Secure Secrets. Everywhere.
Share .env files and secrets securely across machines, environments, and platforms. One encrypted vault, accessible anywhere your code runs.
npm install -g envoak
scan command manages all your reposIndustry-standard authenticated encryption. Each encryption uses a unique IV from a cryptographically secure random source.
One 64-character hex key per project. Generate with envoak keys --generate or use
your own.
Encrypted files are safe to commit. Your secrets travel with your code, protected by the key.
Works on macOS, Linux, and Windows. Share secrets across any development environment.
Audit all repositories at once with envoak scan. Find unencrypted secrets and stale
vaults.
AI agents can audit, encrypt, and decrypt via Model Context Protocol. Perfect for agentic workflows.
When generating Mycmail encryption keys, back them up automatically to your envoak vault.
mycmail generate-keys --vault
Set ENVOAK_KEY as a secret in GitHub Actions, GitLab CI, or any pipeline.
ENVOAK_KEY=${{ secrets.ENVOAK_KEY }}
Include .env.enc in your image, inject key at runtime. No secrets in layers.
docker run -e ENVOAK_KEY=... myapp
envoak initenvoak pushenvoak pullenvoak statusenvoak auditenvoak scan [dir]envoak keys --generateenvoak keys --propagateSync secrets between your laptop, desktop, and cloud VMs without ever exposing them in plain text.
New developer joins? Share the ENVOAK_KEY once. They git pull && envoak pull and
they're ready.
Use envoak scan to audit all projects. Propagate keys to ensure consistent
encryption.
Agents can use MCP tools to check vault status and manage secrets without exposing keys in prompts.
Yes! envoak uses AES-256-GCM, the same encryption standard used by governments and financial institutions. Each encryption uses a unique initialization vector (IV) from a cryptographically secure random source. The 64-character hex key provides 256 bits of entropy — virtually uncrackable with current technology.
We recommend using a password manager (1Password, Bitwarden), an encrypted messaging app (Signal), or your company's secrets management system. Never share keys via unencrypted email or Slack. For AI agents, consider using Mycmail's encrypted messaging with envoak backup.
Absolutely! Create separate .env files (.env.dev, .env.staging, .env.prod) and use different
ENVOAK_KEY values for each. The --file flag lets you specify which file to
encrypt/decrypt.
The encrypted file cannot be recovered without the key — that's the security guarantee. Always store your key in a secure location like a password manager. For critical projects, consider key escrow with a trusted party.
No. envoak is 100% local and offline. Your secrets are encrypted and stored as .env.enc files in your repository. We never transmit, store, or have access to your secrets or keys. You own your data completely.