Now in private beta for agencies

Stop sharing .env files over Slack. It's a security mess.

EnvSync is a minimalist CLI that encrypts your .env on your machine and syncs it everywhere — across your own laptops, or your whole team's. Free for solo developers, one flat rate for your agency.

No credit card. No spam. Just your activation key.

Zero-knowledge encryption Secrets off disk with envsync run Flat agency pricing
~/projects/client-app — zsh

Built for teams that ship fast

Everything you need to kill the copy-paste-secrets workflow for good.

Local Cryptography First

Secrets are encrypted on your machine before transport. Keys never touch our servers in plaintext.

Zero-Config CLI Wrapper

Language-agnostic — works with any stack. One command in, one command out. No YAML hell.

Flat Agency Pricing

Stop paying unfair per-seat user fees. One predictable monthly rate covers your whole agency.

AES-256-GCM encryption Works with any stack Up to 15 developers Versioned rollback

How it works

Three commands. Encrypted on your machine, synced everywhere.

1

Log in

envsync login <token>

Scope your repo — it auto-detects your git remote.

2

Push

envsync push

Encrypt your .env (AES-256-GCM) and save a version.

3

Pull anywhere

envsync pull

Restore it on any machine — or envsync run to skip the file entirely.

Read the docs →

Why not the others?

The one combination nobody else offers: flat pricing, zero-knowledge, and a managed vault.

vs Doppler

Flat pricing instead of per-seat — and a server that can't read your secrets.

Compare →

vs Infisical

Nothing to self-host, flat pricing, and zero-knowledge by default.

Compare →

vs dotenvx

A real managed vault + dashboard — your secrets never get committed to the repo.

Compare →
See the full comparison →

Simple, honest pricing

Free for solo developers. One flat rate for your whole team — never per-seat.

Solo

For individual developers.

Free
  • ✓ Unlimited projects & environments
  • ✓ Versioned vault with rollback
  • ✓ Sync across all your machines

Agency

Popular

For teams that ship together.

₹1,999/mo
  • ✓ Up to 15 developers — no per-seat fees
  • ✓ Team invites & one-click offboarding
  • ✓ Roles & centralized access logs
See full pricing →

Questions, answered

Can you read my secrets?

No. Encryption happens on your machine (PBKDF2 + AES-256-GCM); we only ever store ciphertext. See the security model →

What if I forget my passphrase?

It never leaves your machine, so we genuinely can't recover it — keep it in your team password manager. That's the trade-off that makes it zero-knowledge.

Which languages or frameworks does it work with?

Any of them. EnvSync manages your .env and can run any command with secrets injected — it doesn't care about your stack.

Is it really not per-seat?

Correct — one flat rate covers up to 15 developers. Add or remove teammates anytime; the price doesn't change.

What happens when a developer leaves?

Remove them in one click — their tokens are revoked instantly and their CLI access is cut off.

Open-source CLI · audit the crypto yourself

EnvSync is built in public. The CLI's encryption is open-source and auditable, and the server is treated as untrusted infrastructure — a breach exposes only ciphertext.

View the CLI source on GitHub →

Start syncing in two minutes

Stop Slacking .env files. Encrypt once, sync everywhere.

Join the Early Access Beta

Free for solo developers · flat rate for your agency.