StoreEnv Beta

StoreEnv keeps your .env files versioned, encrypted and shared, so nobody has to send one in chat again.

Get started, it's free Install the CLI

Open-source client. The CLI and the encryption library are Apache-2.0 on GitHub, so you can read exactly what happens to your secrets before they leave your machine.

View on GitHub
Why StoreEnv

StoreEnv gives every project an encrypted home for its environment files, in any folder, with or without Git. Push once, pull anywhere and share exactly the secrets you mean to. Values are locked on your device, so nobody else can read them, including us.

AES-GCM key for every single secret
Recovery phrase that only you hold
On a teammate's laptop: login and pull
Plaintext values on our servers

4 ways

Pick the method that suits your machine. Each one gives you the same storeenv command.

macOS and Linux

01
$ curl -fsSL https://storeenv.app/install.sh | sh

A single binary, no Node needed. Checks the download's checksum and runs again to update.

Windows

02
$ irm https://storeenv.app/install.ps1 | iex

Run in PowerShell. Installs storeenv.exe and adds it to your PATH.

Homebrew

03
$ brew install tusharrr0302/storeenv/storeenv

For macOS and Linux. Update with brew upgrade storeenv.

npm

04
$ npm i -g storeenv-cli

Needs Node.js 18 or newer. Works anywhere Node runs.

Then run storeenv login and storeenv push in any Git repository. Read the docs

04 Features
  • $ storeenv push -m "Add Stripe keys"
  Encrypting 19 secrets locally... done
$ storeenv pull
  Restored 3 files.
    • Finds every .env file in every service folder
    • Encrypts on your device before upload
    • Restores each file in the right folder
    • Works offline with local commits
    Read how it works 
  • $ storeenv log
  9f2c81a  @neha  "Add Stripe keys"     +2 ~1
  3b7e0d4  @you   "Rotate DB password"  ~1
$ storeenv rollback 3b7e0d4
    • Every push is a version with an author
    • See exactly which keys changed
    • Roll back an environment in one command
    • History is kept, even after a rollback
    Read how it works 
  • $ storeenv invite @bob --role viewer \
    --keys backend/.env.production:DB_HOST \
    --expires 7d
  Invited @bob. Access ends in 7 days.
    • Invite by email or username
    • Share a whole environment or a few keys
    • Access that expires on its own
    • Revoke and re-key in one step
    Read how it works 
  • $ storeenv run --env production -- node server.js
  Server listening on :3000
    • Secrets go straight into the process
    • Nothing is written to disk
    • Pick one service or all of them
    • Same command on macOS, Linux and Windows
    Read how it works
How it works

Your code names the project: a small .storeenv.json committed with it. Folders become services, file suffixes become environments, and remotes on any host are optional hints.

You already knowIn StoreEnv
RepositoryProject (namespace/name, its own id in a committed .storeenv.json)
RemoteOptional link: GitHub, GitLab, Gitea or any host, or none
FolderService (frontend/, backend/, root)
BranchEnvironment, picked by an optional branch rule
CommitSigned version (author, message, changed keys)
Submodule / dependencyImport from a library or another project
push / pull / clonestoreenv push / pull / init
~/cakeshop 
$ storeenv push -m "Added Razorpay keys"
  Project    acme/cakeshop   (branch main)
  Scanning   3 env files
 
  backend    backend/.env              default     +2 ~1
  backend    backend/.env.production   production  +2
  frontend   frontend/.env             default     no changes
 
  Encrypting 19 secrets locally...   done
  default     v 9f2c81a   "Added Razorpay keys"
  production  v 3b7e0d4   "Added Razorpay keys"
 
$ storeenv pull            # on a teammate's laptop
  + backend/.env               12 keys
  + backend/.env.production    14 keys
  + frontend/.env               5 keys
  Restored 3 files.

Security

Encrypted on your device

Values are sealed with AES-256-GCM before upload. Our servers store ciphertext, wrapped keys and public keys.

Your values never leave your device unencrypted.

A key only you hold

Your identity comes from a 24-word recovery phrase that is generated on your device and stays there.

Sharing down to one secret

Every secret has its own key, wrapped separately for each person allowed to read it.

Nothing is forgotten

Every push is a version with an author, a message and the keys that changed. Roll back any time.

 The full threat model, including what we can see Read the security model

FAQ

  • No. Each value is encrypted on your device with its own AES-256-GCM key before it is uploaded. Our servers only ever hold ciphertext, wrapped keys and public keys, so a breach of our database reveals no values.

  • Sign in on another machine and approve it from a device you still have, or enter your 24-word recovery phrase. Then remove the lost device in Settings, Devices: its sessions end and its signing key is revoked. Its copy of your key is encrypted at rest; if you think it was unlocked and copied, start over with a new identity and rotate the values it could read.

  • No. A folder finds its project through the .storeenv.json committed with your code, so it works in any Git repository on any host, private or public, and in folders without Git. Linking a repository is optional: it helps teammates find the project, and on supported hosts a link can be verified from repository metadata, never your code.

  • Run storeenv revoke @username or use the Access page. Their wrapped keys are deleted at once, and the secrets they could read get new keys and are marked rotation due, so you know what to change at the provider.

  • Yes. StoreEnv is free while it is in early access, with no limit on projects or teammates.

  • The CLI runs on macOS, Linux and Windows. There is also a VS Code extension and a web app for managing access, history and devices.