envsync /oss
Start free

Ship secrets
like code.

End-to-end encrypted .env sync for teams. One command pulls, merges, and injects secrets in memory.

Start free See the CLI
~/trestle/payments-service zsh
$ envsync login
device authorized sergi@trestle.dev
$ envsync pull production
pulled v27 / 14 keys / signature verified
$ envsync run -- bun dev
injecting 14 variables into child process
ready on http://localhost:3000
$
AES-256-GCM X25519 Ed25519
runs on Cloudflare Workers D1 R2 Astro, Hono, Better Auth, OpenTUI

The .env file never got a version history.

One teammate has v26. Staging is missing a key. Production lives in a DM. You find out when the deploy fails.

Today

  • - Files copied through chat
  • - Stale keys on laptops
  • - No record of who pulled what
  • - One leak, no rotation plan

With EnvSync

  • + One signed revision per env
  • + Keys wrapped per device
  • + Every pull in the audit log
  • + Rotate a DEK in one command

A vault that works like version control.

Every push is encrypted, signed, and addressable. Every pull is verified before it reaches your process.

Merge without overwriting

A three-way AST merge keeps local edits and upstream additions. No line-based conflicts, no overwritten keys. 

# pulled v27, merged locally
API_URL=http://localhost:3000        # local
DATABASE_URL=postgres://••••••••     # upstream
STRIPE_KEY=sk_live_••••••••          # unchanged
SENTRY_DSN=https://••••@sentry.io    # added

Ciphertext at rest

D1 stores pointers. R2 stores sealed revisions. The API never holds a key that can open them.

v27.enc sealed
9f2c8a71c0e4...d44e a83f0c56b120...7b19 c41d9e77fa02...02ac

Access is a wrapped key

Each member gets the environment key wrapped to their device. Revoke access and rotate the key.

  • owner9f2c...a71eactive
  • writer44b0...e219active
  • readerb7da...0c84active

CI without a human

Scoped tokens unwrap one environment and one permission level. No long-lived secrets in your runner. 

# .github/workflows/deploy.yml
ENVSYNC_TOKEN=es_tok_8d2f••••
envsync run -- pnpm build

Every pull is an event

Every pull, push, grant, and token is recorded. Filter by project, actor, or environment.

  • 22:41maya pulled production v27
  • 22:18jonas pushed staging v09
  • 21:52token unwrapped ci/deploy

Three commands, start to finish.

No dashboard required. The CLI is the primary interface, built for terminals.

envsync init

Link this repository to a project and choose its environments.

once
envsync pull

Fetch the latest revision and merge it against your local file.

every pull
envsync run -- <command>

Inject decrypted variables into a child process. Nothing is written to disk.

every run

Works with bun, pnpm, npm, cargo, go, and anything else that reads the environment.

We cannot read your secrets. That is the architecture, not a promise.

Keys are generated on your device and wrapped for each member. The API stores ciphertext, wrapped keys, and signatures. Nothing else.

X25519 + HKDF
Per-environment DEKs are wrapped for each member's device public key using ephemeral ECDH.
AES-256-GCM
Revision ciphertext is bound to its org, project, environment, revision, and key version.
Ed25519
Every push is signed by the author. The CLI verifies the signature before decrypting.
PBKDF2-SHA256
Private key bundles are sealed with 210,000 iterations and AES-256-GCM.

Questions, answered.

Can I self-host the API?

Yes. The API is a Hono worker on Cloudflare Workers, with D1 for metadata and R2 for ciphertext. Point the CLI at your own URL.

What happens if two people edit at once?

The push is rejected with a stale revision. The CLI runs a three-way AST merge, then retries with your changes and theirs.

Does the server ever see plaintext?

No. Encryption and decryption happen in the CLI or browser. The server only sees ciphertext and wrapped keys.

How do CI tokens work?

A token is scoped to one environment and one permission level. It unwraps the DEK, decrypts in the runner, and never writes a .env file.

What if I lose my passphrase?

The vault cannot recover it. You can reset your account, but existing environment keys must be re-wrapped by another admin.

Bring your .env under version control.

Open source. Self-host it, or use the hosted vault.

Start free