Quickstart

Encrypt your first .env file.

Install

Install the Dotenvx CLI:

$ curl -sfS https://dotenvx.sh | sh

More installation options Alternative →

Encrypt

Start with a secret value in the .env file at your project root, like:

# .env
HELLO="Secret"

Encrypt it with a single command.

$ dotenvx encrypt
◈ encrypted .env (022 0D8) via .env.keys ⛉

The values become ciphertext and only your private key can unlock them.

# .env
DOTENV_PUBLIC_KEY="0220d830351410598be484f43a7b07097e09851f50426832876e8b5815a1752990"

HELLO="encrypted:BHLTACNJMr00nTG6yXpkCyWFKF/MY0ajN855tg3uVtKopTe2AGzSkQlcPd21pTOT3Ci8IKrdIg2TMZFoq1mDR6yb06QCRvqHXtpkZkAHYCEHfeWqqC8tMFovcYq5JS2uZSrC/qUGDA=="

CI & Production Alternative →

Commit

Commit your encrypted .env files with your code. It's safe. Now you can securely share secrets through git.

$ git add .env
$ git commit -m "encrypt .env"

Protect your commits Extra protection →

Ship

Use your secret in an app. Here's a Node.js example, but dotenvx works with any language.

// index.js
console.log(`Hello ${process.env.HELLO}`)

Run it with dotenvx:

$ dotenvx run -- node index.js
⟐ injected env (2) from .env (022 0D8) via .env.keys
Hello Secret

Dotenvx uses your private key to decrypt and inject your secrets just-in-time to your code.

Without Node.js Alternative →

Next steps

Your secrets now travel with your code. Follow a guide for your stack, or continue below.

Deploy with a private key Deploy →