dotenvx.com

Dotenvx is a tool from the creator of dotenv that encrypts the values in your .env files so you can commit them to git and ship them alongside your code. It solves the long-standing tension between two things developers want: keeping secrets out of source control, and getting secrets to wherever the code runs. With Dotenvx, the .env file stays in your repo but its values are ciphertext, and only a private key held on your infrastructure can unlock them at runtime.

The problem it addresses

A normal .env file is plaintext. That creates a delivery problem:

• Don't commit it, and you need a separate secrets pipeline — a vault, a CI secret store, or manual copying — to get values onto every machine.
• Do commit it, and your secrets are readable by anyone with repo access, now and in history.

Dotenvx's argument is that git is already the best mechanism for distributing digital goods, so secrets should travel the same way code does — but encrypted, so the file is safe to commit. The decryption key lives in the environment, not the repo, which keeps the twelve-factor separation between config and code.

How it works

The workflow has three steps, each a single command:

1. Encrypt — dotenvx encrypt turns the values in .env into ciphertext. Only your private key can decrypt them.
2. Commit — git add .env and commit as usual. The encrypted file is safe to share through git.
3. Ship — dotenvx run -- node index.js decrypts and injects the variables just-in-time into your process.

The expected result at step 3 is that your app sees the same environment variables it always did, without any plaintext secret ever sitting in the repo.

The design behind it

Dotenvx is built from three primitives the site names explicitly:

The key operational consequence: you set one private key on your infrastructure. There's no async coordination of secrets across services and no central secrets server that can go down — the encrypted values are always present with the code, and the key is always present in the environment.

When Dotenvx fits — and when it may not

Dotenvx is a good fit if you want secrets to live in the same repo as your code, you deploy to infrastructure where you can set an environment variable (the private key), and you want to avoid running a separate secrets service.

It may be less suitable if your organization already mandates a centralized secrets manager, or if your deployment targets don't let you inject a private key into the runtime environment. The site does not describe pricing or access requirements, so check the pricing page before assuming cost or availability.

The site also includes field notes from John Zila (Cofounder/Chief Architect at Watt, formerly Head of Security at Zoom) and Dhravya Shah (CEO at Supermemory) describing their use of the tool; those are endorsements rather than independent benchmarks, so treat them as context rather than proof of fit for your setup.

The takeaway

Dotenvx doesn't replace .env — it makes .env safe to commit. If your pain point is "how do secrets get to the code without a separate pipeline or a plaintext file in git," the encrypt-commit-run loop is the whole answer, and the single private key is the only thing you need to manage on the infrastructure side.

Dotenvx combines three existing primitives instead of inventing a new secrets system: Git distributes the encrypted .env file alongside your code, .env remains the standard way apps load environment variables, and secp256k1 (the elliptic curve Bitcoin has used for years) makes the values unreadable without your private key. The practical result is that you commit ciphertext, set one private key on your infrastructure, and Dotenvx decrypts and injects the values just-in-time when the app runs. This design fits teams that already deploy code through Git and want secrets to travel the same path without a separate secrets service.

The three primitives and what each one does

The design page on dotenvx.com describes the system as built entirely from primitives developers already understand and infrastructure they already use. Each piece has a narrow job:

The key separation is deliberate: encryption lets the values sit next to the code in Git, while the decryption key stays on the environment (infrastructure) rather than in the repository. That keeps the twelve-factor principle of separating config from code intact.

Why Git instead of a dedicated secrets service

The stated reasoning is that code already travels through Git, so secrets should use the same channel rather than a purpose-built delivery mechanism. The design page puts it directly: why invent an inferior secrets delivery mechanism when a world-class one is already at hand. In practice this means:

• One distribution path. git add .env and git commit put the encrypted file in the same history as the code that reads it.
• Sharing through Git. Because the committed values are ciphertext, secrets can be shared through the repository safely.
• No parallel system to operate. There is no separate secrets store to keep in sync with deployments.

This is a design argument, not a guarantee for every team. If your organization already runs a secrets manager with audit logging and rotation workflows, the trade-off is between that operational tooling and the simplicity of shipping secrets with code.

Why .env and secp256k1 specifically

.env was chosen because it is the open standard for injecting environment variables at runtime — the core primitive all secrets end up in. Keeping that format means existing apps and frameworks load variables the same way they always have; only the file's contents change from plaintext to ciphertext.

For encryption, the requirements were a proven, simple asymmetric standard with small keys. secp256k1 met all three: it is asymmetric (so the private key can stay off the code path), its keys are small, and it has a long track record through Bitcoin. The page frames cryptography as an opinionated choice made so developers don't have to pick an algorithm themselves.

