Your .env files belong in your Git — encrypted
EnvVault encrypts environment variables with Age and stores them in your private Git repo. No secret database, no vendor lock-in — pull locally with envvault using 2FA and a master passphrase.
- Secrets never stored on EnvVault servers
- Age-encrypted in your private Git repo
- CLI pull with local 2FA + passphrase
- GitHub, GitLab & Bitbucket
Features
Everything you need to vault envs in Git
Upload from the browser, store ciphertext in your repo, pull locally with the CLI — without handing secrets to a SaaS vault.
Your Git repo is the vault
Env files live in your private GitHub, GitLab, or Bitbucket repository — not on a third-party secret store. You own the data, the history, and the backups.
Encrypted before Git ever sees them
Every env file is encrypted with Age (X25519 + ChaCha20-Poly1305) and stored as {project}/{environment}.env.age. Plaintext never sits in your repo.
Zero secret storage on our servers
The web app uses OAuth to talk to Git. Your .env values pass through briefly during upload, then only encrypted blobs are committed. We do not run a secrets database.
Local CLI authentication
Developers pull with envvault using TOTP + a master passphrase — verified on their machine. No EnvVault login, no central auth server on pull.
Self-hostable & open stack
Run EnvVault on your own infrastructure. TanStack Start, OAuth, and the @env-vault/cli npm package — no proprietary lock-in.
Manage from the browser
Upload, overwrite, and delete with OAuth. Fetch decrypted envs and share links require TOTP from your authenticator app.
Workflow
How it works
Three steps from OAuth sign-in to Age-encrypted env files in your own repository.
- Step 1
Authenticate with OAuth
Connect GitHub, GitLab, or Bitbucket. We request repo scope only — no passwords stored.
- Step 2
Choose your private repo
Pick a repo and project. Files land as Age-encrypted {projectName}/{environment}.env.age blobs.
- Step 3
Upload or pull envs
Upload from the web UI or pull with envvault — decrypt locally with 2FA + passphrase.
Why EnvVault
Built for teams who already trust Git
Stop choosing between insecure .env commits, expensive secret SaaS, and CLIs that phone home on every pull.
Unlike cloud secret managers, your ciphertext lives in Git you control — not a vendor database.
Unlike plain .env commits, every file is Age-encrypted before it reaches the remote.
Unlike server-login CLIs, envvault authenticates locally with 2FA + passphrase — no standing vendor session.
Compare
How EnvVault stacks up
A quick look at Git-native Age encryption vs common alternatives. No vendor names — just the capabilities that matter.
| Capability | EnvVault | Cloud secret SaaS | Plain .env in Git | Server-login CLI |
|---|---|---|---|---|
| Secrets stored in your own private Git repo | Yes | No | Yes | No |
| Encrypted at rest in Git (Age / .env.age) | Yes | Varies | No | Varies |
| EnvVault / vendor never stores your secret values | Yes | No | Yes | No |
| CLI works without vendor login on every pull | Yes | No | Yes | No |
| Local 2FA + passphrase for developer pulls | Yes | No | No | Varies |
| GitHub, GitLab & Bitbucket support | Yes | Varies | Yes | Varies |
| Self-host the management app | Yes | No | Yes | Varies |
| No monthly per-seat secret manager bill | Yes | No | Yes | Varies |
Secrets stored in your own private Git repo
Encrypted at rest in Git (Age / .env.age)
EnvVault / vendor never stores your secret values
CLI works without vendor login on every pull
Local 2FA + passphrase for developer pulls
GitHub, GitLab & Bitbucket support
Self-host the management app
No monthly per-seat secret manager bill
SupportedVaries by productNot typical
Developer CLI
Pull envs without a vendor login
The envvault CLI fetches encrypted blobs from Git and decrypts locally with TOTP + passphrase. The web Manage page also requires TOTP to fetch or share decrypted envs.
- 1
Install the CLI
npm install -g @env-vault/cli — public on npm, no vendor account required.
- 2
Provision once
Download vault_key.enc + totp.secret from the web app. Save to ~/.env-vault/.
- 3
Pull with 2FA
envvault pull myapp/production .env — TOTP and passphrase unlock locally, then decrypt in memory.
npm install -g @env-vault/clienvvault config set --provider github --repo owner/my-env-vaultenvvault config set --git-token ghp_...envvault pull myapp/production .envSecurity
Defense in depth, end to end
Modern cryptography at every layer — from the Age blobs in Git to the passphrase-protected keys on developer machines.
Age in Git
X25519 + ChaCha20-Poly1305 for every .env.age blob in your repository.
Passphrase-wrapped keys
Developers hold vault_key.enc (AES-256-CBC + PBKDF2) — never commit raw Age identities.
TOTP for CLI pulls
RFC 6238 two-factor verification runs locally; no EnvVault API call on pull.
In-memory decrypt
Age identity unlocked in RAM for one operation, then discarded. No plaintext keys on disk.
Get started
Connect your Git provider
Sign in once with OAuth, upload encrypted envs, and provision your team with the envvault CLI.
- Files organized as {projectName}/{environment}.env.age (Age encrypted)
- Overwrite or rotate envs anytime from the web app
- Delete env files when a project is retired — ciphertext removed from Git
Ready to vault your first .env?
Connect your Git provider, create a private repo, and upload — your secrets stay encrypted in Git you control.