Take back control of your secrets.
Create a vault, invite your team, and never commit an API key by accident again.
Create a vault, invite your team, and never commit an API key by accident again.
sharedenv encrypts your environment variables, passwords and API keys on your machine, with your public key. Our servers only ever store unreadable ciphertext — no one but you can decrypt it.
Public-key encryption does all the work. You share your public key, you keep your private key. sharedenv never sees the latter.
The sharedenv client encrypts each secret on your machine with the vault's public key. Nothing leaves in plaintext.
Only signed ciphertext is synced. The server keeps bytes it has no way to read.
Your private key — never transmitted — decrypts secrets at the moment you use them, locally or in CI.
Your .env files per environment (dev, staging, prod), injected at runtime without ever touching the disk in plaintext.
sharedenv run -- npm startTeam credentials, machine access, service accounts — shared by encrypted reference, never over a message.
sharedenv share db-admin --teamStripe, AWS, OpenAI tokens… with rotation, expiry and a log of every access. Revocable in one click.
sharedenv rotate STRIPE_SECRET_KEYSSH private keys, TLS certificates, PEM files. Stored as encrypted files, mounted on demand.
sharedenv mount ./certs/prod.pemThe architecture makes a server-side leak impossible: without your private key, the vault is just a pile of random bytes. It's a mathematical guarantee, not a promise.
Generated and kept on your device, derived from your password with scrypt. Never sent, never recoverable by sharedenv.
Every shared secret is ECIES-sealed (ECDH secp256k1 → AES-256-GCM). Any server-side tampering is detected instantly.
secp256k1, AES-256-GCM, scrypt — proven primitives, verifiable line by line.
✕ The server never sees your secrets in plaintext — only signed ciphertext.
sharedenv plugs into where you already work: terminal, CI/CD, containers. Secrets are injected into memory, for the length of a single run.
No secret written to disk. The child process receives the environment, decrypted in memory.
GitHub Actions, GitLab, Vercel… a machine token decrypts only what the job needs.
Change a secret and the whole team has it on their next run. Versioned and reversible.
Granular RBAC per vault: reader, writer, admin. The right access, for the right person.
Every read, write and share is timestamped and signed. Exportable for your audits.
Sealed team keys, members provisioned by a lead. Access follows the organization.
Revoke a member and the vault key rotates: re-sealed to the rest, secrets re-encrypted.