Sealed Secrets is composed of two parts:

A cluster-side controller / operator
A client-side utility: kubeseal

The kubeseal utility uses asymmetric crypto to encrypt secrets that only the controller can decrypt.