Encrypt environment variables directly in your Git repository. No external services, no vendor lock-in, no extra key management.
curl -fsSL https://dotenc.org/install.sh | sh
Everything you need, nothing you don't.
Battle-tested authenticated encryption for your secrets.
Uses your existing SSH keys. No extra key management needed.
Run commands with decrypted env vars injected automatically.
Edit secrets in your preferred editor. Re-encrypted on save.
Development, staging, production. As many as you need.
Each developer gets their own encrypted env file.
Data keys are automatically rotated on every edit.
Supports both key types. Use whatever you already have.
Most secret managers rely on third-party services and web dashboards. dotenc keeps everything in your repo.
Your secrets live in your repository. Never tied to a third-party provider.
All encryption happens locally. Private keys never leave your machine.
You already have SSH keys. dotenc uses them directly.
Onboard or revoke team members with a single command.
Every grant and revoke is tracked in your Git history.
Env updates live in the same PR as your feature code.
Simple, transparent, secure.
dotenc scans ~/.ssh/ for your Ed25519 or RSA keys.
Your public key is derived and stored in .dotenc/.
A unique 256-bit data key is generated for each environment.
The data key is encrypted per-user with each authorized public key.
Environment variables are encrypted with AES-256-GCM.
Encrypted .env.*.enc files are committed to your repository.
When running commands, variables are decrypted using your SSH private key. Keys never leave ~/.ssh/.
Pick your favorite method.
Universal install (macOS / Linux)
curl -fsSL https://dotenc.org/install.sh | sh
macOS / Linux
Onboard and offboard team members with simple commands. Git tracks every change.
Give your CI runners their own identity. Same workflow as local development.
GitHub Actions example:
jobs: test: runs-on: ubuntu-latest steps: - uses: actions/checkout@v6 - uses: actions/setup-node@v6 with: node-version: 24 - run: npm ci - run: npm install -g @dotenc/cli - run: dotenc run -e test npm test env: DOTENC_PRIVATE_KEY: ${{ secrets.DOTENC_PRIVATE_KEY }}
dotenc is a Git-native encryption layer. It doesn't replace centralized secret managers — it serves a different operational model.
| Capability | dotenc | SOPS | Vault | Doppler |
|---|---|---|---|---|
| Git-native encrypted files | ✔ | ✔ | ✘ | ✘ |
| Uses existing SSH identity | ✔ | ✘ | ✘ | ✘ |
| No external service required | ✔ | ✔ | ✘ | ✘ |
| Envs versioned with code | ✔ | ✔ | ✘ | ✘ |
| Centralized runtime API | ✘ | ✘ | ✔ | ✔ |
| Dynamic / short-lived secrets | ✘ | ✘ | ✔ | ✘ |
| Built-in org policy engine | ✘ | ✘ | ✔ | ✔ |
| Requires running infrastructure | ✘ | ✘ | ✔ | ✘ |