v1.1.0 — 8 Commands Now Available

Stop sharing
.env files
over chat apps.

A dev-friendly CLI workflow for encrypting, auditing, and sharing your environment secrets. AES-256-GCM. Zero account. Zero server. Zero drama.

$ npm install envcrypted
AES-256Encryption
8Commands
0Accounts needed
MITFree Forever
The Problem

Your secrets are
leaking.

Every team has done it. It's not carelessness — it's a missing tool. envcrypted is that tool.

Developer Chat — Slack / WhatsApp / Telegram
Khaleel: bro can you send me the .env?

You: yeah one sec

You:
DB_PASSWORD=supersecret123
API_KEY=sk-live-xxxxxxxxxxx
JWT_SECRET=myproductionsecret

⚠ Now backed up to iCloud.
⚠ Screenshot-able. Searchable. Forever.
💬
Secrets sent over chat
Chat apps, email, ticketing systems — none of these are safe channels for API keys and database passwords.
🔄
Out of sync between teammates
Someone adds a new variable. Nobody knows. Production breaks at 2 AM.
🗑️
Accidentally committed to Git
Even deleted, it lives in git history forever. TruffleHog and GitGuardian scan GitHub for exactly this.
🔐
envcrypted fixes this workflow
Encrypt once. Commit the vault safely. Share the secret key through a proper channel. Everyone stays in sync.
How It Works

Simple by design.
Secure by default.

Four steps. One secret key. Your .env stays yours.

Step 01
⚙️
Initialize
Generate secret key, choose storage, auto-update .gitignore
Step 02
🔐
Encrypt
.env → AES-256-GCM → .env.vault
Step 03
📤
Share Vault
Commit .env.vault safely — no secrets inside
Step 04
🔓
Decrypt
Team pulls + secret key = .env restored instantly
envcrypted — live demo
$ npx envcrypted init
  ✔  Master key generated!
  ✔  Added to .gitignore: .env, .env.*

$ npx envcrypted audit
  ✖  DB_PASSWORD=1234 — weak password
  ⚠  localhost detected — not safe for production

$ npx envcrypted push
  ✔  Encrypted vault saved as .env.vault

$ npx envcrypted pull
  ✔  .env restored successfully!
▶ Interactive Demo — all 8 commands
Commands

8 commands.
Complete workflow.

Everything your team needs to secure, share, audit, and sync environment variables.

Core — encrypt & decrypt
envcrypted initSetup

Set up envcrypted, generate a secret key, choose storage (local or GitHub), and auto-update .gitignore to protect .env.

$npx envcrypted init
envcrypted pushEncrypt

Encrypts your .env with AES-256-GCM and saves as .env.vault. GitHub storage auto-commits and pushes.

$npx envcrypted push --message "update keys"
envcrypted pullDecrypt

Decrypts the vault and restores your .env file. Perfect for new team members getting started in seconds.

$npx envcrypted pull
envcrypted auditSecurity

Scans .env for weak passwords, placeholder keys, exposed DB URIs, localhost in production, debug flags, and more.

$npx envcrypted audit
New in v1.1.0 — team productivity
envcrypted generateUtility

Strips all values from .env, keeps keys → creates .env.example safe to commit publicly.

$npx envcrypted generate
envcrypted statusInfo

Quick snapshot of your project: vault state, gitignore, hook installed, .env.example — all at once.

$npx envcrypted status
envcrypted doctorHealth

Runs 8 health checks on your setup and tells you exactly what's wrong and how to fix it.

$npx envcrypted doctor
Git protection
envcrypted hook installGit Hook

Adds a git pre-commit hook that warns if .env is unencrypted and blocks any commit where .env is accidentally staged.

$npx envcrypted hook install
envcrypted hook uninstallGit Hook

Removes the envcrypted pre-commit hook from your repository cleanly without affecting other hooks.

$npx envcrypted hook uninstall
Security

Built on proven crypto.
Auditable by anyone.

Uses Node.js's built-in crypto module — the same one used by millions of production apps. Open source. No black boxes.

AlgorithmAES-256-GCM
Key DerivationPBKDF2-SHA512
Iterations100,000
Salt64 bytes (random per encryption)
IV16 bytes (random per encryption)
Auth Tag16 bytes (tamper detection)
Secret Key StorageNever stored anywhere
LicenseMIT — open source

🔑 How the secret key works

1
You provide a secret key (generated or custom)
↓
2
PBKDF2 derives a 32-byte key (100K iterations)
↓
3
AES-256-GCM encrypts with random salt + IV
↓
4
Vault is safe to commit. Secret key is never stored.
↓
5
Without the key, the vault is computationally impossible to crack
Team Workflow

Works for every
team setup.

Solo dev, small team, or large org — the workflow scales with you.

👑 Team Lead
$ npm install envcrypted
$ npx envcrypted init
$ npx envcrypted audit
$ npx envcrypted generate
$ npx envcrypted hook install
$ npx envcrypted push

# share secret key securely — never over chat
👤 New Team Member
$ git clone <repo>
$ npm install envcrypted
$ npx envcrypted init
$ npx envcrypted pull

✔ .env restored. Ready to code.
🔍 Daily Health Check
$ npx envcrypted status
✔ .env found
✔ .env.vault up to date
✔ hook installed

$ npx envcrypted doctor
✔ Everything looks healthy!
Community

Built in public.
Grown by the community.

envcrypted is open source and actively improving based on real developer feedback. Every issue, idea, and PR matters.

A note from the builder: I built this in one day to solve a real problem I kept running into. It works — but it's not perfect. If you find a bug, have a better idea, or want to contribute, please open an issue or PR. I read everything. This tool gets better with your help.
🐛
Found a bug?
Open an issue on GitHub. Include your OS, Node version, and what happened vs what you expected.
Open an issue →
💡
Have an idea?
Feature requests are welcome. If it solves a real dev problem and fits the zero-server philosophy, it belongs here.
Start a discussion →
⭐
Using it daily?
A GitHub star helps other developers find this tool. It also tells me the project is worth continuing to improve.
Star on GitHub →
Secure Key Sharing

Stop sending your
secret key in chats.

You encrypted the vault. Now share the secret key properly — a one-time link that self-destructs after being viewed once. No trails. No logs. No risk.

Get Started

One install.
Secure forever.

Free. Open source. No account. No server.
Works on Windows, macOS and Linux. Requires Node.js 16+

$ npm install envcrypted npx envcrypted init
📦 View on NPM ⭐ Star on GitHub 🐛 Report a Bug