Zero-knowledge environment vault
Your development environment, available anywhere.
nvault stores your .env and project configuration files encrypted end-to-end. Encrypt in the browser, keep a full version history, and restore any project's environment on a new machine in one command.
No credit card. The server never sees your plaintext or your passphrase.
$ nvault init
Git repository: github.com/bharath/portfolio-analytics
Matching project: portfolio-analytics
Restore 3 files into this directory?
.env .env.local .env.production
$ nvault pull
✓ Vault unlocked
✓ 3 files decrypted locally
✓ Environment restored
How it works
Three steps to an environment that follows you
Set up once. Every machine after that is a clone-and-pull.
- 1
Set a vault passphrase
Chosen once, never transmitted. It derives the key that wraps everything else — so only you can unlock your vault.
- 2
Push your config files
Upload through the web app or the CLI. Encryption happens locally; the server only receives an opaque blob.
- 3
Restore anywhere
On any machine, unlock the vault and pull. nvault matches the project from your Git remote and writes the files back.
Features
A developer-native secure vault — not cloud storage for secrets
Everything is built around the way environment configuration actually changes: often, and in ways that can break your setup.
Zero-knowledge encryption
Files are encrypted in your browser with AES-256-GCM before they ever leave your machine. The server stores ciphertext and wrapped keys — never plaintext, never your passphrase.
Organised by project
Group .env, .env.local, .env.production and any other config file under the project it belongs to. Everything stays exactly as you uploaded it.
Versioned history
Every change to a file is a new version. Compare, download an earlier one, or restore it in a click when a config change breaks your dev environment.
Exact-fidelity storage
Comments, quoting, multiline values, ordering, whitespace and encoding are preserved byte-for-byte. nvault never parses and rewrites your files.
One-command restore
Clone a repo on a new machine and pull its environment straight back into place — with an explicit prompt before anything on disk is overwritten.
Devices & audit trail
See every active session, revoke any device instantly, and review a timestamped log of security-sensitive actions on your account.
Security model
Designed so a breach of our servers reveals nothing
A key derived from your vault passphrase (PBKDF2, 600,000 iterations) wraps a per-account master key, which wraps a per-project key, which encrypts each file. Every layer is AES-256-GCM with bound additional authenticated data.
- Plaintext and passphrases never leave your browser
- Server-side envelope encryption over every stored blob
- Non-guessable UUIDs and per-request authorization checks
- Short-lived access tokens with device/session revocation
- Audit logging that never records secret contents
CLI
First-class terminal workflow
Built for WSL, SSH sessions, remote servers and headless CI — where a browser is inconvenient or unavailable.
$ nvault init
Git repository: github.com/bharath/portfolio-analytics
Matching project: portfolio-analytics
Restore 3 files into this directory?
.env .env.local .env.production
$ nvault pull
✓ Vault unlocked
✓ 3 files decrypted locally
✓ Environment restored
FAQ
Common questions
- Can nvault staff read my environment variables?
- No. All encryption and decryption happens in your browser. The server stores only ciphertext and keys that are themselves wrapped by a key derived from your vault passphrase, which is never sent to us.
- What happens if I forget my vault passphrase?
- Because the architecture is zero-knowledge, there is no recovery path — we cannot reset a passphrase we never had. Store it in a password manager and keep an offline backup of critical files.
- Does it change my .env files in any way?
- No. Files are stored and restored byte-for-byte. Comments, quoting, ordering, multiline values and whitespace are all preserved. nvault treats config files as opaque data, not dotenv syntax to be re-serialised.
- How does versioning work?
- Each upload of a file creates a new immutable version. You can view metadata for every version, download a previous one, or restore it as the current version. Older encrypted versions remain readable.
Stop copying .env files between machines
Create a vault, push your first project, and restore it anywhere in minutes.