EnvVault
The professional vault for developers.
Stop storing secrets in plain text. EnvVault manages, versions and encrypts your environment variables on your own machine — AES-256-GCM at rest, no cloud sync, no telemetry. It is MCP-native, so the rest of our suite pulls the credentials it needs on demand.
The problem every developer knows
Managing environment variables is broken. Here is what is really happening.
Plain-text secrets
API keys, database credentials and JWT secrets sitting in unencrypted .env files. One leaked file and it is over.
.gitignore failures
One missed entry and production secrets are on GitHub for the world to see.
Config drift
"It works on my machine." Different secrets across dev, staging and production, causing bugs nobody can reproduce.
Multi-project chaos
Freelancers and agencies juggling twenty client projects. Which .env belongs to which client again?
Built for professional developers
Not another bloated SaaS tool. A focused vault for developers who take security seriously.
Security first
AES-256-GCM encryption and Argon2id hashing. Every secret encrypted at rest, with zero-knowledge architecture.
Local-first
No cloud sync, no telemetry. Your keys, your files, air-gap ready. Works offline forever.
Version control
A built-in timeline and instant rollback. See every change, diff it, undo mistakes.
Productivity
Command palette and fuzzy search. Hierarchical organisation: projects, then branches, then environments.
Beyond .env
API keys, SSH configs and database credentials in one vault — not just environment variables.
Auto-lock
Step away from your desk and the vault locks itself after a configurable period of inactivity.
For the skeptics
We are developers too, so here is exactly how it works.
- Zero-knowledge architecture — the master password never leaves your device
- Local storage only — an encrypted SQLite database, no network transmission
- AES-256-GCM for encryption, Argon2id for password hashing, CSPRNG for key derivation
- Atomic file operations, so a power loss or crash cannot corrupt the vault
- Automatic session locking, requiring the master password again
- Built with Tauri — a Rust backend with a React front end
One-time purchase
No subscription, no recurring fee.
Personal
39 €69 €
one-time payment
- Unlimited projects and environments
- AES-256-GCM encryption
- Version control and rollback
- Command palette
- Up to 5 devices
- Lifetime updates
- Email support
Business
69 €99 €
one-time payment
- Everything in Personal
- 15 installations
- Air-gapped environments
- Offline licence validation
Prices shown include the launch discount. Current pricing and the download are on envvault.eu.
MCP-native, and part of the suite
EnvVault is our own product, built with Tauri, Rust and React. It is MCP-native: askTheodor, LOKIDocs, DaRunner and Social Scheduler fetch the credentials they need from it over MCP, so secrets never sit in plain config files.