How to uninstall Secretive on Mac

Secretive keeps SSH keys in your Mac's Secure Enclave, and its README says those keys cannot be exported or backed up and cannot move to another Mac. Before removing the app, add a different key to every server, Git host or machine that still trusts a Secretive key, because there is no backup to restore from if those keys are lost.

Quit Secretive and remove the app

Secretive registers a background helper, SecretAgent, that keeps answering SSH requests after you quit the main app. Turn it off under System Settings › General › Login Items & Extensions, then quit Secretive and move it from Applications to the Trash.

Where Secretive keeps its data

In Finder, press Shift + Command + G and check each location that exists.

Location What it holds What to do
~/Library/Containers/com.maxgoedjen.Secretive.Host The app's sandbox container Remove once you no longer need Secretive
~/Library/Application Scripts/com.maxgoedjen.Secretive.Host The app's scripts folder Remove with the app
~/Library/Containers/com.maxgoedjen.Secretive.SecretAgent, ~/Library/Containers/com.maxgoedjen.Secretive.SecretiveUpdater Sandbox containers for SecretAgent and the update checker Review before removing; not needed once the app is gone
~/Library/Application Scripts/com.maxgoedjen.Secretive.SecretAgent, ~/Library/Application Scripts/com.maxgoedjen.Secretive.SecretiveUpdater Scripts folders for those two components Review before removing

Check the result

pgrep -il secret
launchctl list | grep -i secretive
ls -d ~/Library/Containers/com.maxgoedjen.Secretive.Host ~/Library/Containers/com.maxgoedjen.Secretive.SecretAgent
  • No output from pgrep means neither Secretive nor SecretAgent is running.
  • No output from launchctl list means SecretAgent is no longer loaded; a line naming com.maxgoedjen.Secretive.SecretAgent means it still is, so turn it off in Login Items & Extensions and check again.
  • ls -d printing "No such file or directory" for a path means that container is gone.

If you installed it with Homebrew

Mole skips --zap when its list reaches unchecked or shared data, or cannot fully be checked, and still cleans the leftovers you selected.

The secretive cask's zap list trashes the Application Scripts folders for the main app and SecretAgent, plus every container matching com.maxgoedjen.Secretive.*, which also reaches the SecretiveUpdater container. The SecretAgent and SecretiveUpdater rows are unticked by default, so Mole removes Secretive without --zap unless you tick them. Running brew uninstall --cask --zap secretive yourself trashes that whole list regardless of what Mole would tick.

brew uninstall --cask secretive

What Mole lists

For an officially downloaded Secretive:

  • The main app's own Application Scripts folder and container are selected by default.
  • The Application Scripts folders and containers for SecretAgent and SecretiveUpdater are listed but not selected by default, since they belong to helper components inside the app.
  • When SecretAgent is still running, Mole stops at a Quit and Remove confirmation; after you confirm, it stops SecretAgent before removing the app.

What this test covered

Secretive 4.0.0 was installed from its official GitHub release and uninstalled on September 25, 2026, with a development build of Mole. SecretAgent registered itself on first launch and was relaunched after being quit, so the removal stopped at the Quit and Remove step; after confirming, the helper was stopped first, then the app and its containers were removed. Every review row was ticked and trashed, and nothing was left on disk or in the login item list afterward. Whether existing SSH keys kept working elsewhere was not tested.