Secrets storage where the server can't read your secrets.
Env Vault stores and shares .env files and secret configuration with end-to-end encryption. The infrastructure holds ciphertext — only your devices understand it.
Your password never leaves this device and derives your keys. Lose it and your data is unrecoverable — there is no server-side reset.
Encrypted before upload
Names and values are encrypted in your browser. The server stores ciphertext it cannot read.
Versioned like Git
Immutable revisions with structural diffs, comparison, and restore — never exposing values.
Share with cryptography
Vault keys are wrapped per member. Removing someone rotates the key for future secrecy.
CLI & CI ready
Pull secrets or inject them into a process with envvault — service accounts for pipelines.