Everything Envless does

An end-to-end encrypted secrets platform — from client-side encryption to typed SDKs, framework adapters, versioning, and granular access control.

What is Envless?

Envless is an end-to-end encrypted secrets manager that replaces .env files. Variables are encrypted on your machine with AES-256-GCM before upload — the server only ever stores ciphertext — then delivered to any runtime, framework, or CI pipeline through a typed SDK and CLI, with versioning, audit logs, and role-based access built in.

What sets Envless apart

True client-side end-to-end encryption with a zero-knowledge server: values are encrypted with AES-256-GCM and a PBKDF2-SHA256 key (600,000 iterations) on your machine, and the server only ever stores ciphertext.

A typed SDK that imports variables directly into application code with automatic coercion and generated TypeScript declarations (envless-env.d.ts) for IDE autocomplete and compile-time checking.

Built-in server/client variable splitting enforced through bundler plugins, ESLint rules, and runtime checks to keep secrets out of client bundles.

Native runtime delivery across Next.js, Vite, Node, Bun, and edge workers — no .env files required — while still populating the standard process.env for library compatibility.

On-disk encrypted caching with ~1ms cache hits, background revalidation, and an offline fallback that keeps builds and dev working when the API is unreachable.

Dev mode live reload that pushes dashboard variable changes to running dev servers with no restart or manual sync.

Open, verifiable webhooks following the Standard Webhooks spec with HMAC-SHA256 signatures, ~30 event types, exponential-backoff retries, secret rotation, and delivery history.

End-to-end encryption

Secrets are encrypted and decrypted on your machines — the server only ever holds ciphertext.

Client-side AES-256-GCM encryption

Variable values are encrypted with AES-256-GCM using a key derived from the workspace passphrase via PBKDF2-SHA256 (600,000 iterations) with a workspace-specific salt. Encryption and decryption happen only on client machines.

Zero-knowledge server storage

The server stores only ciphertext and never sees plaintext values or the workspace passphrase. Decryption requires the locally cached derived key.

Workspace passphrase management

Set, verify, rotate, and clear workspace encryption passphrases. The CLI verifies a passphrase against sample encrypted variables before caching the derived key, and supports rotating or forgetting keys from the dashboard.

Encryption SDK

The @goenvless/sdk package exposes encrypt() and decrypt() functions so you can encrypt values client-side before writing them through the API, with language-specific reference implementations.

Sync, runtime & environments

Get decrypted variables into any process, file, or runtime — without committing .env files.

Typed runtime import

Import environment variables directly in application code via the typed SDK, with automatic type coercion and no .env files on disk.

Sync to .env files

envless sync decrypts variables and writes .env.<environment-slug> files with proper bash escaping and a sync timestamp header. Writes are idempotent — unchanged files are skipped to avoid spurious dev-server reloads.

Process wrapping (envless run)

Inject decrypted variables into a single child process with no disk footprint and no code changes. Forwards SIGINT/SIGTERM to the child and returns its exit code, making it ideal for CI and one-off commands.

Multi-environment merging

Sync or run against multiple environments at once; later environments override earlier ones in merge order.

Real process.env compatibility

Envless populates the standard process.env alongside the typed env proxy, so libraries that read environment variables directly keep working.

Dev mode with live reload

Framework adapters open long-lived connections that push dashboard variable changes to running dev servers without a restart or manual sync.

Project linking (.envless file)

Bind a directory to a workspace, product, project, and one or more environments via interactive or flag-driven CLI. The resulting .envless JSON file is safe to commit and enables non-interactive sync and run.

Developer tooling & type safety

Schema-driven types, compile-time checks, and guardrails that keep secrets out of client bundles.

Typed variables with auto coercion

Define variable schemas in the dashboard with required/optional flags and defaults. The CLI generates type-safe imports and coerces values to strings, numbers, or booleans at runtime.

Type declaration generation

envless types generates an envless-env.d.ts declaration file from the dashboard schema, giving IDE autocomplete and compile-time type checking.

Server vs client variable splitting

Visibility flags separate server-only and client-safe variables, enforced through types, runtime checks, bundler plugins, and ESLint rules to prevent secrets from leaking into client bundles.

Test overrides

Override env values in tests with __override() and scoped 'using' declarations, without mutating global state.

Interactive CLI

Guided workspace, project, and environment selection with autocomplete and validation, plus help/version flags, browser-based login, and an optional background npm update check.

Framework & platform integrations

First-class adapters for the runtimes and deploy targets developers actually use.

Next.js integration

The withEnvless() build plugin handles client inlining and runtime loading with full support for the App Router, Pages Router, and Edge Runtime.

Vite plugin

A Vite plugin for SPAs, SvelteKit, Astro, and Remix-on-Vite with client variable inlining and dev-mode HMR.

