.env (encrypted)

Format

An encrypted .env file keeps the same KEY=value format. Variable names stay readable; secret values become ciphertext.

# .env
DOTENV_PUBLIC_KEY="03a435b2dc61a408876ba5f2afa0a6ab5c827e2167228c3b8c9d1a8253ccd62514"

HELLO="encrypted:BDcJe0ksryTFcP9vEGH/DRgvxIFCFym1MoPwA5MhnTPKhSxinnRAQYAUMalR83my7uyj5LGksmTL2pjOBwWWdZ5utqA6c5CPrs84AF+Kq4imBk1CjzAjN/cnYqMBStbpc+18SPQlJg=="

The filename stays .env. The encrypted: prefix tells dotenvx which values need decryption. This example shows the format; encrypt your own file to generate its matching key pair.

Keys

Environment variable names follow the same rules as a plain .env file. Encryption does not hide names such as DATABASE_URL or API_KEY.

Values

Each encrypted value starts with encrypted:, followed by the ciphertext. Let dotenvx generate the value rather than adding the prefix yourself.

HELLO="encrypted:BDcJe0ksryTFcP9vEGH/DRgvxIFCFym1MoPwA5MhnTPKhSxinnRAQYAUMalR83my7uyj5LGksmTL2pjOBwWWdZ5utqA6c5CPrs84AF+Kq4imBk1CjzAjN/cnYqMBStbpc+18SPQlJg=="

A file can contain both encrypted and plaintext values. Any value left in plaintext remains readable.

Public and private keys

Dotenvx uses public-key encryption with a secp256k1 key pair.

DOTENV_PUBLIC_KEY belongs in the encrypted .env file. It encrypts new values, but cannot decrypt them.

DOTENV_PRIVATE_KEY decrypts the values. Keep it separate from the encrypted file. For local file-based storage, dotenvx saves it in .env.keys. Do not commit that file.

Comments

Comments and blank lines still work. Comments are not encrypted, so keep secrets in values rather than comments.

# Database credentials
HELLO="encrypted:BDcJe0ksryTFcP9vEGH/DRgvxIFCFym1MoPwA5MhnTPKhSxinnRAQYAUMalR83my7uyj5LGksmTL2pjOBwWWdZ5utqA6c5CPrs84AF+Kq4imBk1CjzAjN/cnYqMBStbpc+18SPQlJg=="

Encrypt

Start with a plaintext .env file. Install dotenvx if needed.

HELLO="Secret"

Run this in the directory containing the file:

dotenvx encrypt

Dotenvx replaces the values with ciphertext and adds the public key.

Update

Set a new value without decrypting the whole file:

dotenvx set HELLO "Updated secret"

Dotenvx encrypts the new value using the file's public key.

Commit

Commit the encrypted .env file with your code. Check that any values left in plaintext are suitable for the repository.

git add -f .env
git commit -m "encrypt .env"

Keep .env.keys in .gitignore. Share the private key separately with the people or systems that need to run the app.

Run

Your application reads normal environment variables. For example, in index.js:

console.log(process.env.HELLO)

dotenvx run -- node index.js

With the matching private key available, the app prints Secret. Decryption happens at runtime; the .env file stays encrypted.

Locally, dotenvx can read the private key from .env.keys. In deployment, supply DOTENV_PRIVATE_KEY through your platform's secret settings.

Multiple environments

Use a separate encrypted file and key pair for each environment.

dotenvx encrypt -f .env.production

.env.production uses DOTENV_PUBLIC_KEY_PRODUCTION and DOTENV_PRIVATE_KEY_PRODUCTION.

dotenvx run -f .env.production -- node index.js