Built so we can never read your secrets
envdotweb is zero-knowledge by design. Everything sensitive is encrypted on your device with modern, audited primitives — the server only ever holds ciphertext. Here's exactly how that works and who we rely on to run it.
The encryption chain
Each layer unlocks the next — and none of it is ever sent to us in the clear.
Your passphrase
Never leaves your device. Run through PBKDF2-SHA256 (600,000 iterations).
Wrapping key (AES-256)
Derived from your passphrase; decrypts your private key locally.
Your private key (RSA-OAEP-3072)
Stored only in wrapped form. Unwraps the keys for projects you can access.
Project key (AES-256)
One per project, envelope-encrypted to each member's public key.
Secret values (AES-256-GCM)
Each value encrypted with the project key — in your browser, before upload.
What the server stores
- Secret ciphertext + IVs
- Your public key
- Your passphrase-wrapped private key
- Per-member wrapped project keys
- Workspace metadata & audit logs
What it never sees
- Your passphrase
- Your recovery code
- Any unwrapped private key
- Any unwrapped project key
- A single plaintext secret value
Defense in depth
Zero-knowledge encryption is the foundation. These controls protect everything around it.
Zero-knowledge encryption
Secret values are encrypted with AES-256-GCM in your browser (and CLI) before they're sent to us. We store ciphertext only and can't decrypt it.
Envelope key sharing
Team access works like Figma: a project's key is re-encrypted to each member's RSA public key. No shared passwords, no plaintext key on the server.
Role-based access control
Owner, Admin, Editor and Viewer roles are enforced on every server action — writes require Editor, member and billing management require Admin/Owner.
Audit logging
Every meaningful action — secrets changed, members invited, roles updated — is recorded with actor, timestamp and IP for Team-plan workspaces.
Hardened application layer
Strict security headers and a production Content-Security-Policy, same-origin CSRF protection on server actions, and no raw SQL — all queries are parameterized through Prisma.
Secret data handling
Values are masked by default with click-to-reveal. One-time shared secrets are deleted from the database the moment they're viewed or when they expire.
Cryptographic primitives
Standard, browser-native WebCrypto — no home-rolled algorithms.
Authenticated encryption for every secret value and the wrapped private key.
Public-key envelope encryption of project keys to each team member.
600,000 iterations to derive your wrapping key from your passphrase.
Infrastructure & subprocessors
The services we use to run envdotweb. None of them ever receive a plaintext secret.
Encrypted secret ciphertext, wrapped keys, and workspace metadata (names, roles, audit logs). Never plaintext secrets.
Serves the app and terminates TLS. Processes request traffic; never sees decrypted secrets.
Recipient email addresses and message contents (magic links, invites, production-change alerts). Never secret values.
Handles checkout, card data and tax directly as merchant of record. We store only a customer / subscription identifier — never card numbers.
Verifies your identity and, with your consent, lists repositories you choose to import. Token scoped to what you approve.
Subprocessors may change as the product evolves; material changes are noted in the changelog. See our Privacy Policy for how data is handled.
What zero-knowledge means for you
Because we can't read your data, we also can't recover it. If you lose both your passphrase and the recovery code you download at signup, your secrets are unrecoverable — by design. Store your recovery code somewhere safe and offline.
Responsible disclosure
Found a vulnerability? We'd genuinely like to hear from you. Email security@envdotweb.xyz with details and steps to reproduce. Please give us a reasonable window to fix issues before public disclosure.