Secrets management glossary
Clear definitions for the concepts behind environment variables, encryption, and secure developer workflows.
.env file
A .env file is a plain-text file that stores configuration as KEY=VALUE pairs, one per line. Applications read it at startup to load environment variables such as database URLs, API keys, and feature flags. It separates config from code, but the values are unencrypted, so a .env file should never be committed to version control.
DefinitionSecrets management
Secrets management is the practice of securely storing, distributing, rotating, and auditing sensitive credentials such as API keys, database passwords, tokens, and certificates. It centralizes secrets so applications and teams retrieve them at runtime instead of hardcoding them, and it enforces access controls, encryption, and audit logging across every environment from local development to production.
DefinitionZero-knowledge encryption
Zero-knowledge encryption is an architecture where the service provider never has access to your unencrypted data or the keys that protect it. Data is encrypted and decrypted only on the user's device, so the server stores ciphertext it cannot read. Even the provider, or an attacker who breaches it, cannot recover the plaintext.
DefinitionEnd-to-end encryption
End-to-end encryption (E2EE) is a method where data is encrypted on the sender's device and decrypted only by the intended recipient, with no readable copy at any point in between. Intermediaries that relay or store the data, including the service provider and the network, see only ciphertext and cannot access the plaintext.
DefinitionSecret sprawl
Secret sprawl is the uncontrolled scattering of credentials such as API keys, passwords, and tokens across code, config files, CI pipelines, chat messages, and developer laptops. As copies multiply without central tracking, organizations lose visibility into where secrets live, who can access them, and which need rotating, widening the attack surface.
DefinitionSecret rotation
Secret rotation is the practice of regularly replacing credentials such as API keys, passwords, and tokens with new values, then revoking the old ones. It limits the window an exposed secret stays useful, contains the damage from leaks, and is often required by compliance frameworks. Rotation can be scheduled at intervals or triggered by a suspected compromise.
DefinitionTwelve-factor config
Twelve-factor config is a principle from the Twelve-Factor App methodology that says configuration should be stored in the environment, not in code. Anything that varies between deploys, such as credentials and resource handles, belongs in environment variables. This keeps a single codebase portable across environments and prevents secrets from being committed to version control.
Ship secrets, not chaos.
Start free today and discover why developers trust Envless for end-to-end encrypted, versioned secrets across every environment.