Features
Built for how environment config actually changes
Often, across many machines, and in ways that can break a working setup. nvault is a secure vault for that reality — not generic cloud storage.
Zero-knowledge encryption
Files are encrypted in your browser with AES-256-GCM before they ever leave your machine. The server stores ciphertext and wrapped keys — never plaintext, never your passphrase.
Organised by project
Group .env, .env.local, .env.production and any other config file under the project it belongs to. Everything stays exactly as you uploaded it.
Versioned history
Every change to a file is a new version. Compare, download an earlier one, or restore it in a click when a config change breaks your dev environment.
Exact-fidelity storage
Comments, quoting, multiline values, ordering, whitespace and encoding are preserved byte-for-byte. nvault never parses and rewrites your files.
One-command restore
Clone a repo on a new machine and pull its environment straight back into place — with an explicit prompt before anything on disk is overwritten.
Devices & audit trail
See every active session, revoke any device instantly, and review a timestamped log of security-sensitive actions on your account.
Preserve files exactly as written
nvault stores configuration files as opaque blobs. It does not assume dotenv syntax, so comments, inline quotes, multiline values, key ordering, trailing whitespace and file encoding all survive a round trip unchanged.
Version every change
Each push creates an immutable version with its own metadata. Browse the history for any file, download an earlier version, or promote it back to current — useful when a config edit silently breaks local development.
Restore by Git remote
The CLI reads the Git remote of the current directory and matches it to a project, so 'nvault init' in a fresh clone knows exactly which environment to restore. Git is never required — you can always select a project explicitly.
Safe by default on write
Restoring never silently overwrites a local file. You are shown what will change and asked to confirm, with a backup strategy for anything already on disk.
Manage devices and sessions
Every authenticated session is listed with its device and last-seen time. Revoke any one, or all others, immediately. Access tokens are short-lived and refresh independently.
Audit trail without secrets
Security-sensitive actions — logins, session revocations, project and file changes — are recorded with timestamps. Secret contents are never included in an audit entry or a log line.