How to uninstall Secretive on Mac

Secretive keeps SSH keys in your Mac's Secure Enclave, and its README says those keys cannot be exported or backed up and cannot move to another Mac. Before removing the app, add a different key to every server, Git host or machine that still trusts a Secretive key, because there is no backup to restore from if those keys are lost.

Quit Secretive and remove the app

Secretive registers a background helper, SecretAgent, that keeps answering SSH requests after you quit the main app. Turn it off under System Settings › General › Login Items & Extensions, then quit Secretive and move it from Applications to the Trash.

Where Secretive keeps its data

In Finder, press Shift + Command + G and check each location that exists.

After replacing the keys you still need and quitting Secretive and SecretAgent, open each existing location or its parent in Finder and move only the unwanted Secretive items to the Trash. Keep data still used by another installed copy and leave the Containers and Application Scripts parent folders intact.

Check the result

pgrep -il secret
launchctl list | grep -i secretive
ls -d ~/Library/Containers/com.maxgoedjen.Secretive.Host ~/Library/Containers/com.maxgoedjen.Secretive.SecretAgent

• No output from pgrep means neither Secretive nor SecretAgent is running.
• No match after a successful launchctl list means no listed session label contains secretive; it does not rule out differently named jobs. A com.maxgoedjen.Secretive.SecretAgent line identifies a remaining registered job, so turn off the corresponding item in Login Items & Extensions and check its process and job again.
• ls -d printing "No such file or directory" for a path means that container is gone.

If you installed it with Homebrew

Mole skips --zap when its list reaches unchecked or shared data, or cannot fully be checked, and still cleans the leftovers you selected.

The secretive cask's zap list trashes the Application Scripts folders for the main app and SecretAgent, plus every container matching com.maxgoedjen.Secretive.*, which also reaches the SecretiveUpdater container. With “Remove data and settings with apps” off, the SecretAgent and SecretiveUpdater rows stay unticked. Turning it on can select eligible reviewed helper data; check the final rows after replacing the SSH keys. Mole uses --zap only when the full removal list passes review. Running brew uninstall --cask --zap secretive yourself trashes that whole list regardless of what Mole would tick.

brew uninstall --cask secretive

What Mole lists

For an officially downloaded Secretive:

• The main app's own Application Scripts folder and container are selected by default.
• The Application Scripts folders and containers for SecretAgent and SecretiveUpdater are listed for review. They stay unticked with “Remove data and settings with apps” off and can be selected with that setting on when they pass the app-data checks.
• When SecretAgent is still running, Mole stops at a Quit and Remove confirmation; after you confirm, it stops SecretAgent before removing the app.

What this test covered

Secretive 4.0.0 was installed from its official GitHub release and uninstalled on September 25, 2026, with a development build of Mole. SecretAgent registered itself on first launch and was relaunched after being quit, so the removal stopped at the Quit and Remove step; after confirming, the helper was stopped first, then the app and its containers were removed. Every review row was ticked and trashed, and nothing was left on disk or in the login item list afterward. Whether existing SSH keys kept working elsewhere was not tested.