Free for teams

Stop pasting .env files into Slack.

envpass keeps every secret for every project, service and environment in one encrypted place. Your team gets exactly the access it needs, CI pulls with a token, and every read is logged.

Create your free workspace See how it works

No credit card. Bring your existing .env files.

envpass.dev/w/acme/p/shop

devstagingprod

Layer: api

KeyValue

DATABASE_URLYours••••••••••
STRIPE_SECRET_KEYapi••••••••••
SENTRY_DSNShared••••••••••
OPENAI_API_KEYShared••••••••••
PORTapi••••••••••

Ana pulled 12 keys from prod · 2m ago

AES-256-GCM, a key per project and environment
Every read and write in an append-only log
CI tokens that expire and can't outlive their creator
Free for teams, no credit card

Sound familiar?

The production database password lives in a Slack DM from two years ago.
A new hire asks for the .env, and someone pastes the whole file, prod keys included.
A key got rotated. Two of your three services still have the old one.
Someone left the team. Nobody can say which secrets they had.

Each of these is one forwarded message away from an incident.

From scattered .env files to one source of truth

Three steps. Most teams are done before their coffee cools.

1
Import what you have
Drop in your .env files. envpass shows what's new, what changed and what's identical before anything is saved.
```
$ drag .env.production → envpass
  + 23 new  ~ 2 changed  = 4 same
```
2
Invite your team with a role
Developers write dev and staging. Production stays read-only or hidden. You decide, per environment.
```
dana@acme.dev   Developer
  dev write · staging write · prod —
```
3
Pull secrets anywhere
CI, servers and AI agents fetch a ready .env with one HTTP call. A CLI for bunx and uvx is on the way.
```
curl -H "Authorization: Bearer $ENVPASS_TOKEN" \
  envpass.dev/api/v1/resolve?environment=prod&format=dotenv
```

Everything a .env file can't do

Set it once, override where it matters

Values in Shared reach every service. Override one for a single service, or just for yourself on dev, without touching anyone else's setup.

Production stays locked

Build roles from read and write per environment. Nobody can grant access they don't have, so a junior dev can't hand themselves prod.

Know who touched what

Every create, update, reveal and pull is recorded with who, when and from where. Values never appear in the log.

Undo a bad rotation in one click

Every change is a version. Restore the last working value, and deleted keys stay recoverable for 30 days.

And the rest of what you'd expect

Service tokens for CI
Scoped to a project, environment and service. Read-only by default, always expiring.
Share one value safely
Links encrypted in your browser and deleted after reading. The server never sees the key.
Compare and promote
Diff dev against prod and copy the keys prod is missing in one move.
No lock-in
Export any environment as .env, JSON or shell exports, any time.
API-first
Every screen is backed by a documented REST API with an OpenAPI spec.
Personal overrides
Point dev at your local database without changing the team's value.

Built like a vault, not a notes app

Secrets are the keys to everything else you run. envpass treats them that way.

Envelope encryption
AES-256-GCM with a separate data key for every project and environment, wrapped by a rotatable master key.
Least privilege by default
New environments start with no access for anyone but admins. Tokens are read-only unless you say otherwise.
Offboarding that works
Remove a member and every token they created stops working at once.
Nothing secret in logs
Values are decrypted only to answer an authorized request, and never written to logs or caches.

How envpass compares

Feature	envpass	.env in Slack	Password manager note
Access per environment	Yes	No	Partly
Log of who read what	Yes	No	Partly
Tokens for CI	Yes	No	Partly
Version history and rollback	Yes	No	Partly
Per-service and personal overrides	Yes	No	No
Price	Free	Free	Paid seats

Free. The whole thing.

Every feature, for your whole team. Fair-use limits keep it running for everyone.

Team

$0forever

10 projects per workspace
25 members
500 keys per project
10 environments
50 CI tokens
30 versions per key, 90-day audit log

Create your free workspace

Questions

Is it really free?

Yes. There is no paid plan and no credit card. The limits above exist to keep the service fast and fair.

Can envpass read my secrets?

Values are encrypted at rest and decrypted on the server only to answer a request from someone with access, which is what lets CI and your team pull them. Share links are different: they are encrypted in your browser and the server never holds the key.

How do I use it in CI?

Create a service token for the environments the job needs, then call the resolve endpoint with it to get a ready .env file. Tokens expire after 30, 90 or 365 days.

Is there a CLI?

bunx and uvx CLIs are in progress and will use the same API. Until then, one curl command does the job.

Can I take my data with me?

Any time. Export an environment as .env, JSON or shell exports from the app or the API.

What happens when someone leaves?

Remove them from the workspace. Their access and every token they created stop working immediately, and the audit log shows what they accessed.

Your secrets deserve better than a Slack thread.

Create a workspace, import your first .env, and invite your team.