dotenvx/dotenvx
Dotenvx
dotenvx is a cross-platform command-line tool that encrypts .env files using public-key cryptography and decrypts them at runtime, injecting the plaintext secrets into a process environment before execution. It treats encrypted environment files as self-contained vaults that are loaded and decrypted entirely in memory each time a command runs.
What sets dotenvx apart is its ability to armor the private decryption key itself with a passphrase, allowing that key to be stored remotely and retrieved only when decryption is needed. A single encrypted vault file can be bound to multiple per-environment decryption keys, so one artifact can unlock different secrets in development, staging, and production. The tool also supports public-key generation and encryption in a single command, and it can encrypt environment files for CI pipelines, commit them safely to version control, and deploy encrypted variables to cloud platforms with a single automated command.
Beyond its core encryption and injection workflow, dotenvx offers on-demand variable decryption, runtime secret injection for serverless functions and task runners, and integrations with frameworks such as Astro. It provides automatic key generation, keyless decryption that discards keys after use, and private key armoring for secure off-device storage. The tool also keeps encrypted environment variables hidden from AI agents while still allowing them to inspect and run projects.
Features
- File Encryption - Encrypts entire .env files with public-key cryptography for safe version control and storage.
- Encryption CLI Utilities - Ships a dedicated CLI for encrypting .env files with public-key cryptography and decrypting them at runtime.
- Runtime Environment Variable Injections - Decrypts an encrypted vault file then injects the plaintext variables into a child process's environment before the command begins.
- Per-Environment Vault Bindings - Dotenv Vault manages different sets of environment variables for each deployment environment, loading the appropriate encrypted file and using per-environment decryption keys.
- Process Injection Wrappers - Acts as a process wrapper that decrypts and injects environment variables before executing the target command.
- Environment File Encryptors - Dotenv Vault encrypts environment variable files and injects them into build or runtime processes using a private decryption key in a single command.
- Environment File Vaults - Treats the encrypted .env file as a single-file vault that is loaded and decrypted entirely in memory before the application runs.
- Cross-Platform Encryption Utilities - Provides a cross-platform CLI tool that encrypts and decrypts environment files consistently across local, CI, cloud, and serverless platforms.
- Runtime Secret Injection - Provides automated decryption of encrypted .env files and injection of secrets into the process environment at startup.
- GPG Key-Based File Encryption - Encrypts a plaintext .env file using an asymmetric keypair so secrets stay encrypted at rest and decrypt only at process start.
- Public-Key Vault Generators - Generates a public-private key pair and immediately encrypts the environment file, keeping the public key in clear text and the private key separate.
- Deployment Decryptions - Dotenv Vault injects decrypted environment variables from an encrypted file at application start during each deployment, for any hosting platform.
- Environment Variable Key Configurations - Configuring separate decryption keys for each deployment environment so the same encrypted file can be reused with different secrets.
- Per-Environment Key Bindings - Assigns per-environment decryption keys to the same encrypted vault file, allowing one artifact to unlock different secrets in dev, staging, and production.
- Password-Protected Key Armor Utilities - Encrypts the private key itself with a passphrase so it can be stored remotely and synced only when a decryption workflow is triggered.
- Version-Controlled Secret Encryption - Dotenv Vault commits encrypted .env files to version control while keeping decryption keys separate, preserving developer workflow without exposing secrets.
- File-Based Loading - Loads environment variables from plaintext .env files into the process environment, supporting both CLI and programmatic usage.
- Encrypted Variable Deployers - Dotenv Vault sets up encrypted environment variables for deployment on container and hosting platforms through a single command.
- Environment Variable Deployers - Dotenv Vault deploys encrypted environment variables to cloud platforms using a single command, automating setup for each target environment.
- Cross-Platform Execution - Dotenv Vault executes the same encryption and injection tool across different languages and environments without custom integrations.
- Secrets Deployment Pipelines - Deploying encrypted environment variables to cloud, serverless, and container platforms using a single decryption workflow.
- Serverless & Task Secret Injections - Dotenv Vault decrypts and injects environment variables from encrypted files into serverless functions and remote task runners during execution.
- Key Generation Utilities - Automatically generates encryption keys as part of the encrypted environment setup process.
- Ephemeral Key Retrieval Methods - Implements keyless decryption by retrieving private keys from memory only when needed and discarding them immediately.
- On-Demand Secret Decryption - Provides on-demand decryption of environment variables, only decrypting secrets when accessed rather than at process startup.
- Framework Integrations - Dotenv Vault integrates encrypted environment variables into the Astro framework, decrypting and injecting them during application startup.
- कॉन्फ़िगरेशन प्रबंधन - Manage and inject environment variables from .env files.
