Sync .env files

sync .env files between machines, environments, and team members–from the creator of GitHub dotenv ★ 17.9k

Self-funded and profitable ⋅ Trusted by tens of thousands of companies worldwide

Works with a single command

You don't need to install anything to use dotenv-vault. No error prone binaries to install, infra to maintain, or custom code to write. It just works – with a single command.

"I love how easy it is to get started in a snap. I'm using it to sync between my pc and laptop."
Faisal Abidi – Lead Software Engineer
$
npx dotenv-vault push

Multiple Environments

After you've pushed your .env file, you can manage your secrets across multiple environments. Open an environment to view and edit its environment variables.

"I've been using dotenv for a few years, but only now have I come across dotenv-vault. I'm excited to start using it and replace my instance of hashicorp vault."
Brian Patino – Software Engineer III

Integrates Everywhere

Integrates everywhere you already write, test, build, and deploy your code. Generate your encrypted .env.vault file, commit that safely to code, and deploy. There's nothing else like it.

"I went from 'not knowing what this even is' to 'integrated into my project' within 5 minutes. Having each cli command tell me the next step was super helpful."
Anthony Lukach – Cloud Engineer
I've been thinking about building exactly this for ages, was doing some market research for how to do it properly and found that you had, well, nailed it.
Josh McKenty
Cofounder of OpenStack

Teams love it

Each month, hundreds more software teams start using dotenv-vault.

From the same people that pioneered dotenv. Trusted by millions of developers worldwide.

Frequently asked questions

dotenv-vault is the only secrets manager that works with .env files instead of against them.

Other secrets managers make you replace your environment variables with remote API calls. This means you must rewrite your code, lock yourself into proprietary software, and possibly introduce new attack vectors to your software (It's generally easier for attackers to intercept your web traffic than to gain access to your file system.)

Your secrets go through a ten-step process to split their parts, encrypt those parts, and tokenize them into your project's vault. This includes using AES-GCM encryption - trusted by governments to transport top secret information. Read more about the ten-step process on the security page.

The .env.vault file is an encrypted version of your .env file. It is paired with a decryption key called the DOTENV_KEY. The DOTENV_KEY is set on your server or cloud hosting provider and the .env.vault file is committed to code.

Yes. AES-256 GCM encryption was developed for the needs of US Government agencies like the CIA. AES-256 takes billions of years to crack using current computing technology. Your secrets are much more likely to be leaked by a third-party. This is why we are so committed to this technology while everyone else is focused on syncing secrets to third-party integrations. We see a better way.

In the CircleCI breach the attacker accessed environment variables only. They could not access codebases. To steal your .env.vault secrets, an attacker needs need both – the decryption key (stored as an environment variable), AND the encrypted .env.vault file.

Not officially, but our goal is towards that. We're building things in a way that a cloud service is not necessary. As long as you can generate a .env.vault file you can use the technology. It is open to all.

The .env.vault file and its encryption algorithm is language-agnostic so technically it works with any language. We've built convenience libraries for it in a handful of languages and are adding more as requested. See the docs for a complete list.

See the install page. You can use npx, brew, and more.

Can’t find the answer you’re looking for? Send us an email at [email protected] team. We'd love to hear from you.