AsciiDoc Files
Edit AsciiDoc source and see its preview side by side.
Secret Parcel transfers selected Obsidian secrets in an encrypted file
Transfer selected secrets and preview conflicts.
MIT · no telemetry · core features free
- version
- 1.1.0
- downloads
- 27
- review
- Passed
- health
- Excellent
- license
- MIT
- listed for
- Desktop, Mobile
- obsidian
- 1.11.4 or later
The cryptography has not had an independent audit. Physical mobile devices, cross-vault mobile keychain sharing and cloud sync providers were not tested.
Directory facts fetched from community.obsidian.md/users/theluckystrike.
About Secret Parcel
You need the same selected plugin credentials on another device without re-entering each value.
Secret Parcel lists secret IDs while keeping their values hidden. Select the IDs you need and export them to an encrypted vault file. On the target device, preview new IDs and conflicts before confirming import.
Export, import and write verification are free. Keep the passphrase separate from the parcel, and check failed IDs before removing the parcel.
Play demoFree features
Secret ID checklist
Choose IDs from the checklist; values stay hidden. Export stays disabled until you select an ID. The plugin reads selected values when you export, rather than to build the list.
Encrypted vault export
PBKDF2-SHA256 uses 310,000 iterations and a random 16-byte salt to derive a 256-bit AES-GCM key. Encryption uses a random 12-byte IV and puts IDs and values inside the encrypted payload. A new export never replaces an existing parcel; a taken file name gets a numbered suffix.
Import preview and conflict choices
The plugin decrypts and validates the complete payload before opening the preview. Conflicting IDs start unticked. Confirm import writes new IDs and the replacements you selected.
Read-back result report
Each write reads the value back for comparison and reports written, skipped or failed IDs. Failed entries do not stop later attempts. The write step rechecks conflicts, including IDs added since the preview.
Pro features
Pro costs $5 a month or $15 one time through GitHub Sponsors. One sponsorship turns on Pro in every plugin that has it.
Saved export profiles Pro
Save a profile name, ID prefix and export folder, up to 50 profiles. Prefixes narrow the checklist without selecting IDs. Profiles contain no passphrases or secret values.
Dated encrypted backups Pro
Pro creates manual dated backups with a retention limit from 1 to 100. After writing a backup, it removes older tracked backups using Obsidian’s deletion preference. Ordinary exports and untracked parcels stay outside that cleanup.
Keychain comparison Pro
Compare a decrypted parcel with the current keychain without writing secrets. New and missing IDs appear alongside changed and unchanged IDs, determined by SHA-256 hashes of values.
Set up Secret Parcel
needs
- Obsidian 1.11.4 or later
steps
Check the source vault and run Export secrets.
Select the required IDs, choose a vault folder and enter a long, unique passphrase of at least eight characters.
Transfer the encrypted parcel to the target vault and run Import parcel there.
Enter the passphrase and review new IDs and conflicts, selecting replacements only when intended.
Confirm import, inspect the result and test the consuming plugin with its usual command.
If the app can't find a new plugin yet, try again later. Obsidian says a plugin that passes the review shows in the app within 24 hours.
Known limits of Secret Parcel
- The cryptography has not had an independent audit, and a weak passphrase can be guessed by someone with the file.
- There is no passphrase recovery; a wrong passphrase or failed authentication stops import before writing.
- Payloads are limited to 500 entries, with IDs of 1 to 128 lowercase letters, digits or dashes.
- Values must be text of at most 65,536 UTF-8 bytes, and duplicate IDs are refused.
- Parcel input is limited to 48 MiB.
- A failed write does not undo completed writes; inspect written, skipped and failed IDs before removing the parcel.
- Backup creation is manual, and retention removes only older tracked backup paths after a new backup is written.
- Renaming or moving a tracked backup leaves its old path in the retention list, so cleanup no longer finds that file.
- A partial export can show current keychain IDs as missing from the parcel during comparison.
- The checklist can include GitHub sign-in tokens; leave them unselected unless you intend to transfer those credentials.
- Physical mobile devices, cross-vault mobile keychain sharing and cloud sync providers were not tested.
Need a change for your team? I build custom Obsidian plugins and features.
Questions about Secret Parcel
What does a parcel contain?
The outer JSON contains v, kdf, salt, iv and ct fields. Secret IDs and values sit inside the encrypted payload.
Can I recover a forgotten passphrase?
No, the plugin has no passphrase recovery. A weak passphrase can be guessed by someone who has the file.
What limits apply to imported secrets?
A payload can contain up to 500 entries with IDs of 1 to 128 lowercase letters, digits or dashes. Each value must be text of at most 65,536 UTF-8 bytes. Duplicate IDs are refused before writing.
Does export remove the source credentials?
No, export doesn't clear the source keychain. The checklist can include GitHub sign-in tokens, so leave those unselected unless you intend to transfer them.
Network use
After you choose Sign in with GitHub, github.com receives the public client ID and read:user scope for device sign-in. Then api.github.com receives your token and a sponsorship query at sign-in, periodic checks or Refresh. The plugin sends no vault data; successful checks last seven days, and failed checks can retry after six hours.
Questions or ideas?
Tell me what is broken in Secret Parcel, or what it should do next.
Secret Parcel 1.1.0, MIT license
MIT · no telemetry · core features free
Related plugins
Search Operators
Find notes by date and links, with a preview for each result.