envden v0.1.0 is in alpha

Your .env files, on every machine.

envden keeps your env files in sync across your computers. Encrypted on your machine, stored on a server you run. Free and open source.

Get startedStar on GitHub
$curl -fsSL https://envden.theclau.de/install.sh | sh
$brew install notsuhas/tap/envden

MIT · self-hosted · end-to-end encrypted

Sound familiar?

Every laptop has a slightly different .env.

You fix a key on one machine and forget the other. A new worktree starts with no env at all. You end up sending yourself secrets over chat. Secrets managers help, but they store keys, not files, so your comments and layout don't make it.

3 machines / 1 file

Encrypted before it leaves your machine.

Push from one computer, pull on another. Your server stores the file but can't read it.

plaintext → ciphertext → plaintext

Everything a .env needs to follow you around.

~/.envden/store
~/.envden/store
~/code/shop/.env
~/code/shop-fix/.env

github.com/you/shop/.env

One file, every worktree.

Each repo's env lives in one place, and every checkout links to it.

envden pull

laptop

  • API_KEY
  • DB_URL
  • ~ PORT

desktop

  • API_KEY
  • DB_URL
  • PORT
  • + REDIS_URL

base

  • API_KEY
  • DB_URL
  • PORT

merged

  • API_KEY
  • DB_URL
  • ~ PORT
  • + REDIS_URL

Merges by key.

Edit on two machines and envden merges the keys that changed. Real conflicts wait for you.

zsh

$ cd ~/code/shop

envden: github.com/you/shop out of sync

A nudge in your shell.

cd into a repo that's behind and your prompt tells you.

laptop

pairing codeK7QF2MXP

new laptop

pairing code

Add a laptop with a code.

Type an 8-character pairing code on the new machine and it's in.

envden device rm old-laptop
  • laptopmember
  • desktopmember
  • old-laptopremoved

keysepoch 1epoch 2

Lost a laptop? Remove it.

envden rotates the keys, so that device can't fetch anything new.

agent

envden agent install. envden status --json. envden doctor --json

Built for coding agents.

Agents can check status and run setup. You still type the password.

recovery-kit.txt

Keep a recovery kit.

Store your recovery kit like a passport.

Your server. Your keys. Your network.

Run the server in Docker on a home box, or on the laptop you already have. Devices reach it over Tailscale. There's no account to sign up for and nothing to pay.

  • 0accounts

    self-hosted

  • 1binary

    your hardware

  • $0to pay

    free and MIT

The server can't read your files.

Read the threat model →
server.sqlite

id: 0dTtVqNJjgYOE4cTkd

6JVYFGIqn9EMBH5dlwm9rdiINxaBP60tSJPB9JMaGq18JPyp5mozhTAypiGz5IQU

id: zpvsrHruWdks49MakK

5VxXbjmPa6Qq1LqkldIk0sR3YUCe/sDSUXIjOc3w0mk0FcwUQSYIGoJf5srgxHgv

id: y1LsBkJTJZxKtB9hk3

4hOWx/E0M2dJqQbrlKqM97Ani4r7ueS3VmCGeviGhiTrBpu+o/Ids8SMK3QNpFwK

recovery-kit.txt
threat-model.txt
  • [x]Files are encrypted on your device. The server only sees ciphertext and random IDs.
  • [x]Your master password never leaves your machine (OPAQUE).
  • [x]Each device has its own keys. Remove one and the keys rotate.
  • [x]Every checkout needs your approval before it gets secrets.
  • [x]Updates are signed, and envden checks the signature before installing.
  • [x]Built on audited crypto libraries. Nothing hand-rolled.

Up and running in a few minutes.

macOS / Linux / Windows
get-envden

Install

$curl -fsSL https://envden.theclau.de/install.sh | sh
$brew install notsuhas/tap/envden

One binary for macOS, Linux and Windows. The server is the same binary, or a Docker image.

Setup

envden setup. Host the server on this machine? An always-on host is recommended.. yes. Server setup token. ••••••••••••••••. Device name. laptop. Master password. ••••••••••••. Confirm master password. ••••••••••••. Store this recovery kit like a passport.. Approve checkouts to track. ~/code/shop ~/code/api

Add a device

laptop

envden device add. Master password. ••••••••••••. 3-K7QF-2MXP. . . Add desktop?. yes

desktop

. . . envden join <server>. Pairing code. •••••••••••. Waiting for the approving device.

Day to day

envden status. envden: server reachable. envden: github.com/you/shop out of sync. envden pull. Merge changes to PORT, REDIS_URL?. yes. envden push

Home lab firstRun the server in Docker on a machine that's always on.Laptop firstRun the server on your laptop, and move it later.Add a deviceJoin with a pairing code, or with your recovery kit.Set up with an agentOne prompt to paste into your coding agent.

Stop copying .env files around.

Get startedStar on GitHub
envden setup

envden setup. Device name. laptop. Master password. ••••••••••••. ✓ vault created. Store this recovery kit like a passport.

ready