Manage your .env files without a cloud account
Envy is the local-first dotenv manager for developers. Encrypted vaults, instant profile switching and missing-key diffs, all offline and all yours.
$ envy list
✓ api-gateway/.env (main)
✓ web-app/.env (feature/payments)
$ envy diff
✓ .env.example and .env are in sync
$ envy validate
✓ All clear · 6 keys parsed
$ envy encrypt
✓ encrypted .env → .env.vault (AES-256-GCM)
$
How it works
Install once
One static binary via Homebrew or curl. No account, no daemon, no telemetry.
$brew install systemendgame/tap/envy ✓ one 8 MB binaryScan your workspace
Envy finds every .env and groups them by git root, so multi-repo setups stay organised.
$envy list ✓ 4 .env files foundDiff, switch, encrypt
Compare against .env.example, switch profiles, or lock files into AES-256-GCM vaults.
$envy diff ✓ .env in syncBuilt for local-first developers
Encrypt files into vaults
AES-256-GCM. The key stays in ~/.config/envy and never reaches a server.
envy encrypt .envSwitch profiles in one command
dev, staging, prod. A symlink swap with a hard production guardrail.
envy switch prodDetect missing keys
Compare every .env against its .env.example and flag what is absent.
envy diffSee every project at once
Groups your .env files by git root, so multi-repo setups stay organised.
envy listBrowse from the terminal
A keyboard-first TUI. No Electron, no telemetry, one static binary.
envyShare without leaks
Encrypted shares that expire or burn after reading. Even we cannot read them.
envy share .envAll the tools, right in your browser
No install needed. Every tool runs 100% locally with the Web Crypto API.
Validate .env
Live syntax, duplicate and quote checks in your browser.
Open toolDiff .env files
Spot missing, extra and matched keys between two files.
Open toolEncrypt .env
AES-256-GCM vault, byte-identical to the CLI.
Open toolGenerate secrets
Strong random keys in hex, base64 or URL-safe.
Open toolEvery command
One binary, 11 commands. Copy any of them, paste, read the answer.
$envy Interactive TUI across all projects $envy list --json List all .env files grouped by project $envy diff Show missing keys vs .env.example $envy switch staging Switch profile (.env.staging → .env) $envy init Generate .env.example with values scrubbed $envy encrypt Encrypt .env → .env.vault (AES-256-GCM, local) $envy decrypt Decrypt .env.vault → .env $envy keygen Generate the local encryption key $envy validate Sanity checks (URLs, ports, prod warnings) $envy share .env Share an encrypted .env via a burn link $envy --version Print the installed version Real responses
Paste any command and read the answer, exactly as the terminal prints it.
⚠ Missing (2): AWS_REGION REDIS_URL ℹ Extra (1): DEBUG
🔑 generating local key... ✅ generated key at ~/.config/envy/key (0600, never leaves this machine) ✅ encrypted ./myapp/.env → ./myapp/.env.vault (AES-256-GCM, key: ~/.config/envy/key)
⚠ DATABASE_URL: looks like a URL but missing scheme (e.g. postgres://): "localhost:5432/db" ⚠ PORT: invalid port "abc" ⚠ 2 warning(s) in ./myapp
Envy vs other dotenv tools
Built for developers who want local control and no sign-up.
| Feature | Envy | dotenvx | Doppler | direnv |
|---|---|---|---|---|
| Local-first | Yes | Yes | No | Yes |
| TUI interface | Yes | No | No | No |
| Zero account | Yes | Yes | No | Yes |
| Missing-key detection | Yes | No | No | No |
| Profile switching | Yes | No | Yes | No |
| Free forever | Yes | Yes | No | Yes |
Install in 10 seconds
Frequently Asked Questions
Real questions about managing .env files locally
Run envy list and it groups every .env by its git root. You get one overview of all your projects and can jump into any file with the TUI.
Start managing .env files the right way
One command, one binary. Your config stays local, your secrets stay encrypted.