dotenv-vault-cli

Encrypted .env file management for teams. Encrypt, decrypt, diff, audit, and share environment files safely.

Install

npm install -g dotenv-vault-cli

Quick Start

# Generate an encryption key
dotenv-vault keygen

# Encrypt your .env file (safe to commit .env.vault to git)
dotenv-vault encrypt .env --key <your-key>

# Decrypt it back
dotenv-vault decrypt .env.vault --key <your-key>

Commands

keygen — Generate encryption key

dotenv-vault keygen

Generates a 256-bit hex key for AES-256-GCM encryption.

encrypt — Encrypt a .env file

dotenv-vault encrypt .env --key <key>
dotenv-vault encrypt .env.production --key <key> --out .env.vault.production

Creates an encrypted .env.vault file that is safe to commit to git.

decrypt — Decrypt a vault file

dotenv-vault decrypt .env.vault --key <key>
dotenv-vault decrypt .env.vault --key <key> --out .env

diff — Compare two encrypted vault files

dotenv-vault diff .env.vault.staging .env.vault.prod --key <key>

Shows added, removed, and changed variables between two encrypted environments.

rotate — Rotate encryption key

dotenv-vault rotate .env.vault --key <old-key>
dotenv-vault rotate .env.vault --key <old-key> --new-key <new-key>

Re-encrypts a vault file with a new key. Generates a new key if --new-key is not provided.

audit — Security audit

dotenv-vault audit .env

Checks for:

• Weak values (password, admin, 123456, etc.)
• Empty sensitive keys
• Duplicate keys
• Short passwords
• Production keys pointing to localhost

export — Convert .env format

dotenv-vault export .env --format json
dotenv-vault export .env --format yaml
dotenv-vault export .env --format shell
dotenv-vault export .env --format json --out config.json

validate — Validate against schema

dotenv-vault validate .env --schema .env.schema

Schema format (.env.schema):

DATABASE_URL=required,type:url
API_KEY=required,minLength:10
PORT=required,type:number
DEBUG=type:boolean
NODE_ENV=required,enum:development|staging|production

Supported types: string, number, boolean, url, email

Key Management

The encryption key is resolved in this order:

1. --key flag
2. DOTENV_VAULT_KEY environment variable
3. .env.key file in current directory

Never commit your .env.key file. Add it to .gitignore.

Security

• Algorithm: AES-256-GCM (authenticated encryption)
• Key derivation: PBKDF2 with SHA-512, 100,000 iterations
• Random salt and IV per encryption operation
• Authentication tag prevents tampering

License

MIT