Git-native and distributed secrets manager. Encrypted, local-first, and infrastructure agnostic.

envseal is a CLI tool that scans .env* files across multiple repositories, normalizes them, and syncs them into a centralized Git-backed vault as SOPS-encrypted dotenv files, providing safe key-only diffs and versioned rollback.

Encrypt, sync, and inject .env files. Zero-config, zero-login, works offline.

Encrypt sensitive values in environment files using AES-GCM. Envseal allows you to store encrypted values in your environment files (like .env) instead of plain-text secrets.

encrypt secrets at rest, inject at runtime