What the single private key changes about key management

The design's stated payoff is operational: all of this works by setting a single private key on your infrastructure. The page contrasts that with "risky async coordination of secrets" and "centralized downtime risk," and says your secrets are always just there with your code.

Concretely, the workflow is:

1. Encrypt: dotenvx encrypt turns the values in .env into ciphertext.
2. Commit: git add .env and git commit -m "encrypt .env" store the encrypted file with your code.
3. Run: dotenvx run -- node index.js decrypts with the private key and injects the variables — the page's example shows injected env (2) from .env.

The thing to verify before adopting this: the single private key becomes the one thing that must be present and protected on every environment that runs the app. The design removes coordination between a secrets service and your deployments, but it concentrates trust in that key. How you store and distribute it is your responsibility, and the page does not describe a key-rotation or recovery process.

When this design fits

Choose the Git + .env + secp256k1 approach when your deployments already flow through Git, your apps read environment variables from .env, and you want secrets to ship with code without running a separate secrets service. Look elsewhere, or plan additional controls, if you need centralized audit trails, automated rotation, or per-secret access policies — none of which the design page claims to provide.

Dotenvx lets you commit an encrypted .env file to git, so secrets travel with the code but stay unreadable without a separate private key. The traditional alternative — keeping plaintext .env files out of version control and distributing secrets through another channel — still works, but it leaves you coordinating secrets outside the repository. Choose Dotenvx when you want secrets versioned and shared through git; stay with untracked .env files when you already have a trusted out-of-band secret store and don't want encryption keys in your delivery path.

The two approaches side by side

What actually changes when you commit ciphertext

The core trade is moving secret distribution onto git while keeping the decryption key separate. Dotenvx encrypts the values in .env so they become ciphertext, and only your private key can unlock them. You then commit the encrypted file with your code. At runtime, dotenvx run uses the private key to decrypt and inject secrets just-in-time.

The design rests on three primitives, per the site: git as the delivery mechanism, .env as the open standard for loading secrets into code, and secp256k1 as the asymmetric encryption standard (the same curve Bitcoin has used). The site frames the key separation as preserving twelve-factor config: the decryption key lives in the environment, not in the code, so secrets can travel with code without becoming part of it.

How to try the encrypted-commit workflow

1. Encrypt. Run dotenvx encrypt. Expected result: the values in .env become ciphertext, per the site's example output ◈ encrypted (.env).
2. Commit. Run git add .env and git commit -m "encrypt .env". Expected result: the encrypted file is tracked in the repository.
3. Ship and run. Run dotenvx run -- node index.js. Expected result: the private key decrypts the values and injects them into your process — the site's example shows ⟐ injected env (2) from .env.

Verification: after step 1, open .env and confirm the values are unreadable ciphertext. After step 3, confirm your app receives the expected variables.

Common sticking point: the workflow depends on the private key being available wherever the app runs. The site describes setting a single private key on your infrastructure as the mechanism that replaces async secret coordination and centralized secret services. If the key isn't present at runtime, decryption and injection can't happen.

Where each approach fits

• Pick committed encrypted .env files when you want secrets to have the same distribution and history as code, and you're willing to manage one private key on your infrastructure. The site's stated benefit is that secrets are "always just there with your code," removing out-of-band coordination and centralized downtime risk.
• Keep .env untracked when your team already relies on a separate secret manager, or when adding an encryption key to the deployment path is a bigger change than you want to make. The traditional approach needs no key management, but secrets stay outside version history and must be shared by other means.

The site also includes field notes from John Zila (cofounder/chief architect at Watt, described as recently Head of Security at Zoom) and Dhravya Shah (CEO at Supermemory) on why they use Dotenvx; the excerpts don't include their detailed reasoning, so treat those as pointers rather than evidence.

Run dotenvx encrypt to turn your .env values into ciphertext, commit the encrypted file with git, then start your app with dotenvx run -- <your command> so the secrets are decrypted and injected at runtime. This works for any language or framework, and the only thing your infrastructure needs is the private key — not the plaintext secrets.

Before You Start

You need:

• A project with a .env file containing the values you want to protect.
• Dotenvx installed (see the Quickstart on dotenvx.com).
• Git initialized in the project, since the encrypted file is meant to travel with your code.
• A way to set one private key in your runtime environment. Dotenvx's design is built around a single private key held on your infrastructure.

