Every LLM agent that does real work needs secrets: an OpenAI key, a Stripe key, a wallet's private key. Today those secrets sit in the prompt, where the model can read them, repeat them and be tricked into printing them.
SEALED keeps them out of the model's head. The agent writes a placeholder like {{vault:STRIPE}}. SEALED swaps in the real key at the edge, after the thinking is done, and scrubs it from whatever comes back.
An agent can't leak what it never saw. Not to a jailbreak, not to a hidden instruction in a web page, not to a screenshot of its logs.
Paste an agent log, a system prompt or a .env. SEALED checks it here, in your browser, for every key it would hand over. Nothing leaves this page.
Both agents were told to summarise a blog post. The post carried one hidden line. Watch what each of them did with it.
It asks for {{vault:STRIPE}} by name. The key itself was never in its prompt.
This agent, this tool, this host. Anything else and the placeholder stays a placeholder.
At the edge, after the model is done. The real value lives for one request and is gone.
Out to api.stripe.com with the real key on the wire, where it belongs.
If the response echoes the key back, it turns into {{vault:STRIPE}} again before the model reads it.
Illustrative feed. This is what the vault's log looks like: every row has a secret reference, none has a secret.
$SEALED is the key to the vault. Holding it is meant to unlock sealed slots for your agents: one slot, one secret your agent can use and never read.
No account, no sign-up. Your wallet is your key ring.
More held, more slots. Each slot seals one secret.
Swap the key in your prompt for {{vault:NAME}}. Done.
CA drops at launch| Key in the prompt | Key sealed | |
|---|---|---|
| The model can read it | Yes | Never |
| A web page can ask for it | And get it | Gets a placeholder |
| It shows up in logs | In full | As {{vault:NAME}} |
| Rotating it | Edit every prompt | One place |
| Holding | Slots | Title |
|---|---|---|
| 100k+ | 1 | Key holder |
| 1M+ | 5 | Locksmith |
| 5M+ | 12 | Vault keeper |
| 20M+ | ∞ | The banker |
CA drops at launchThe vault for LLM agents. The agent uses secrets by name, SEALED fills them in at the edge, and the model never sees the real value.
Because the key sits in the same context as everything else the model reads. A hidden line on a web page or in an email can ask for it, and a helpful model may comply.
No. It runs in your browser. Close the tab and it's gone.
Anything that makes HTTP calls with a key: Claude, GPT, open models, MCP servers, trading bots.
Yes. It checks for real key formats: OpenAI, Anthropic, Stripe, AWS, GitHub, Slack, Google, private keys, EVM and Solana wallet keys, JWTs and seed phrases.
The project token. The intended model: holding it unlocks vault slots. Not live, not advice.