Encrypt locally
Use age public keys. Only matching private keys can open a file.
LOCAL KEYS / SHARED CIPHERTEXT
Keep the keys.
Share the ciphertext.
Encrypt your environment files to your team and CI recipients. Run a command with decrypted variables in memory. Keep secret values out of an inventory.
Compare names for free → Install the CLIFree source code · MIT · No account
Run with your values
Pass decrypted values to a child process without a plaintext temporary file.
Keep a useful inventory
Export names, assigned contacts and rotation dates for control SEC-2.
YOUR TERMINAL
envvault init --recipient age1… envvault encrypt .env -o app.age envvault run -i team.key app.age -- python app.py
A small tool, with a clear boundary
Env Vault handles local environment files. For managed distribution or password workflows, compare these options.
Some links on this page are partner links. If you buy through one, a commission may be paid at no extra cost to you. Recommendations are chosen on fit, not commission; prices were read from the vendor's page on the date shown.