Features

An end-to-end encrypted secrets platform, from client-side encryption to typed SDKs, framework adapters, versioning, and granular access control.

What is Envless?

Envless is an end-to-end encrypted secrets manager that replaces .env files. Variables are encrypted on your machine with AES-256-GCM before upload, so the server only ever stores ciphertext, then delivered to any runtime, framework, or CI pipeline through a typed SDK and CLI, with versioning, attributed change history, and role-based access built in.

What sets Envless apart

True client-side end-to-end encryption with a zero-knowledge server: values are encrypted with AES-256-GCM and a PBKDF2-SHA256 key (200,000 iterations) on your machine, and the server only ever stores ciphertext.

A typed SDK that imports variables directly into application code with automatic coercion and generated TypeScript declarations (envless-env.d.ts) for IDE autocomplete and compile-time checking.

Built-in server/client variable splitting enforced through bundler plugins, ESLint rules, and runtime checks to keep secrets out of client bundles.

Native runtime delivery across Next.js, Vite, Node, Bun, and edge workers, no .env files required, while still populating the standard process.env for library compatibility.

An on-disk cache that only ever holds ciphertext, written at mode 0600, so a cached build never leaves plaintext secrets on the machine.

Open, verifiable webhooks following the Standard Webhooks spec with HMAC-SHA256 signatures, 48 event types, exponential-backoff retries, secret rotation, and delivery history.

Every capability, in depth

One page per pillar, with the real numbers, the commands that work today, and the limits stated plainly.

Agents

AI agents

Give a coding agent working secrets with no plaintext .env in the repository for it to read or commit.

 Terminal

The CLI

24 commands, browser device login, local encryption, and JSON output on every list.

 TypeScript

The SDK

Zero-dependency typed client, full API coverage enforced by CI, with encryption and webhook helpers.

 Encryption

End-to-end encryption

AES-256-GCM on your machine, a key the server never sees, and an API that structurally refuses plaintext.

 History

Versioning and history

Numbered snapshots in one locked transaction, attributed per-variable history, and signed events for every change.

 Teams

Team access control

44 permissions, custom roles, private products isolated to named members, and keys clamped to their creator.

 Environments

Environment variables

Typed, per-environment variables with server/client splitting, .env import and export, and a real diff.

 Public feeds

Virtual environments

Serve an environment as an encrypted JSON feed at a public URL that needs no SDK, CLI or API key.

 Setup

Getting set up

Install, sign in, bind the directory, unlock, run. What each step writes, and what it does not.

 Cloning

One-click duplicate

Clone an environment, project or whole product with every variable, in one transaction, without decrypting anything.
01 / 08

End-to-end encryption

Secrets are encrypted and decrypted on your machines, the server only ever holds ciphertext.

Client-side AES-256-GCM encryption

Variable values are encrypted with AES-256-GCM using a key derived from the workspace passphrase via PBKDF2-SHA256 (200,000 iterations) with a workspace-specific salt. Encryption and decryption happen only on client machines.

Zero-knowledge server storage

The server stores only ciphertext and never sees plaintext values or the workspace passphrase. Decryption requires the locally cached derived key.

Workspace passphrase management

Set, verify, rotate, and clear workspace encryption passphrases. The CLI verifies a passphrase against sample encrypted variables before caching the derived key, and supports rotating or forgetting keys from the dashboard.

Encryption SDK

The @goenvless/sdk package exposes encryptValue(), decryptValue(), deriveWorkspaceKey(), importWorkspaceKey(), and passphraseStrength() so you can encrypt values client-side before writing them through the API.

02 / 08

Sync, runtime & environments

Get decrypted variables into any process, file, or runtime, without committing .env files.

Typed runtime import

Import environment variables directly in application code via the typed SDK, with automatic type coercion and no .env files on disk.

Sync to .env files

envless sync decrypts variables and writes .env.<environment-slug> files with proper bash escaping and a sync timestamp header. Writes are idempotent, unchanged files are skipped to avoid spurious dev-server reloads.

