Encryption

# .env
STRIPE_API_KEY="encrypted:dfjkdfjd"
TWILIO_API_KEY="encrypted:a1b2c3d4"

1. Encrypt

Encrypt your .env file.

$ dotenvx encrypt

2. Encrypted .env

Your public encryption key DOTENV_PUBLIC_KEY lands at the top of .env so anyone on your team can encrypt secrets.

# .env
DOTENV_PUBLIC_KEY="037cfbfc90234cfdab7eb54050566293789efaa1a35dc420749662db400dc9c4b2"

HELLO="encrypted:BAZb6wDPFaFeFzq8Ut48oiNFSPtYvJmv4AwVDFVcNKiIcGxrxuRIFGWxZ3xVjxOgOo6w65bWFTpAfbatSz52+VvwDYZ3nFUO828nzovH5ZhsIoxPuPb7K0ZphmNynR7Hxci4a+fB"

3. Private key

Your private decryption key lives in .env.keys. Do not commit it — only holders of this key can decrypt secrets.

# .env.keys
DOTENV_PRIVATE_KEY="81dac4d2c42e67a2c6542d3b943a4674a05c4be5e7e5a40a689be7a3bd49a07e"

We recommend Armor to move the private key off your device and harden it.

4. Run locally

In development, dotenvx run reads .env.keys to decrypt and inject secrets at runtime.

$ dotenvx run -- node index.js
⟐ injected env (2) from .env
Hello World

5. Run in production

Do not ship .env.keys. Set DOTENV_PRIVATE_KEY in the environment instead — dotenvx decrypts and injects at runtime.

$ DOTENV_PRIVATE_KEY="…" dotenvx run -- node index.js

No more scattering secrets across third-party platforms where they could leak.

Lock password-protect your private key
Native store the key in your OS keychain
Armor managed private keys