Pawan Saini
← Lab

EnvVault

Share .env files with your team, without the server ever reading them.

Type
Developer tool
Built with
React, Vite, Node.js

01What it is

EnvVault keeps your .env files in sync across machines and teammates. Every value is locked on your own device before it is sent, so the server only holds scrambled text it cannot read. Use it from a web dashboard or from the command line.

Environment files usually travel through chat messages, shared docs and screenshots. That is convenient right up until someone pastes a production key into the wrong place. EnvVault gives them a proper home: versioned, encrypted and one command away.

02Major features

  • Locked on your device

    Values are encrypted with AES-256 in the browser or the CLI before upload. The server never gets the key.

  • Command-line tool

    Pull, push and compare with one command. It runs with npx, so nothing needs installing, and it is published on npm.

  • Approve new devices

    A new laptop asks for access and you approve it in the dashboard. The project key is passed over using RSA, so there are no shared passwords.

  • Version history

    Every change saves an encrypted snapshot. Look back at older versions and restore one when needed.

  • See changes before you push

    The CLI lists which keys were added, changed or removed, without printing any values. Pushing to production also needs you to type the word production.

  • Teams and activity

    Projects have development, staging and production environments. Invite teammates, compare or clone environments, and check an activity log of who did what.

03How it works

  1. Edit

    Change variables in the web dashboard, or push a local .env file from the CLI.

  2. Encrypt

    WebCrypto encrypts the values on your device, before any network call.

  3. Store

    The API saves ciphertext only. It has nothing readable to leak.

  4. Snapshot

    Every change creates an encrypted version you can inspect later.

  5. Restore

    Pull or restore a version, and it is decrypted on your device again.

04What the server knows

Can see

  • Encrypted values
  • Encrypted version snapshots
  • Public device keys

Never sees

  • Plain-text variables
  • Private keys
  • Anything it could decrypt

05Tech stack

Frontend
ReactVite
Backend
Node.jsExpressMongoDB
CLI
Node.jsCommandernpm package
Security
WebCryptoAES-GCMRSA-OAEPGitHub and Google sign-in
Delivery
DockerRender

06How it's tested

  • Shared encryption code
  • RSA device-key handoff
  • API security and error responses
  • The bundled CLI
  • The production web build