Encrypt your .env file online

Why you should encrypt .env files before committing

Committing a plaintext .env file to Git exposes API keys, database passwords and third-party tokens. Even a private repository can leak, and once a secret lands in Git history it is very hard to remove.

Encrypting the file turns it into a vault that only someone with your decryption key can open. You keep the key on your machine and commit the ciphertext safely, so the repository stays shareable without leaking anything.

• API keys and OAuth secrets never appear in Git history
• Team members without the key cannot read the values
• The .env.vault file is safe to store on remote hosts
• Deploys stay reproducible when the key is provided at runtime

How .env encryption works

Envy encrypts with AES-256-GCM entirely in your browser using the Web Crypto API. The encrypted file starts with the # envy:v1 header, and only someone holding your key can decrypt it back to the original .env.

Your plaintext and your key never leave this tab. The CLI uses the exact same format, so a file encrypted here decrypts with envy decrypt, and a vault created by the CLI opens right here. Pair the key with the secret generator for fresh 256-bit material.