Documentation
Deprecated

.env.vault (DEPRECATED)

The .env.vault file has been DEPRECATED since May 2024. Please see updated encryption instructions.

.env.vault is an encrypted version of your .env file. Here is what it looks like.

.env.vault

#/-------------------.env.vault---------------------/
#/         cloud-agnostic vaulting standard         /
#/  [how it works](https://dotenvx.com/env-vault)   /
#/--------------------------------------------------/
# development
DOTENV_VAULT_DEVELOPMENT="V4NYVn0Pow6Uf2ez2mbHEzTrYURloHL6VDAFRLqnQBppA/OmHI5x5AXoxCMVor7wOg=="
# production
DOTENV_VAULT_PRODUCTION="YZkhtbh1IlzBgIamAAsG5nzGPfH6p8Zbuj9egXoziviVu/eYIyNjJWtIYyhiW/vHhFbqbsvo5+P9b27OC6ZC7qU="

Some quick takeaways:

  1. It uses the .env format
  2. It uses AES-256-GCM encryption
  3. DOTENV_VAULT_DEVELOPMENT contains encrypted contents of .env
  4. DOTENV_VAULT_PRODUCTION contains encrypted contents of .env.production

Generating

It's generated with dotenvx encrypt. Create your .env files like you usually do.

.env

# .env
HELLO="World"

.env.production

# .env.production
HELLO="production"

and then run dotenvx encrypt.

$ dotenvx encrypt

.env.vault

#/-------------------.env.vault---------------------/
#/         cloud-agnostic vaulting standard         /
#/  [how it works](https://dotenvx.com/env-vault)   /
#/--------------------------------------------------/
# development
DOTENV_VAULT_DEVELOPMENT="V4NYVn0Pow6Uf2ez2mbHEzTrYURloHL6VDAFRLqnQBppA/OmHI5x5AXoxCMVor7wOg=="
# production
DOTENV_VAULT_PRODUCTION="YZkhtbh1IlzBgIamAAsG5nzGPfH6p8Zbuj9egXoziviVu/eYIyNjJWtIYyhiW/vHhFbqbsvo5+P9b27OC6ZC7qU="

History

The .env.vault came out of development work on dotenv-vault – around early 2023.