Documentation

Everything you need to store, share, and sync your .env files with zero-knowledge encryption.

Introduction

envdotweb is an encrypted manager for environment variables. Every secret value is encrypted in your browser with AES-256-GCM before it's ever sent to our servers — we only store ciphertext and could never read your secrets, even if compelled to. Teams share access the way Figma shares a file: each project has a key that is envelope-encrypted to every member's public key.

Quickstart

1. Sign in with GitHub or an email magic link at /login.
2. Create a passphrase. This encrypts your private key locally. Download the one-time recovery code shown right after — it's the only way back in if you forget your passphrase.
3. Create a workspace and project. We add dev, staging and production environments automatically.
4. Add or import secrets. Paste an existing .env or add keys one at a time — they're encrypted before upload.
5. Invite your team. Hit Share on a project and add teammates by email or invite link.

How encryption works

envdotweb uses a layered, zero-knowledge scheme. Nothing in this chain is ever sent to the server in plaintext:

• Passphrase → wrapping key. Your passphrase is run through PBKDF2-SHA256 (600,000 iterations) to derive an AES-256 key that never leaves your device.
• Wrapping key → private key. That key decrypts your RSA-OAEP-3072 private key, which is stored only in wrapped (encrypted) form.
• Private key → project keys. Each project has a symmetric AES-256 key, envelope-encrypted to your public key. Your private key unwraps it in memory.
• Project key → secret values. The project key encrypts and decrypts individual secret values with AES-256-GCM.

The server stores: your public key, your wrapped private key, per-member wrapped project keys, and secret ciphertext. It never sees a passphrase, an unwrapped key, or a plaintext value.

Managing secrets

Open a project to see a table per environment. Values are masked by default:

• Reveal / copy — click the eye to decrypt a value in place, or the copy icon to put it on your clipboard.
• Inline edit — click the pencil, change the value, press Enter. A new encrypted version is written.
• History — every change is an append-only version. Open the clock icon to see and decrypt past values.
• Export — download a decrypted .env for any environment, assembled in your browser.

Environments & diffing

Each project starts with dev, staging, and production. Admins can add custom environments (subject to plan limits). The Compare tab diffs two environments and highlights missing or mismatched keys so config drift never reaches production — values stay masked unless you reveal them.

Team sharing

Click Share on any project to manage access:

• Invite by email. If they already have an account, they're granted the project key immediately (encrypted to their public key). If not, they get an email invite.
• Invite links (Pro+) let anyone with the URL join a workspace with a preset role.
• Roles. Viewer reads secrets, Editor changes them, Admin manages members, Owner manages billing.

When a new member finishes setting up their keys, the next time an admin opens the project their access is granted automatically — the project key is re-wrapped to the newcomer's public key in the admin's browser.

Importing a .env

During onboarding, or via Import on any environment, paste a .env file or upload one. It's parsed and each value encrypted client-side. Existing keys are updated; new keys are added. Comments and export prefixes are handled automatically.

Importing from GitHub

Sign in with GitHub (granting the repo scope) and open the Import from GitHub tab on your dashboard. Your repositories appear as cards — click Import as project to spin up an encrypted project named after the repo, ready for its secrets.

CLI (envdot)

The envdot CLI pulls and pushes secrets from your terminal and CI. Decryption happens locally with a token-scoped key — plaintext never touches disk unless you ask for it.

# install
npm i -g envdot

# authenticate a machine
envdot login

# write .env for an environment
envdot pull --env production

# push local changes back up
envdot push

# run a command with secrets injected (no file written)
envdot run -- npm start

# see what differs between local and remote
envdot diff

The CLI and scoped tokens are rolling out — see the roadmap.

VS Code extension

A VS Code extension is on the way. From the editor you'll be able to upload the open .env directly to an environment, pull secrets into your workspace, and reveal or edit values inline — all with the same client-side encryption. Follow progress on the roadmap.

Passphrase & recovery

Your passphrase never leaves your device and we can't reset it. If you lose it, use the recovery code you downloaded at signup: go to /app/recover, enter the code, and set a new passphrase — your keys are re-wrapped locally. If you lose both, your data is unrecoverable by design.

Migrating from Doppler / Infisical

1. Export each config/environment to a .env file.
2. Create a matching project and environment in envdotweb.
3. Use Import to paste or upload the file — values are encrypted on import.
4. Invite your team and revoke the old tool's access.

FAQ

Can envdotweb read my secrets?

No. Encryption and decryption happen in your browser or CLI. We only ever hold ciphertext.

What happens if I lose my passphrase and recovery code?

Your secrets can't be recovered — that's the tradeoff for true zero-knowledge. Keep the recovery code somewhere safe.

Is there a free plan?

Yes — 1 project, 2 members, 3 environments and 7-day history, free forever. See pricing.

Still stuck? Try the one-time secret tool or create an account to get started.