Process wrapping (envless run)

Inject decrypted variables into a single child process with no disk footprint and no code changes. Forwards SIGINT/SIGTERM to the child and returns its exit code, making it ideal for CI and one-off commands.

Multi-environment merging

envless run and envless build merge several environments into one process, with later environments winning on a name collision. Sync does not merge: it writes a separate .env.<slug> file per environment.

Real process.env compatibility

Envless populates the standard process.env alongside the typed env proxy, so libraries that read environment variables directly keep working.

Project linking (.envless file)

Bind a directory to a workspace, product, project, and one or more environments via interactive or flag-driven CLI. The resulting .envless JSON file is safe to commit and enables non-interactive sync and run.

03 / 08

Developer tooling & type safety

Schema-driven types, compile-time checks, and guardrails that keep secrets out of client bundles.

Typed variables with auto coercion

Define variable schemas in the dashboard with required/optional flags and defaults. The CLI generates type-safe imports and coerces values to strings, numbers, or booleans at runtime.

Type declaration generation

envless types generates an envless-env.d.ts declaration file from the dashboard schema, giving IDE autocomplete and compile-time type checking.

Server vs client variable splitting

Visibility flags separate server-only and client-safe variables, enforced through types, runtime checks, bundler plugins, and ESLint rules to prevent secrets from leaking into client bundles.

Test overrides

Override env values in tests with __override() and scoped 'using' declarations, without mutating global state.

Interactive CLI

Guided workspace, project, and environment selection with autocomplete and validation, plus help/version flags, browser-based login, and an optional background npm update check.

04 / 08

Framework & platform integrations

First-class adapters for the runtimes and deploy targets developers actually use.

Next.js integration

The withEnvless() build plugin handles client inlining and runtime loading with full support for the App Router, Pages Router, and Edge Runtime.

Vite plugin

A Vite plugin for SPAs, SvelteKit, Astro, and Remix-on-Vite with client variable inlining and dev-mode HMR.

Node.js and Bun support

Side-effect import (/register) or --import flag for Express, Fastify, Hono, and standalone scripts, plus native Bun support via a bunfig.toml preload hook with native crypto and faster cold starts.

Edge worker support

The withEnvless and Vite plugins inline client-flagged variables into the bundle at build time for Cloudflare, Vercel, and Netlify edge runtimes, and a separate @goenvless/env/edge entry loads them explicitly where a filesystem is not available.

CI/CD and deploy targets

Works with GitHub Actions, GitLab CI, CircleCI, and generic runners via ENVLESS_TOKEN, plus Vercel, Docker build secrets, Kubernetes (including the ExternalSecret operator), Fly.io, Railway, and Render.

05 / 08

Caching & production performance

Fast, resilient access to secrets even under cold starts or network failure.

On-disk encrypted caching

Ciphertext is cached on disk per workspace and environment exactly as the API returned it, at file mode 0600, and refetched once the 15-minute freshness window lapses. No plaintext value is ever written to the cache.

Build-time inlining on edge

On edge runtimes the envless build command inlines client-flagged variables at build time, so there is no fetch and no decryption on the request path.

Cache management

envless cache clear drops the cached ciphertext for the current product, project, and environment, and envless cache clear --all wipes the whole cache directory to force a fresh API fetch.

Offline fallback

envless whoami falls back to the cached profile with a warning when the API is unreachable, and the in-process runtime serves a fresh on-disk cache without a network call.

06 / 08

Versioning, history & audit

Every change is snapshotted, attributed, and reversible.

Variable versioning and history

Publish environment snapshots with version notes and view full change history, including who changed what and when. Add, update, and delete operations are all tracked.

Version rollback

Roll an environment back to a previous variable snapshot from the API or dashboard.

Per-variable change history

Track each variable's individual history with event types (created, updated, deleted, restored) and timestamps, with search and sorting in the dashboard.

Workspace activity trail

Every workspace action is recorded with actor information (user ID, name, email), event type, and payload, and is delivered in real time as a signed webhook. Per-variable history is queryable through the API and the dashboard; a workspace-wide query endpoint is not exposed yet.

