// docs

Documentation

Everything you need to sync secrets securely. New here? Start with the Quickstart — about two minutes.

Quickstart

Install the CLI

A single static binary. Pick your platform:

macOS

$ brew install envsync

Linux

$ curl -fsSL https://get.tryenvsync.com | sh

Windows

> scoop install envsync

Any platform with Rust: cargo install envsync · or build from source (cargo build --release).

Create a project & token

In the dashboard, create a project and generate a token for an environment. The token is shown once — copy it now.

Open the dashboard →

In your repo: log in, push, pull

Run these from your project folder. Each one's job:

$ envsync login es_dev_…

Links this folder to your project (auto-detects your git repo).

$ envsync push

Encrypts your .env on your machine and saves a new version.

$ envsync pull

Restores your .env on any machine. That's the whole loop. 🎉

How it works

Encryption happens on your machine. The server only ever sees ciphertext.

your machine

Encrypt .env

AES-256-GCM

→

the vault

Stores ciphertext

never plaintext

→

teammate

Pull & decrypt

same passphrase

Core concepts

Projects & environments

One project per repo. Each has separate vaults for DEVELOPMENT, STAGING, and PRODUCTION.

Tokens

Each token scopes the CLI to one project + environment. Shown once, stored only as a hash. Admins mint PRODUCTION tokens.

Versioning & rollback

Every push is an immutable version. Roll back anytime with envsync pull --version N.

Zero-knowledge

Your passphrase and key never leave your machine. How we keep secrets safe →

CLI reference

Command	What it does
envsync login <token>	Scope the folder; auto-detects the git repo.
envsync push	Encrypt local .env and store a new version.
envsync pull [--version N]	Decrypt the latest (or a specific) version to .env.
envsync run -- <cmd>	Inject secrets into a process — never touches disk.
envsync status	Show scope, latest version, and local drift.
envsync diff	Compare local .env keys with the vault (local).

Common tasks

Run your app with secrets (no .env on disk)

$ envsync run -- npm start

Roll back to a previous version

$ envsync pull --version 1

See what changed vs the vault

$ envsync diff

Use a token in CI (non-interactive)

$ ENVSYNC_PASSPHRASE=$PASS envsync pull --yes

Onboard a teammate: invite them from the dashboard → they run envsync login then envsync pull.

Good to know

Keep your Team Master Passphrase safe. It never leaves your machine — so we can't recover it. Store it in your team password manager.

Scopes & roles. A token works for exactly one project + environment. Only admins can mint PRODUCTION tokens, invite, or remove members.

`.envsync.json` is written in your repo on login and auto-added to .gitignore — your token never gets committed.

Next steps

How security works → EnvSync vs others → Pricing →