Why encenv?

Environment variables often contain secrets (API keys, DB passwords, tokens). encenv lets you encrypt .env files into .env.enc blobs that are safe to commit, while keeping an interactive, modern CLI experience — plus a full non-interactive mode for scripts and CI.

• 🎨 Fully interactive — menus, checkboxes, real-time strength meters
• ⚡ Full CLI mode — every action available as a subcommand with flags
• 🔒 AES-256-GCM authenticated encryption
• 🔑 PBKDF2-HMAC-SHA256 key derivation (100k iterations)
• 💪 Real-time password strength meter (zxcvbn)
• 📁 Monorepo support — encrypt frontend/ and backend/ in one shot
• 🧹 Smart cleanup — --yes auto-deletes originals after encryption/decryption
• 🔄 Rekey support — rotate passwords without losing data
• ⚠️ Git guard — warns if .env files are not gitignored

Installation

Global (recommended)

npm install -g @iamsdr/encenv

Then use it from any project:

encenv

Local (per-project)

npm install --save-dev @iamsdr/encenv
npx encenv

Usage

Interactive mode (default)

Simply run encenv with no arguments:

encenv

| Subcommand | What it does | |---|---| | 🔒 Encrypt .env files | Discovers .env* files, lets you pick which to encrypt | | 🔓 Decrypt .env files | Discovers .env*.enc files, restores the originals | | ❌ Exit | Quits the tool |

CLI mode (non-interactive)

| Command | Description | |---|---| | encenv encrypt | Encrypt .env files | | encenv decrypt | Decrypt .env.enc files | | encenv status | Show which files are encrypted vs plain | | encenv rekey | Re-encrypt with a new password |

Encrypt

# Current directory
encenv encrypt -p "MyStrongPass123!"

# Monorepo: encrypt frontend and backend
encenv encrypt -p "MyStrongPass123!" frontend backend

# Auto-delete originals without prompting
encenv encrypt -p "MyStrongPass123!" --yes

# Preview only (no files changed)
encenv encrypt -p "MyStrongPass123!" --dry-run

Decrypt

# Current directory
encenv decrypt -p "MyStrongPass123!"

# Monorepo: decrypt frontend and backend
encenv decrypt -p "MyStrongPass123!" frontend backend

# Auto-delete .enc files without prompting
encenv decrypt -p "MyStrongPass123!" --yes

Status

# Current directory
encenv status

# Monorepo: show frontend and backend
encenv status frontend backend

Output example:

  [OK]   .env                    encrypted
  [WARN] .env.local              NOT encrypted
  [MISS] .env.production.enc     missing original

Summary: 1 plain, 2 encrypted

Rekey (password rotation)

# Re-encrypt all .enc files with a new password
encenv rekey --old-password "OldPass123" --new-password "NewPass456"

# Rekey multiple directories
encenv rekey --old-password "OldPass123" --new-password "NewPass456" frontend backend

# Auto-delete old backups without prompting
encenv rekey --old-password "OldPass123" --new-password "NewPass456" --yes

# Preview only
encenv rekey --old-password "OldPass123" --new-password "NewPass456" --dry-run

Rekey creates .env.enc.bak backup files for safety, then replaces the originals with re-encrypted data.

Monorepo example

my-monorepo/
  frontend/.env
  backend/.env

# One command encrypts both
encenv encrypt -p "Secret123" frontend backend

# One command decrypts both
encenv decrypt -p "Secret123" frontend backend

Encrypted File Format

[version: 1 byte] || [salt: 16 bytes] || [nonce: 12 bytes] || [authTag: 16 bytes] || [ciphertext: variable]

| Field | Size | Purpose | |---|---|---| | Version | 1 byte | Format version (0x01) | | Salt | 16 bytes | Unique random salt per file (PBKDF2 input) | | Nonce | 12 bytes | Unique random nonce per encryption (GCM IV) | | AuthTag | 16 bytes | GCM authentication tag — prevents tampering | | Ciphertext | variable | The actual encrypted data |

Security Model

• Passwords are never persisted — only kept in memory during the session
• Derived keys are zeroed from memory after use (Buffer.fill(0))
• Unique salt + nonce per file — no key/nonce reuse across files
• GCM provides both confidentiality and integrity — corrupted files are rejected
• Backups on rekey — old .enc files are backed up before rotation

Programmatic API

If you want to use the crypto engine in your own scripts:

import { encrypt, decrypt } from "@iamsdr/encenv";

const password = "your-strong-password";
const payload = encrypt(password, Buffer.from("SECRET=value"));

// ...later...
const plaintext = decrypt(password, payload);

Requirements

• Node.js >= 18.0.0

Tech Stack

• TypeScript + ESM
• Node.js crypto (AES-256-GCM, PBKDF2)
• Commander (CLI parsing)
• Inquirer (interactive prompts)
• Ora (spinners)
• Chalk + Boxen (styled CLI)
• zxcvbn (password strength estimation)

License

MIT © IAMSDR