envstore

Encrypted .env management with AES-256-GCM, org-first RBAC, and zero config.

Upload, encrypt, version, and sync .env files across machines and teammates. Your passphrase never leaves your machine — the server only ever stores ciphertext.

Install

npm i -g @fenilsonani/envstore

This installs the envstore command globally.

Quick start

envstore login           # authenticate with your API key (esk_live_...)
cd my-project
envstore init            # link the project + encrypt .env -> .env.vault
envstore push            # upload the encrypted vault
envstore pull            # fetch + decrypt on another machine
envstore run -- node server.js   # inject vars into a process, nothing on disk

Get an API key from your EnvStore dashboard under API Keys.

Commands

| Command | Description | |---|---| | init | Encrypt .env and create .env.vault | | push / pull | Upload encrypted vault / download + decrypt | | run -- <cmd> | Inject env vars into a command (nothing written to disk) | | status / diff | Sync status / compare local .env vs vault | | keys / peek / check | List names / truncated values / verify required vars | | env | list \| delete environments in the linked project | | org / project | Manage organizations / projects | | members / invite / remove / audit | Team management (admin) | | protect / unprotect | Lock an environment behind a minimum role | | webhook | list \| add \| remove outbound webhooks | | rotate | Re-encrypt with a new passphrase | | 2fa | status \| enable \| disable two-factor auth | | me | Show current account, key, and orgs | | login / logout | Manage credentials | | completion | Generate shell completion (bash/zsh/fish) |

Run envstore --help for full usage.

Environment variables

| Variable | Purpose | |---|---| | ENVSTORE_API_KEY | Skip login, use an API key directly (CI/CD) | | ENVSTORE_PASSPHRASE | Skip the passphrase prompt | | ENVSTORE_SERVER | Override the server URL | | ENVSTORE_ENVIRONMENT | Override the environment name (worktree-safe) | | ENVSTORE_PROJECT_ID | Override the project ID |

CI/CD example

ENVSTORE_API_KEY=esk_live_... ENVSTORE_PASSPHRASE=... envstore pull -q

Security

• AES-256-GCM encryption via the Web Crypto API
• PBKDF2 key derivation (210,000 iterations)
• Zero-knowledge — the passphrase never leaves your machine; only ciphertext is uploaded

License

MIT