Commit .env files with secrets straight into Git without exposing plaintext values.
Share a single encrypted config file across a team using one shared key.
Automatically decrypt secrets during CI or server provisioning using the same setup command.
Mark specific values as intentionally public while keeping the rest encrypted by default.
| automazeio/envapor | kelseyhightower/confidence | developersdigest/aws-ec2-cuda-ollama | |
|---|---|---|---|
| Stars | 29 | 29 | 30 |
| Language | Go | Go | Go |
| Last pushed | — | 2016-01-16 | 2024-08-03 |
| Maintenance | — | Dormant | Stale |
| Setup difficulty | easy | easy | hard |
| Complexity | 3/5 | 2/5 | 4/5 |
| Audience | developer | developer | ops devops |
Figures from each repo's GitHub metadata at analysis time.
Uses a shared symmetric key across the whole team, so anyone with the key can decrypt every stored secret.
envapor is a command line tool that lets you commit your .env files, the plain text files where developers usually keep secrets like database passwords and API keys, directly into Git without exposing those secrets. It works by encrypting each value the moment you commit and decrypting it automatically the moment you check the code back out, so your actual working file on disk always looks normal, while only scrambled text ever gets stored inside Git itself. The key idea is that your day to day workflow does not change at all. You still run git add, commit, push, and pull the same way you always have. There is no separate encrypted copy of the file to keep synced, and variable names stay readable in the committed version, so the file still works as its own list of what settings exist, without needing a separate example file. If you want a specific value to stay readable in Git on purpose, you mark it with a PUBLIC comment next to it, and anything not marked that way is encrypted by default rather than left exposed by mistake. Under the hood, envapor relies on Git's own clean and smudge filters, hooks Git already supports for transforming files going in and out of storage, plus a pre-commit check that blocks a commit if a secret would otherwise reach Git unencrypted. Each value is encrypted on its own with AES-256-GCM, tied to both a shared team key and the specific variable name, so a scrambled value cannot accidentally apply to the wrong variable if copied elsewhere. Because the encryption is deterministic, the same value always produces the same scrambled result, so diffs and merges still look clean. To use it, you generate a shared key once for your team, then run a setup command in each repository that maps it to that key. Teammates who clone the repository run the same setup command and Git decrypts the file automatically. It installs as a single binary with no extra dependencies on macOS, Linux, and Windows, and is meant for trusted teams who all hold the same key, not for giving different people access to different individual secrets. The project is released under the Apache 2.0 license.
A command line tool that transparently encrypts secrets inside .env files so they can be safely committed to Git, decrypting them automatically on checkout.
Mainly Go. The stack also includes Go, Git, AES-256-GCM.
Use freely for any purpose, including commercial use, as long as you keep the copyright notice and license terms.
Setup difficulty is rated easy, with roughly 5min to a first successful run.
Mainly developer.
This repo across BitVibe Labs
Don't trust strangers blindly. Verify against the repo.