[ envs-cli // encrypted vault ]

Stop losing your .env files.

Encrypted vault. Git sync. One command.

$npm install -g envs-cli
vault://terminal

// Sound familiar?

Every developer has been here.

[BREACH_DETECTED]

Clone a repo. Spend 30 minutes hunting for API keys.

[INSECURE_CHANNEL]

Share .env files over Slack DMs. Hope nobody screenshots it.

[CONFIG_CHAOS]

.env.local? .env.production? .env.development.local? Which one?

How it works

Three commands. That's it.

1envs init

Scans your .env files, encrypts them with AES-256-GCM, stores in a local vault.

2envs push

Pushes encrypted vault to a private Git repo. Your secrets never leave the encryption envelope.

3envs pull

On any machine, one command restores all your env files. Merge or overwrite — you choose.

Everything you need

AES-256-GCM Encryption

Military-grade encryption. Your password never touches disk. Zero-knowledge architecture.

Git Sync

Syncs via private Git repo. Works with GitHub, GitLab, Bitbucket. No server needed.

Smart Diff

envs diff shows what’s missing, what’s different, what’s out of sync. Debug in seconds.

Multi-Environment

Handles .env, .env.production, .env.staging automatically. Maps files to environments.

Team Ready

Share access via Git repo collaborators. Each person uses their own master password.

Works Everywhere

Windows, macOS, Linux. Any project. Any framework. Just needs Node.js.

Quick Start

Up and running in 60 seconds.

bash
# Install
npm install -g envs-cli
# Initialize in your project
cd my-project
envs init
# Push to vault
envs push
# Enable remote sync (optional)
envs sync
# On another machine
envs pull

Commands

envs initInitialize vault for current project
envs pushEncrypt and push env files to vault
envs pullPull and decrypt env files from vault
envs diffCompare local vs vault (--reveal for plaintext)
envs listList all vaulted projects
envs env listShow environment mappings
envs env add <name>Add new environment
envs syncEnable or run remote sync
envs sync statusCheck sync state
envs sync disableTurn off auto-sync

How it flows

Your secrets stay encrypted end-to-end.

Your Machine

.env
.env.production
↓ push · ↑ pull

Private Git Repo

encrypted
blobs only
↑ pull · ↓ push

Another Machine

.env
.env.production

Security first

Built for paranoid developers.

vault_security_manifest
Zero-knowledge: server/Git never sees plaintext
AES-256-GCM with PBKDF2 (SHA-512, 100k iterations)
Unique IV per encryption
Auth cache expires after 24 hours
.env files auto-added to .gitignore
Open source — audit the code yourself