Node.js and Bun support

Side-effect import (/register) or --import flag for Express, Fastify, Hono, and standalone scripts, plus native Bun support via a bunfig.toml preload hook with native crypto and faster cold starts.

Edge worker support

The envless build command wraps build tools for Cloudflare, Vercel, and Netlify edge runtimes, inlining variables at build time.

CI/CD and deploy targets

Works with GitHub Actions, GitLab CI, CircleCI, and generic runners via ENVLESS_TOKEN, plus Vercel, Docker build secrets, Kubernetes (including the ExternalSecret operator), Fly.io, Railway, and Render.

Caching & production performance

Fast, resilient access to secrets even under cold starts or network failure.

On-disk encrypted caching

Decrypted bundles are cached per workspace and environment, re-encrypted with the workspace key, and refreshed via background revalidation.

Cold start performance

Roughly 1ms cache hits on Node and sub-1ms on Bun, 50-150ms on a cache miss with fetch and decrypt, and 0ms on edge where variables are inlined at build time.

Cache management

envless cache clear wipes on-disk caches per workspace or globally to force a fresh API fetch.

Offline fallback

whoami and sync fall back to cached data with a warning when the API is unreachable.

Versioning, history & audit

Every change is snapshotted, attributed, and reversible.

Variable versioning and history

Publish environment snapshots with version notes and view full change history, including who changed what and when. Add, update, and delete operations are all tracked.

Version rollback

Roll an environment back to a previous variable snapshot from the API or dashboard.

Per-variable change history

Track each variable's individual history with event types (created, updated, deleted, restored) and timestamps, with search and sorting in the dashboard.

Workspace audit logs

All workspace activity is recorded with actor information (user ID, name, email), event type, and payload, queryable by type and timestamp.

Collaboration & access control

Granular roles, scoped keys, and team management across isolated workspaces.

Role-based access control

Built-in Owner, Admin, and Viewer roles plus custom roles with fine-grained control across 37+ granular permissions covering every resource.

Scoped API keys

Named, rotatable keys (ev_sk_...) with per-resource scopes (workspace, projects, environments, variables, versions, members) at read, write, or none levels. Keys are stored as SHA-256 hashes with usage and last-used tracking.

Team invitations and member management

Invite members by email with role assignment, resend or revoke pending invites (3-day expiration), update roles, and remove members or self-leave — all tracked via webhooks.

Multi-tenant workspaces

Create, switch between, and leave isolated workspaces, each with its own settings, icon, plan, projects, and environments.

Project locking

Lock a project to prevent accidental edits; locked projects show a warning banner and disable edit operations.

API, webhooks & authentication

A complete programmatic surface with signed events and flexible sign-in.

REST API with full CRUD

HTTP API covering workspaces, projects, environments, variables, members, versions, and keys, with encrypted variable values, pagination, and sorting.

Bulk variable operations

Create or delete many variables in a single call, emitting bulk_created and bulk_deleted events.

Signed webhooks

Real-time JSON webhooks for ~30 workspace event types, signed with HMAC-SHA256 per the Standard Webhooks spec, with at-least-once delivery, 5 exponential-backoff retries, per-endpoint secrets, secret rotation, and delivery history with manual redelivery.

CLI device-code authentication

Browser-based OAuth device flow for passwordless CLI login. Tokens are cached locally in ~/.envless/config.json (mode 0600) and can be revoked from the dashboard or via envless logout.

Multi-provider sign-in

Authenticate via email, Google OAuth, GitHub OAuth, or email one-time passwords (OTP) with rate limiting and expiration.

Billing and subscriptions

Plan tiers (Free, Dev, Team) with monthly or yearly billing via Polar, customer portal access, invoice history, and plan-based resource limits.

How Envless works

From login to running code in four commands — no .env files committed, ever.

1
Link your project

Authenticate once with a browser device-code login, then bind the directory to a workspace, product, project, and environment. The resulting .envless file is safe to commit.
```
envless login
envless link
```
2
Run anything with secrets injected

Wrap any command and Envless injects decrypted variables straight into the process — no .env file ever touches disk.
```
envless run -- npm run dev
```
3
Import typed variables in code

Generate an envless-env.d.ts declaration and read variables through the typed SDK, with IDE autocomplete and compile-time checks. The standard process.env is populated too.
```
envless types

import { env } from '@goenvless/sdk'
console.log(env.DATABASE_URL)
```
4
Sync to .env when you need it

Need a real file for a tool that expects one? Sync writes idempotent .env.<environment> files so unchanged output never triggers a dev-server reload.
```
envless sync
```

Built for your stack

Step-by-step guides for the frameworks, pipelines, and platforms you already ship with.

Use case

See how Envless compares

Side-by-side capability matrices against Doppler, HashiCorp Vault, Infisical, and more.

Compare

Get Started

Ship secrets, not chaos.

Start free today and discover why developers trust Envless for end-to-end encrypted, versioned secrets across every environment.