Envault

A local-first .env manager for teams.

Envault stores environment variables in projects, keeps version history, shows diffs between snapshots, and encrypts secrets at rest with AES-256-GCM.

Why I built it

Working with shared .env files gets messy fast. Secrets get copied around, overwritten, lost in chats, or changed without anyone knowing what happened.

I built Envault to explore what a small but useful developer tool could look like if it treated .env files like something worth versioning and protecting.

What it does

• Stores variables by project and environment
• Encrypts values at rest with AES-256-GCM
• Imports and exports .env files
• Creates snapshots before changes
• Shows diffs between versions
• Restores older snapshots
• Keeps everything local in SQLite

Tech stack

• Next.js 14
• TypeScript
• Tailwind CSS + HeroUI
• SQLite via better-sqlite3
• Node crypto
• Vitest

Run locally

git clone https://github.com/IsaacOdeimor/envault.git
cd envault
npm install
npm run dev

Open http://localhost:3000.

To use your own encryption secret:

ENVAULT_SECRET="your-strong-secret-key" npm run dev

Changing ENVAULT_SECRET means old encrypted values can no longer be decrypted, so rotate carefully.

Project structure

src/
├── app/
│   ├── api/           # API routes
│   └── projects/[id]/ # Project detail UI
├── components/        # UI components
├── lib/
│   ├── crypto.ts      # encryption + .env parser
│   ├── db.ts          # SQLite setup
│   └── queries.ts     # database operations
└── tests/             # Vitest tests

Tests

npm test

The tests cover encryption, .env parsing, project CRUD, variable management, version snapshots, diffs, and restore.

Notes

This was built as a practical developer-tooling project. The main pieces worth reviewing are the encryption flow, snapshot/diff logic, local database design, and the project/environment UX.