The zero-knowledge secrets manager for teams that take security seriously.
The sharedenv client encrypts each secret on your machine with the vault's public key. Nothing leaves in plaintext.
Only signed ciphertext is synced. The server keeps bytes it has no way to read.
Your private key — never transmitted — decrypts secrets at the moment you use them, locally or in CI.
Your .env files per environment (dev, staging, prod), injected at runtime without ever touching the disk in plaintext.
$sharedenv run -- npm startEvery shared secret is ECIES-sealed (ECDH secp256k1 → AES-256-GCM). Any server-side tampering is detected instantly.
✕The server never sees your secrets in plaintext — only signed ciphertext.
secp256k1, AES-256-GCM, scrypt — proven primitives, verifiable line by line.
No secret written to disk. The child process receives the environment, decrypted in memory.
GitHub Actions, GitLab, Vercel… a machine token decrypts only what the job needs.
Change a secret and the whole team has it on their next run. Versioned and reversible.
Granular RBAC per vault: reader, writer, admin. The right access, for the right person.
Every read, write and share is timestamped in an append-only log — including secret reads.
Sealed team keys, members provisioned by a lead. Access follows the organization.
Revoke a member and the vault key rotates: re-sealed to the rest, secrets re-encrypted.
For personal use and trying things out.
For developers and small teams.
For organizations that share at scale.