dotenvx/docs
dotenvx

.env.vault

.env.vault is an encrypted version of your .env file. Here is what it looks like.

.env.vault

#/-------------------.env.vault---------------------/
#/         cloud-agnostic vaulting standard         /
#/  [how it works](https://dotenvx.com/env-vault)   /
#/--------------------------------------------------/
# development
DOTENV_VAULT_DEVELOPMENT="V4NYVn0Pow6Uf2ez2mbHEzTrYURloHL6VDAFRLqnQBppA/OmHI5x5AXoxCMVor7wOg=="
# production
DOTENV_VAULT_PRODUCTION="YZkhtbh1IlzBgIamAAsG5nzGPfH6p8Zbuj9egXoziviVu/eYIyNjJWtIYyhiW/vHhFbqbsvo5+P9b27OC6ZC7qU="

Some quick takeaways:

  1. It uses the .env format
  2. It uses AES-256-GCM encryption
  3. DOTENV_VAULT_DEVELOPMENT contains encrypted contents of .env
  4. DOTENV_VAULT_PRODUCTION contains encrypted contents of .env.production

Generating

It's generated with dotenvx encrypt. Create your .env files like you usually do.

.env

# .env
HELLO="World"

.env.production

# .env.production
HELLO="production"

and then run dotenvx encrypt.

$ dotenvx encrypt

.env.vault

#/-------------------.env.vault---------------------/
#/         cloud-agnostic vaulting standard         /
#/  [how it works](https://dotenvx.com/env-vault)   /
#/--------------------------------------------------/
# development
DOTENV_VAULT_DEVELOPMENT="V4NYVn0Pow6Uf2ez2mbHEzTrYURloHL6VDAFRLqnQBppA/OmHI5x5AXoxCMVor7wOg=="
# production
DOTENV_VAULT_PRODUCTION="YZkhtbh1IlzBgIamAAsG5nzGPfH6p8Zbuj9egXoziviVu/eYIyNjJWtIYyhiW/vHhFbqbsvo5+P9b27OC6ZC7qU="

History

The .env.vault came out of development work on dotenv-vault – around early 2023.