Native macOS · v0.6 · Free to start
A native vault for environment files and secrets. It syncs through your own iCloud, never through our servers, because there aren’t any. Copy a key from any app, unlock the CLI with Touch ID, and stop committing secrets by accident.
macOS 14 or later. Free tier forever, no account. Signed and notarized by Apple. Release notes
EnVault (.env + vault) was called eVault until 0.6. Coming from eVault? Install EnVault, then pick “Used eVault? Move a vault from it…” on the first screen for an iCloud vault, or “Open from a Folder…” for a folder vault. Paste your license key again in Settings › License. The command is now envault.
In the app
Projects, env files, secrets and notes. An editor with history, line numbers and warnings, and a key-by-key comparison with your other environments.
Over any app, with ⌥⌘E
A search panel above whatever you are doing. Type part of a key, press Return, paste. The clipboard clears itself and clipboard managers skip it.
In Terminal
The envault command ships inside the app. It asks EnVault for the key and you approve with Touch ID, so you never type the passphrase into a shell.
New in 0.5: AI coding agents can use your secrets without seeing them. From 0.4: quick copy over any app, Touch ID for the command line, importing whole project folders, files kept in sync on disk, and a commit hook that stops leaks.
Claude Code, Cursor and Codex run your tests and scripts with the env file loaded, through MCP or the envault command. Values in their output show as [redacted:KEY]; reading one takes your Touch ID. How it works
Press ⌥⌘E anywhere. Search keys, secrets, notes and values, with the ones you copy most at the top. Return copies the value, ⌥Return an export line, ⌘Return KEY=value.
When EnVault is running, envault asks the app for the key and you approve with Touch ID. Install it from Settings in one click; app updates update it too.
Point EnVault at ~/Projects. Each folder becomes a project with its .env files; templates like .env.example are skipped. Also imports Doppler, 1Password items, JSON and .env.vault.
Link an item to a project folder and EnVault rewrites the file whenever it changes, here, on another Mac or from the CLI. Edits you made on disk are never overwritten without asking.
envault protect adds a pre-commit hook that stops commits containing API keys, tokens, private keys or a real .env file. Mark a false positive with envault:allow.
Line numbers and warnings for duplicate keys, empty or placeholder values and broken lines. See which keys .env.production has that .env.local lacks, and add them in one step.
Each edit is a new revision you can diff and restore, with the Mac that made it. Keys whose value hasn’t changed in 90 days are flagged for rotation.
cdLink a folder to an env file and the shell hook (zsh, bash or fish) exports its variables when you enter and unsets them when you leave.
Push an env file to Vercel, Cloudflare Workers or GitHub Actions secrets with envault deploy, using the vendor CLIs and logins you already have.
Plus, in Pro: env diff, .env.example generator, secret scan, JWT decoder, UUID and password generators.
Zero-knowledge by construction
Every revision is its own AES-256-GCM file. The key comes from your passphrase on your Mac (PBKDF2, 600,000 rounds). Sync only ever carries ciphertext.
Files are never overwritten, so iCloud Drive, Dropbox or git can’t produce conflicts, and offline edits on two Macs merge cleanly.
The app is sandboxed without a network entitlement. macOS does the syncing; EnVault has no servers and no analytics.
Unlock with Touch ID, lock on sleep or after idle time. Copied values are hidden from clipboard managers and cleared after 30 seconds.
The command line gets the key only after you approve it in a system Touch ID prompt, one command at a time. You can turn this off in Settings.
A one-time recovery key gets you back in if you forget the passphrase. The vault format and crypto are open source: read the threat model.
Run a command with an environment injected, pull a file, import from Doppler or 1Password, deploy to Vercel. The same vault, the same Touch ID.
Full command referencevault.json holds your key-derivation settings and the vault key, wrapped by your passphrase. Every change writes a new .evr file that is never touched again. Choose how it travels:
Keep the vault in iCloud Drive, Dropbox, Syncthing or a git repo. No account, nothing to set up.
The vault lives in the app and mirrors to your private CloudKit database. Your other Macs on the same Apple Account open it with the passphrase.
The free tier stays free. Pro is a one-time purchase with a year of updates.
$0
$29 one-time
cdCheckout by Polar. Your key arrives by email within a minute. 14-day refunds. Lost your key?
Soon