Encryption

Add encryption to your `.env` files with a single command. Use `dotenvx encrypt`.

dotenvx encrypt

$ touch .env
$ echo "console.log('Hello ' + process.env.HELLO)" > index.js

$ dotenvx encrypt

Your .env file will now look something like this.

.env

#/-------------------[DOTENV_PUBLIC_KEY]--------------------/
#/            public-key encryption for .env files          /
#/       [how it works](https://dotenvx.com/encryption)     /
#/----------------------------------------------------------/
DOTENV_PUBLIC_KEY="037cfbfc90234cfdab7eb54050566293789efaa1a35dc420749662db400dc9c4b2"

# .env
HELLO="encrypted:BAZb6wDPFaFeFzq8Ut48oiNFSPtYvJmv4AwVDFVcNKiIcGxrxuRIFGWxZ3xVjxOgOo6w65bWFTpAfbatSz52+VvwDYZ3nFUO828nzovH5ZhsIoxPuPb7K0ZphmNynR7Hxci4a+fB"

The public encryption key DOTENV_PUBLIC_KEY is placed at the top of your .env file. This allows anyone on your team to encrypt secrets.

The private decryption key DOTENV_PRIVATE_KEY is placed in your .env.keys file. Only those holding this key can decrypt secrets.

DOTENV_PRIVATE_KEY

Locate your DOTENV_PRIVATE_KEY in .env.keys

cat .env.keys

$ cat .env.keys

.env.keys

#/------------------!DOTENV_PRIVATE_KEYS!-------------------/
#/ private decryption keys. DO NOT commit to source control /
#/     [how it works](https://dotenvx.com/encryption)       /
#/----------------------------------------------------------/

# .env
DOTENV_PRIVATE_KEY="81dac4d2c42e67a2c6542d3b943a4674a05c4be5e7e5a40a689be7a3bd49a07e"

Run

In development the dotenvx run command reads from your .env.keys file to decrypt and inject your secrets at runtime.

development

$ dotenvx run -- node index.js
[[email protected]] injecting env (2) from .env
Hello World

In production, do NOT include your .env.keys file. Instead, set your DOTENV_PRIVATE_KEY ahead of your dotenvx run command and it will smartly run the associated .env file - decrypting and injecting your secrets at runtime.

production

$ dotenvx set HELLO production -f .env.production
$ DOTENV_PRIVATE_KEY_PRODUCTION="4a650a4159790e2341a388ebcd7526036fd33cc6240667c7cd940cde7b11cfaf" dotenvx run -- node index.js
[[email protected]] injecting env (2) from .env.production
Hello production
> :-D

No more scattering your secrets across multiple third-parties platforms where they could leak!