sendenv

Encrypt your .env file and share it safely through git. Teammates decrypt it locally with a shared passphrase. No third-party service. No secrets in Slack.

npx sendenv encrypt
npx sendenv decrypt

The problem

.env files cannot be committed to version control, so secrets end up in Slack messages, email threads, and README files. New developers are blocked on day one waiting for someone to send them the correct values. When a secret rotates, not everyone gets updated.

sendenv solves this by treating the encrypted file as a regular git artifact.

How it works

1. Run sendenv encrypt in your project root. It reads .env, encrypts every value using AES-256-GCM with a passphrase-derived key, and writes .env.encrypted.
2. Commit and push .env.encrypted. Your .gitignore is updated automatically to block the plain-text .env.
3. A teammate clones the repo, runs sendenv decrypt, enters the shared passphrase, and gets a working .env file in seconds.

Key names are visible in the encrypted file. Values are not.

Requirements

• Node.js 18 or later
• No production dependencies

Installation

Run without installing:

npx sendenv <command>

Install globally:

npm install -g sendenv

Install as a dev dependency:

npm install --save-dev sendenv

Commands

encrypt

Reads .env, encrypts each value, writes .env.encrypted, and updates .gitignore.

sendenv encrypt

Options:

| Flag | Description | Default | | ---------------- | ---------------------------------------- | ---------------- | | --input, -i | Path to the source .env file | .env | | --output, -o | Path to the encrypted output file | .env.encrypted | | --env, -e | Named environment profile | — | | --iterations | PBKDF2 iteration count (minimum 100,000) | 200000 | | --overwrite | Overwrite an existing encrypted file | false | | --no-gitignore | Skip .gitignore management | false |

decrypt

Reads .env.encrypted, verifies integrity, decrypts each value, and writes .env.

sendenv decrypt

Options:

| Flag | Description | Default | | -------------- | --------------------------------- | ---------------- | | --input, -i | Path to the encrypted file | .env.encrypted | | --output, -o | Path to write the decrypted file | .env | | --env, -e | Named environment profile | — | | --overwrite | Overwrite an existing .env file | false |

check

Verifies the HMAC integrity of .env.encrypted without decrypting. Useful in CI.

sendenv check --key "$sendenv_KEY"

Exits with code 0 on success, 1 on failure.

diff

Compares key names between .env and .env.encrypted. Does not decrypt values.

sendenv diff

Exits with code 0 when files are in sync, 1 when keys differ.

rotate

Re-encrypts .env.encrypted with a new passphrase. Does not require the plain-text .env file.

sendenv rotate

init

Creates a .env.example template from your existing .env key names and configures .gitignore.

sendenv init

Environment profiles

Use --env to manage multiple environments from one project.

# Encrypt the staging environment
sendenv encrypt --env staging

# Decrypt it on another machine
sendenv decrypt --env staging

This reads .env.staging, writes .env.staging.encrypted, and follows the same naming pattern for all commands.

Encrypted file format

.env.encrypted is a plain-text file safe to open in any editor or diff tool.

# sendenv encrypted file
# Do not edit manually. Use sendenv to modify values.
# sendenv_VERSION=1
# sendenv_SALT=<base64 encoded salt>
# sendenv_ITERATIONS=200000
# sendenv_HMAC=<base64 encoded HMAC-SHA256>

DATABASE_URL=enc:aGVsbG8gd29ybGQgdGhpcyBpcyBhIHRlc3Q...
STRIPE_SECRET=enc:c29tZSByYW5kb20gZW5jcnlwdGVkIGRhdGE...
NODE_ENV=enc:cHJvZHVjdGlvbiBtb2Rl...

Configuration file

Create sendenv.config.json in the project root to set defaults.

{
  "iterations": 200000,
  "gitignore": true,
  "profiles": {
    "staging": {
      "input": ".env.staging",
      "output": ".env.staging.encrypted"
    },
    "production": {
      "input": ".env.production",
      "output": ".env.production.encrypted"
    }
  }
}

CLI flags always override config file values.

CI usage

Store the passphrase as a repository secret and pass it via the --key flag or the sendenv_KEY environment variable.

- name: Verify encrypted env file
  run: npx sendenv check
  env:
    sendenv_KEY: ${{ secrets.sendenv_KEY }}

Do not write the decrypted .env to disk in CI. Export values directly into the shell environment instead.

Security

• Passphrase-derived key via PBKDF2-HMAC-SHA256 (200,000 iterations, 32-byte salt)
• Per-value encryption using AES-256-GCM with a unique 12-byte IV per value
• File-level HMAC-SHA256 integrity check — any modification to the encrypted file is detected before decryption begins
• Passphrase and derived key are zeroed in memory after use
• No network calls, no telemetry, no external services

The passphrase must be shared through a secure out-of-band channel such as a shared password manager. sendenv does not handle passphrase distribution.

If .env was committed to git at any point in the past, the secret exists in git history. Rotate all affected credentials before using sendenv.

Contributing

See CONTRIBUTING.md.

Security issues

See SECURITY.md.

License

MIT. See LICENSE.