OPEN SOURCE ENVIRONMENT ENCRYPTION
Keep your environments next to your code.
Encrypted in Git. Unlocked with your SSH key.
No account. No hosted vault. Just your keys.
Meet the dotenc skill & plugin.env.development.encENCRYPTED
A SMALL ADDITION TO YOUR TOOLKIT
Your editor, your terminal, your Git workflow.
dotenc takes care of the encryption.
Initialize the project with your existing Ed25519 or RSA key.
Use your editor. Save. Commit the encrypted file.
dotenc loads the variables into your app’s process.
# Set up your encrypted environments
$ dotenc init --name alice
# Add your personal variables
$ dotenc env edit personal.alice
# Start your app with its environment
$ dotenc dev npm start
FOR YOUR CODING AGENT
Give your agent the workflows to set up encrypted environments, manage access, and run commands with dotenc.
“Check this project
with dotenc doctor.”
dotenc doctor --jsonRead-only diagnosticsThe official plugin gives ChatGPT and Codex step-by-step guidance for setting up dotenc, managing access, and running commands with encrypted secrets.
Get the official ChatGPT plugin
Use the official dotenc skill in Codex CLI, Claude Code, Cursor, OpenCode, and other compatible coding agents. Get practical instructions for encrypted edits, access changes, and running commands, with guidance to keep plaintext out of chat and logs.
npx skills add dotenc/skills --skill dotencStart with dotenc installed, your repository, and an authorized SSH identity. Choose the skill or the plugin; the plugin already includes the skill.
AT HOME IN YOUR REPOSITORY
Code, configuration, and access.
One workflow you already know.
Ship an environment update in the same pull request as the code that needs it. Authorized developers can read changes locally with Git diff.
Explore the Git workflowgit diffAdd a teammate’s public key and grant access to the environments they need. Public keys and encrypted files stay in the repository.
Set up your teamalice.pub
bob.pubGive CI its own SSH identity and run commands with the right environment. Use the CLI, GitHub Actions, or the VS Code extension.
Connect your workflowdotenc run
-e test npm testEach environment is encrypted with AES-256-GCM. Its data key is encrypted separately for each authorized SSH public key. Reading the repository alone isn’t enough to decrypt it.
Repository writers and the machines running your code are trusted. After offboarding, rotate external credentials a former teammate could have known.
READY WHEN YOU ARE
Install dotenc. Open your repo.
Bring your SSH key.
For macOS, Linux, and Windows with Git Bash or MSYS2. The installer selects an available package manager.
curl -fsSL https://dotenc.org/install.sh | shInstall with Scoop on Windows.
scoop bucket add dotenc https://github.com/ivanfilhoz/scoop-dotenc
scoop install dotenc
Yours to use. Yours to improve.
Open source, under the MIT license.