diff --git a/pkgs/applications/version-management/blackbox/default.nix b/pkgs/applications/version-management/blackbox/default.nix
new file mode 100644
index 000000000000..569606d2fdb6
--- /dev/null
+++ b/pkgs/applications/version-management/blackbox/default.nix
@@ -0,0 +1,25 @@
+{ stdenv, fetchFromGitHub }:
+
+stdenv.mkDerivation rec {
+  version = "1.20170611";
+  pname   = "blackbox";
+  name    = "${pname}-${version}";
+
+  src = fetchFromGitHub {
+    owner  = "stackexchange";
+    repo   = pname;
+    rev    = "v${version}";
+    sha256 = "1jnzhlj54c0szw9l9wib07i2375pbm402bx9wagspcmwc0qw43p6";
+  };
+
+  installPhase = ''
+    mkdir -p $out/bin && cp -r bin/* $out/bin
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Safely store secrets in a VCS repo";
+    maintainers = with maintainers; [ ericsagnes ];
+    license     = licenses.mit;
+    platforms   = platforms.all;
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index dfbcf5d1f596..395a80857456 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -13467,6 +13467,8 @@ with pkgs;
     inherit (gnome2) zenity;
   };
 
+  blackbox = callPackage ../applications/version-management/blackbox { };
+
   bleachbit = callPackage ../applications/misc/bleachbit { };
 
   blender = callPackage  ../applications/misc/blender {