07 / 08

Collaboration & access control

Granular roles, scoped keys, and team management across isolated workspaces.

Role-based access control

Built-in Owner, Admin, and Viewer roles plus custom roles with fine-grained control across 44 granular permissions covering every resource.

Scoped API keys

Named, rotatable keys (ev_sk_...) with per-resource scopes (workspace, projects, environments, variables, versions, members) at read, write, or none levels. Keys are stored as SHA-256 hashes with usage and last-used tracking.

Team invitations and member management

Invite members by email with role assignment, resend or revoke pending invites (3-day expiration), update roles, and remove members or self-leave, all tracked via webhooks.

Multi-tenant workspaces

Create, switch between, and leave isolated workspaces, each with its own settings, icon, plan, projects, and environments.

Project locking

Lock a project to prevent accidental edits; locked projects show a warning banner and disable edit operations.

08 / 08

API, webhooks & authentication

A complete programmatic surface with signed events and flexible sign-in.

REST API with full CRUD

HTTP API covering workspaces, projects, environments, variables, members, versions, and keys, with encrypted variable values, pagination, and sorting.

Bulk variable operations

Create or delete many variables in a single call, emitting bulk_created and bulk_deleted events.

Signed webhooks

Real-time JSON webhooks for 48 workspace event types, signed with HMAC-SHA256 per the Standard Webhooks spec, with at-least-once delivery, 5 exponential-backoff retries, per-endpoint secrets, secret rotation, and delivery history with manual redelivery.

CLI device-code authentication

Browser-based OAuth device flow for passwordless CLI login. Tokens are cached locally in ~/.envless/config.json (mode 0600) and can be revoked from the dashboard or via envless logout.

Multi-provider sign-in

Authenticate via email, Google OAuth, GitHub OAuth, or email one-time passwords (OTP) with expiration.

Billing and subscriptions

Plan tiers (Free, Dev, Team) with monthly or yearly billing via Polar, customer portal access, invoice history, and plan-based resource limits.

How Envless works

From login to running code in four commands, with no .env files committed, ever.

  1. 1

    Link your project

    Authenticate once with a browser device-code login, then bind the directory to a workspace, product, project, and environment. The resulting .envless file is safe to commit. 

    envless login
envless link
  2. 2

    Run anything with secrets injected

    Wrap any command and Envless injects decrypted variables straight into the process, so no .env file ever touches disk. 

    envless run -- npm run dev
  3. 3

    Import typed variables in code

    Generate an envless-env.d.ts declaration and read variables through the typed SDK, with IDE autocomplete and compile-time checks. The standard process.env is populated too. 

    envless types

import { env } from '@goenvless/env/server'
console.log(env.DATABASE_URL)
  4. 4

    Sync to .env when you need it

    Need a real file for a tool that expects one? Sync writes idempotent .env.<environment> files so unchanged output never triggers a dev-server reload. 

    envless sync

Built for your stack

Step-by-step guides for the frameworks, pipelines, and platforms you already ship with.

Use case

Next.js

End-to-end encrypted environment variables for your Next.js app, across local, preview, and production.

 Use case

CI/CD (GitHub Actions, GitLab CI)

Inject end-to-end encrypted secrets into GitHub Actions and GitLab CI from a single source of truth.

 Use case

Docker & Kubernetes

Keep encrypted secrets out of your images, Compose files, and manifests, and inject them into containers at runtime.

 Use case

Monorepos

One encrypted source of truth for every app, package, and environment in your repo.

 Use case

Serverless & Edge

End-to-end encrypted environment variables for Lambda, Cloud Functions, Workers, and any edge runtime, without committing a .env file.

 Use case

Startups & small teams

Stop passing .env files around Slack. Encrypt secrets on every device and sync them across your team and environments.

See how Envless compares

Side-by-side capability matrices against Doppler, HashiCorp Vault, Infisical, and more.

Compare
Get Started

Ship secrets, not chaos.

Start free today and discover why developers trust Envless for end-to-end encrypted, versioned secrets across every environment.