AES-256-GCM vault, byte-identical to the CLI. The vault updates live as you type, and your plaintext and key never leave this tab.
Paste the file, then use a 64-char hex key, a raw 32+ byte string, or a passphrase.
The # envy:v1 vault builds in real time with AES-256-GCM and a fresh random nonce.
Save .env.vault, commit it to Git, and share the key out-of-band.
Live encryption, 100% in your browser
Algorithm
AES-256
Mode
GCM
Key strength
256-bit
Keys stored
0
Add a .env and a secret key above and the vault appears here.
4 keys encrypted · 256-bit hex key
Runs locally in your browser
Plaintext .env files in Git leak secrets forever.
Encrypting the file gives you versioned config without exposing keys. Only someone holding the key can read it, and the key never touches the repo.
# envy:v1 followed by base64(nonce + ciphertext).Decrypt with the CLI via envy decrypt, or generate key material with the secret generator.
Common questions about encrypting .env files
No. Encryption happens entirely in your browser with the Web Crypto API. Your key never leaves this tab and is never transmitted to any server.