Encrypt your secrets.
Ship them with your code.

Dotenvx is docker for secrets From the creator of dotenv 20.5k

Install Docs

Encrypt

$ echo "HELLO=Secret" > .env
$ dotenvx encrypt
◈ encrypted (.env)

Encrypt your secrets in .env files. Only your private key can unlock them.

Commit

HELLO=encrypted:BAgYNmJ3PV9+aajRwCh1Wx...
$ git add .env
$ git commit -m "Add encrypted secrets"

Commit your encrypted .env. Your secrets ship with your code.

Ship

$ dotenvx run -- node index.js
⟐ injected env (2) from .env
Hello Secret

Ship your code and encrypted secrets together. Dotenvx unlocks them at runtime.

Three foundational technologies.
One elegant way to manage secrets.

Dotenvx brings together .env’s simplicity, git’s distribution, and ECIES’ battle-tested encryption, built on the same elliptic curve used by Bitcoin, so your secrets can ship with your code.

Chosen for projects at Google, NASA, AWS, PayPal, CrowdStrike, Supabase, and the Republic of France, with all the features you need.

Make .env safe to commit dotenvx encrypt
Password protect your .env file dotenvx lock
Store keys in your OS keychain dotenvx native
Same on Mac, Linux, and Windows dotenvx run
Ship the right secrets to each environment dotenvx run -f .env.production
Runtime leak protection and log redaction dotenvx run --redact -- claude
Catch missing keys before you run dotenvx validate
Protect your team from secret leaks dotenvx precommit
Give .env live, computed values ${OTHER_VAR} $(whoami)
Pull secrets remotely from places like 1Password op://.. bw://..
and more

Once your secrets are in an encrypted git workflow, you'll wonder why you waited so long. It just feels so good.

Encrypt your secrets.Ship them with your code.