Switch hosts entries and environment variables per project on macOS, without editing /etc/hosts or keeping .env files around.
- Hosts contexts: group hosts entries and turn them on or off with one click. Your own entries in
/etc/hostsare never touched. - Credential contexts: keep environment variables in an encrypted vault and serve them to your shells. Several contexts can be active at once, layered by priority.
- File variables: store certificates or kubeconfigs encrypted, and let the variable receive their path.
- Variable references: reuse values with
{$VAR}, for example{$APP_PATH}/config. - Import and export: bring in hosts and
.envfiles by drag and drop, and export any screen to a file. - macOS integration: Touch ID for hosts changes, system tray and launch at login.
Download the latest .dmg from Releases. Bypass requires macOS on Apple Silicon.
Create a context in the Hosts tab, add your entries and turn it on. Bypass writes them to a marked block in /etc/hosts and flushes the DNS cache:
# ===== BYPASS MANAGED START =====
# >>> Context: "Development"
127.0.0.1 api.local
# <<< Context: "Development"
# ===== BYPASS MANAGED END =====
Contexts are written in sidebar order, so the higher one wins when two define the same hostname. An active context is read-only because every change needs administrator approval; turn it off to edit it.
- In Settings, turn on Enable shell agent and install the Shell hook.
- In Credentials, create a context, add your variables and turn it on.
- Your shells pick up the changes on their next prompt.
When several active contexts define the same variable, the one higher in the sidebar wins. Active Variables shows exactly what your shells receive.
For tools that expect a path, such as KUBECONFIG or GOOGLE_APPLICATION_CREDENTIALS, switch the add row from Text to File, type the variable name, choose a file of up to 1 MiB and click Add. Bypass keeps an encrypted copy and the original is not modified.
- Variables and files are stored in
store.enc, encrypted with ChaCha20-Poly1305. The master key is kept in the macOS Keychain. - File variables are the one exception to encryption at rest, because other tools need to read them. While its context is active and the shell agent is on, each file is available unencrypted at
~/.bypass/files.noindex/<KEY>/<file name>. It has0600permissions and is excluded from Spotlight and Time Machine. - These files are removed when the context is turned off, the variable is deleted, the shell agent is turned off or Bypass quits. Anything left by a crash is removed the next time Bypass starts.
To report a vulnerability, see SECURITY.md.
You need Node.js 22 or later, pnpm 10 or later, Rust and the Tauri prerequisites.
pnpm installpnpm tauri devIf you use Task, task --list shows shortcuts for development, tests, linting and builds, including task build:local for a release build without signing keys.
See CONTRIBUTING.md for the project layout and pull request guidelines, and docs/release-signing.md for release signing.