Push
Store once, encrypted at rest
envs push sends every .env file in the repo up, per project. Values are AES-256-GCM encrypted before they ever hit the database — only ciphertext at rest.
One vault for every .env
Your env vars, everywhere. Never in git.
EnvStash stores your .env files AES-256-GCM encrypted and pulls them to any machine with one command. Flat price. Near-zero ops. Next on the roadmap: a broker that hands agents scoped, short-lived tokens instead of your keys.
No per-seat tax. No machine-identity billing. No Vault engineer required.
envs — envstash
# stash every .env in the repo, encrypted
$ envs push
✓ .env — 12 keys encrypted (AES-256-GCM)
ciphertext only at rest
# any machine you’ve signed in
$ envs pull
✓ Wrote .env (12 keys, chmod 600)
✗ plaintext in git history — never again
3.2%
of AI-assisted commits leak secrets
Double the baseline rate
81%
spike in Anthropic & OpenAI key leaks
Year over year
$540
monthly Infisical bill example
10 devs + 20 machine identities
How it works
Push once, pull anywhere
Your secrets live encrypted in one vault instead of scattered across laptops and chat threads. And the broker layer on the roadmap goes where incumbents don't: keeping the underlying key out of an agent's reach entirely.
Pull
Your files back, anywhere
envs pull writes them to disk exactly as pushed, chmod 600, on any machine you have signed in — or in CI with a token from your secret store. Nothing lands in git history.
Broker · roadmap
Scoped tokens, not raw keys
The layer we are building next: when an agent or pipeline needs access, EnvStash will issue a short-lived token with explicit scope — read:stripe, write:deploy — not the raw secret.
# in CI: pull with a token from your secret store
$ ENVSTASH_HOST=https://envstash.co ENVSTASH_TOKEN=$ENVS_TOKEN \
envs pull
Compare
Not another enterprise vault
Enterprise platforms demand a Vault engineer. DX SaaS tools tax you per seat or per machine identity. EnvStash targets the solo builder and the agentic pipeline — flat, predictable, purpose-built.
| Capability | Doppler | Infisical | EnvStash |
|---|---|---|---|
| Agent-scoped brokering | — | — | Soon |
| Flat team pricing | — | — | ✓ |
| Self-host option | — | ✓ | Soon |
| Just env vars (no PKI/PAM bloat) | ✓ | — | ✓ |
| Setup in minutes | ✓ | — | ✓ |
| Open source core | — | ✓ | Soon |
Features
Everything you need. Nothing you don't.
Env vars across environments with the security model the AI era actually demands.
Encrypted at rest
AES-256-GCM in Node before values touch Postgres. If the database leaks, attackers get ciphertext — not your keys.
Revocable device tokens
Sign each machine in with a device-flow login — no password over the wire. Revoke one device without rotating a single secret.
Every env file, one home
.env, .env.local, apps/web/.env — every file in the repo, tracked per project. envs diff shows what changed before you overwrite anything.
Agent identity scoping — roadmap
Coming with the broker: tokens bound to a specific agent identity with explicit read/write scope, revocable one at a time.
Ephemeral by design — roadmap
Coming with the broker: tokens that expire in minutes, not months. Limits blast radius when an agent goes off-script.
Solo-builder friendly
No 3-hour self-host setup. No $21/seat RBAC wall. Built for the vibe coder who needs it working tonight.
Pricing
One flat price.
Whole team.
No $21/seat RBAC wall. No counting machine identities. Predictable billing for solo builders and small teams who just want env vars that work.
$12/ month
Early access · founding member pricing
- Unlimited projects & env files
- Unlimited device tokens
- Agent broker when it ships (roadmap)
- AES-256-GCM encryption at rest
- Dashboard + CLI (push, pull, status, diff)
- No per-seat fees
- No machine-identity tax
Stop scattering .env files across machines.
One encrypted vault, one command to pull — and next on the roadmap, a broker that hands your agents scoped ephemeral tokens instead of raw keys.
Get on the list