The Next Generation of Secret Management

Secure your secrets.
Empower your team.

Zero-knowledge end-to-end encryption. Seamless CLI integration. Granular sharing. Built specifically for modern developer workflows.

.env — EnVault Workspace
# Production Environment Secrets
DATABASE_URL="postgres://admin:********@aws.neon.tech/main"
NEXTAUTH_SECRET="vlt_sec_8f92jK..."
E2E Encrypted & Synced

Core Capabilities

Hover over the cards below to uncover the depth of our military-grade infrastructure.

Zero-Knowledge Encryption

Your secrets are encrypted in your browser. The server never sees your plaintext data.

Zero-Knowledge Encryption Details

We use AES-256-GCM for envelope encryption. Your Master Password stays local and derives a Key Encryption Key via PBKDF2. Even in a total database breach, your secrets remain mathematically impenetrable.

Collaborative Sharing

Share specific files or environments via email with granular TTLs and permissions.

Collaborative Sharing Details

Create 'PR-style' edit requests. Shared payloads are re-encrypted client-side using a unique invitation salt, meaning a revoked share instantly cryptographically invalidates access.

Private Spaces

Create democratic workspaces where changes require peer approval to merge to the official King File.

Private Spaces Details

Every team member receives their own personal fork. When teams grow over 10 members, an automatic election is held to vote for a 3-person Council (The Iron Throne) to govern secret merges.

CLI & IDE Integration

Interact with your vault directly from your terminal or VS Code.

CLI & IDE Integration Details

Generate Machine Tokens to inject secrets into your CI/CD. The VS Code extension offers inline peeking, auto-sync file watching, and Git-like conflict resolution for team collisions.

AI Explorer Widget

A context-aware AI assistant that understands your environments.

AI Explorer Widget Details

The AI only reads structural metadata (key names, counts, file types) to answer questions or detect missing keys. Plaintext secret values are NEVER sent to the LLM.

Robust Security

Protect your account with WebAuthn, TOTP 2FA, and Recovery Codes.

Robust Security Details

Instead of typing your password constantly, use Touch ID or Face ID. If you forget your master password, our generated Recovery Codes act as a cryptographic fallback to derive your keys.

The "Iron Throne" Architecture

EnVault introduces a radically new way to handle team secrets. In a Private Space, everyone gets their own personal fork of the environment.

  • Democracy Mode: Small teams require unanimous approval to merge changes into the official "King File".
  • Council Elections: Once your team grows beyond 10 members, an automatic election triggers to choose a 3-person council to approve merges.
  • Peer-to-Peer Sync: Easily cherry-pick line changes from a coworker's local fork seamlessly using the shared SpaceKey.
The King File
Official Source of Truth
A
Alice's Fork
Drafting changes
B
Bob's Fork
Synced

The Complete Developer Ecosystem

Manage secrets where you work. EnVault goes beyond the browser, delivering native tools for your terminal and IDE.

EnVault CLI

Run vault pull or vault push directly from your terminal. Inject secrets securely into your processes using vault run -- npm run dev without ever writing plaintext to your disk.

VS Code Extension

Never leave your editor. See inline hovers of your decrypted values, gutter indicators showing sync status, and resolve merge conflicts visually just like Git. Auto-push on save keeps your team perfectly in sync.

CI/CD Integration

Generate scoped Machine Tokens to easily pull production secrets into GitHub Actions, Vercel, or AWS deployment pipelines automatically.

zsh — vault-cli
my-app vault login
Authenticated successfully as developer@envault.dev
my-app vault pull --env=production
Downloading and decrypting 24 secrets...
✔ Successfully updated local .env
my-app vault status
1 modified secret (DATABASE_URL)

Multi-Sharing & Version Control

Total control over who sees what, and the ability to travel back in time if something goes wrong.

Granular Multi-Sharing

Share entire environments, specific folders, or single variables. Recipient data is securely re-encrypted on your browser before sending, and you remain in total control.

  • Granular Read / Comment / Edit permissions
  • Time-To-Live (TTL) auto-expiring links
  • Out-of-band passphrase protection for recipients
  • "PR-style" review flow to approve changes

Infinite Version History

Mistakes happen. That's why every single change to a secret or a file is versioned and cryptographically preserved. You can roll back an entire folder to its exact state from yesterday.

Today at 2:30 PM
STRIPE_KEY = "sk_live_old..."
STRIPE_KEY = "sk_live_new..."

Stop passing .env files over Slack

Join developers keeping their secrets secure, synced, and democratized with EnVault.

Create Free Account