing teams to share repositories containing a mix of public and private content without locking down the entire repository. Key features include: - Transparent encryption and decryption via git filters, so users can work with git normally after initial setup - AES-256 in CTR mode with a synthetic IV derived from the SHA-1 HMAC of the file, providing semantic security under deterministic chosen-plaintext attack - GPG-based key sharing for multi-user collaboration, where public keys are added via git-crypt add-gpg-user - Symmetric key export for secure key distribution without requiring GPG - Graceful degradation, so developers without the secret key can still clone and commit to the repository Configuration is done through a .gitattributes file that specifies which files or patterns should be encrypted. The pattern format is similar to .gitignore, supporting wildcards and directory patterns. The .gitattributes file itself must not be encrypted, and rules must be in place before adding sensitive files. Security considerations: git-crypt is more secure than other transparent git encryption systems that use ECB or CBC with a fixed IV. However, it does not encrypt file names, commit messages, symlink targets, or other metadata. It does not hide when a file changes, the length of a file, or the fact that two files are identical. It also does not support revoking access to an encrypted repository that was previously granted, as this is inherently complex in the context of historical data. Limitations include: not suitable for encrypting most or all files in a repository (better suited for selective encryption of a few sensitive files like private keys or API credentials), encrypted files are not compressible so even small changes require storing the entire file, and it may not work reliably with some third-party git GUIs such as Atlassian SourceTree and GitHub for Mac. Files encrypted with git-crypt cannot be patched with git-apply unless the patch itself is encrypted. The latest version is 0.8.0, released on 2025-09-23. The project aims to be bug-free and reliable but has not yet reached full maturity, and backwards-incompatible changes may be introduced before version 1.0.