Step 1: Encrypt the .env File

$ dotenvx encrypt
◈ encrypted (.env)

Input: your existing plaintext .env. Action: dotenvx encrypt converts the values into ciphertext. Expected result: the .env file now holds ciphertext, and only your private key can unlock the values.

After this step, the file is safe to share through git — the values are unreadable without the key.

Step 2: Commit the Encrypted File

$ git add .env
$ git commit -m "encrypt .env"

Input: the encrypted .env. Action: stage and commit it alongside your code. Expected result: the encrypted secrets travel with the repository. Anyone with the repo gets the ciphertext; only holders of the private key can decrypt it.

This is the core shift: instead of coordinating secrets out-of-band, you deliver them the same way you deliver code.

Step 3: Run Your App

$ dotenvx run -- node index.js
⟐ injected env (2) from .env

Input: the encrypted .env plus your private key available to the process. Action: dotenvx run -- <command> decrypts the values and injects them as environment variables just-in-time. Expected result: your app starts with the secrets available as normal environment variables. The injected env (2) line confirms how many variables were loaded.

Swap node index.js for whatever starts your app — the pattern is the same for any language or framework.

How the Pieces Fit

Dotenvx is built from three primitives the site names directly:

The design keeps the decryption key separate from the code, following twelve-factor config: secrets travel with code without becoming part of it. Because only one private key needs to be set on your infrastructure, there's no async coordination of secrets and no centralized service that can go down and take your secret delivery with it.

Common Snags

• App can't decrypt values. The private key isn't available to the dotenvx run process. Confirm the key is set in the environment where the command executes.
• You committed plaintext by mistake. Run dotenvx encrypt first, then commit. The commit step is only safe after encryption.
• You expected a secrets server. Dotenvx deliberately avoids one; delivery happens through git and decryption happens locally at runtime.

When This Approach Fits

Choose Dotenvx if you want secrets to ship with your repository and be decrypted at runtime from a single private key, with no central secrets service in the path. If your workflow depends on a hosted secrets manager with rotation and access auditing, that's a different model — Dotenvx's stated design is to reuse git, .env, and secp256k1 rather than build a new delivery mechanism.

The Dotenvx website (dotenvx.com) is the entry point for all three: the homepage carries Install and Quickstart links, the Usage section shows the core encrypt/commit/run commands, and a Pricing link points to https://dotenvx.com/pricing for plan details. Use the homepage if you want to evaluate the tool and get running; use the pricing page only if you need plan specifics, since the homepage itself doesn't state prices.

Installation and Quickstart

The homepage presents two adjacent entry points, Install and Quickstart, aimed at getting Dotenvx onto your machine and running a first encrypted .env. The site describes Dotenvx as "a secure dotenv–from the creator of dotenv," so the quickstart assumes you already have a .env file and a project that loads environment variables.

What the page does not spell out is the exact install command or supported package managers; those details sit behind the Install link rather than on the homepage. Expect the quickstart to walk you from an existing .env to an encrypted one and then to running your app with the decrypted values injected.

The Three Commands You'll Actually Use

The Usage section is the most concrete part of the site. It reduces the workflow to three commands:

The run example reports injected env (2) from .env, which tells you how many variables were loaded — a quick way to confirm the step worked. The same pattern applies to other runtimes: swap node index.js for your framework's start command.

What the Design Section Tells You Before You Commit

Before adopting the commit-your-.env workflow, the Design section explains the tradeoff you're accepting. Dotenvx is built on three primitives: Git for distribution, .env as the open standard for loading secrets, and secp256k1 (the curve behind Bitcoin) for encryption. The stated goal is to let secrets travel with code "without becoming part of the code" — the decryption key stays on your infrastructure, separate from the repository.

The practical consequence: anyone with repository access can read the ciphertext but not the values, and your deployment needs exactly one private key set in the environment. That single-key model is presented as the alternative to async secret coordination and centralized secret stores, so weigh it against your team's key-rotation and access-control needs.

Pricing

A Pricing link in the site navigation leads to https://dotenvx.com/pricing. The homepage excerpt does not include plan names, prices, or whether a free tier exists, so treat the pricing page as the only authoritative source and check it directly rather than inferring cost from the open-source framing.

Suggested Path

1. Open dotenvx.com and follow Install for your platform.
2. Run the Quickstart against a test .env in a scratch repository — not production secrets — to see the encrypt/commit/run cycle end to end.
3. Confirm injection with the injected env (N) output from dotenvx run.
4. Visit the Pricing page if you need plan details before rolling it out beyond a trial.