Envie is a desktop vault for the .env files you already have — grouped by project and environment, encrypted on your device. Import a .env, edit and copy secrets, diff dev against prod, and export when you need it. No cloud, no account, no subscription.
Free download for macOS 12+ (Apple Silicon). Intel Mac? · Available on the Microsoft Store.
Every secret is protected by your master password with AES-256-GCM encryption. Nothing is stored in plain text, and nothing leaves your device.
Mirror how your .env files actually work — group secrets by project, then split them into development, staging, and production.
Pull an existing .env into any environment in seconds, and export any environment back to a clean .env file whenever you need one.
Diff two environments side by side and instantly see which keys are missing, changed, or extra — no more prod outages from a forgotten variable.
Find any key across every project and environment as you type — masked in the results, one click to copy.
Values stay hidden until you choose to reveal them, and copying never puts a secret on screen. Safe to use with someone watching.
Everything you need to get started.
Biometric unlock, shareable .env.example export, and environment duplication.
Purchase Pro anytime from inside the app.
| Tool | Where secrets live | Account required | Encryption | Price |
|---|---|---|---|---|
| Doppler | Cloud platform, team sync | Required | Encrypted in the vendor cloud | Subscription |
| dotenv-vault | Cloud sync | Required | Encrypted in the vendor cloud | Free + paid |
| Infisical | Server / cloud | Required | Encrypted on the server | Free + paid |
| Plain .env files | Plain text on disk | None | None — readable by anything | Free (and risky) |
| Envie | Encrypted vault on your device | None | AES-256-GCM under your master password | Free |
Doppler, dotenv-vault, and Infisical are built for teams: an account, a server or cloud service, and usually a subscription. If you're a solo developer who just wants your own .env files kept safe on your own machine, that's a lot of overhead for a job a desktop app can do. Envie doesn't do team sync or runtime secret injection — what it does is keep your .env files organized and encrypted locally, with no account and nothing in the cloud.
A .env file is plain text by default — one accidental commit and your database URL and API keys are exposed. Envie stores every value in one encrypted local vault on your Mac or PC, protected by your master password with AES-256-GCM. Nothing sits in plain text, and values stay masked until you choose to reveal them.
Pull an existing .env into any environment in seconds, then group secrets by project and split them into development, staging, and production. Diff two environments side by side to catch a missing variable before it breaks prod, and export a clean .env whenever your tooling needs one — the encrypted vault stays the source of truth.
Envie is a native Mac app (macOS 12+ on Apple Silicon, with an Intel build), not a web app plus CLI. Unlock the whole vault with Touch ID, included with the optional one-time $4.99 Pro upgrade — and the same app is available for Windows on the Microsoft Store.
.env values never leave your machine, and there's no cloud sync or analytics by default..env files in an encrypted vault on your own device, with no account and nothing uploaded — the simpler choice for solo developers..env file and use it however your stack expects..env files, yes. Envie doesn't do team sync or runtime secret injection — if you need those, keep Doppler; if you want your own .env files kept safe locally, Envie replaces it..env into any environment in seconds, and export any environment back to a clean .env file whenever you need one..env on demand — the encrypted vault stays the source of truth.