Sync encrypted .env files through git. No server, no vendor, no shared secrets.

Each value is encrypted with age using the team's GitHub SSH public keys. The vault lives in git. Decryption happens automatically on git pull via a post-merge hook.

.env.local  ->  encrypt per-value  ->  .env.vault  ->  git push
                                                            |
                                                        git pull
                                                            |
                                              .env.local auto-updated

The encrypted file (.env.vault) is safe to commit. The team manifest (.envteam) stores public keys and SSH fingerprints. Your private key stays on your machine and never leaves it.

go install github.com/sanki92/envsync@latest

Build from source:

git clone https://github.com/sanki92/envsync.git
cd envsync && go build -o envsync .

Repo owner (first time):

envsync init
git add .env.vault .envteam .gitignore
git commit -m "chore: init envsync"
git push

Adding a teammate:

Teammate runs this and shares the age public key it prints:

envsync join

Admin then adds them:

envsync add alice --key age1...
git add .env.vault .envteam
git commit -m "chore: add alice"
git push

Teammate pulls and decrypts:

git pull
# post-merge hook runs envsync unlock automatically

Or manually: envsync unlock

# after editing .env.local
envsync lock
git add .env.vault
git commit -m "chore: update env"
git push

# teammates run git pull, their .env.local updates automatically

• Per-value encryption (not whole-file), so a leaked value doesn't expose others
• Multi-recipient: everyone decrypts independently with their own private key
• SSH key fingerprints are pinned in .envteam so key changes are caught
• NEXT_PUBLIC_*, REACT_APP_*, and VITE_* keys are left unencrypted by convention
• Nothing is sent to any server at any point

MIT