{"slug": "direnv", "name": "direnv", "category": "terminal", "category_name": "Terminal and shell", "description": "Shell extension that loads and unloads environment variables per directory from .envrc files.", "recommenders": 5, "commenters": 10, "warners": 0, "score": 5.73, "rising": -0.31, "first": "2025-11-28", "latest": "2026-10-09", "why": "HN commenters like it for loading a simple per-project .envrc into the shell and for pulling secrets from stores like pass, Vault or Infisical instead of keeping them in plain text.", "why_is_quote": false, "has_verdict": true, "sentiment": {"recommend": 5, "neutral": 5, "compare": 0, "warn": 0}, "spark": [1, 0, 1, 0, 0, 0, 1, 1, 0, 1, 0, 0], "listed": true, "loved": ["Secrets loading", "Nix integration"], "caveat": "", "short_quote": "This is why I love direnv (the tool) and just a simple .envrc (not .env).", "icon": false, "domain": "direnv.net", "github_repo": null, "official_url": "https://direnv.net/", "pricing": "open source", "aliases": ["direnv"], "verdict": [{"text": "HN commenters like it for loading a simple per-project .envrc into the shell", "cites": [{"id": 786743616, "item_id": 49171476, "url": "https://news.ycombinator.com/item?id=49171476", "by": "prologic", "date": "2026-08-04", "stance": "recommend", "quote": "This is why I love direnv (the tool) and just a simple .envrc (not .env).", "excerpt": "This is why I love direnv (the tool) and just a simple .envrc (not .env). It has none of the problems posited in the OP's article. It assumes nothing, only that direnv manges loading up the .envrc into your shell.", "context": "", "use_case": "loading environment config", "switched_from": "", "story": "Where .env Went Wrong"}, {"id": 737640658, "item_id": 46102541, "url": "https://news.ycombinator.com/item?id=46102541", "by": "Ingon", "date": "2025-11-30", "stance": "neutral", "quote": "in my projects (with direnv)", "excerpt": "I am excited for having a new version of NixOS. Few days ago I realized that November is almost gone and went looking for when I can expect the new release. And right on schedule it popped out (was checking throughout the day). Big props to the release managers (and of course the maintainers) I use nix via flakes on my own machines (via NixOS), in my projects (with direnv), on my infrastructure/servers (NixOS deployi", "context": "", "use_case": "project environments", "switched_from": "", "story": "NixOS 25.11 released"}]}, {"text": " and for pulling secrets from stores like pass, Vault or Infisical instead of keeping them in plain text.", "cites": [{"id": 737242672, "item_id": 46077667, "url": "https://news.ycombinator.com/item?id=46077667", "by": "sakisv", "date": "2025-11-28", "stance": "recommend", "quote": "The way I solve the plain text problem is through a combination of direnv[1] and pass[2].", "excerpt": "The way I solve the plain text problem is through a combination of direnv[1] and pass[2]. For a given project, I have a `./creds` directory which is managed with pass and it contains all the access tokens and api keys that are relevant for that project, one per file, for example, `./creds/cloudflare/api_token`. Pass encrypts all these files via gpg, for which I use a key stored on a Yubikey. Next to the `./creds` dir", "context": "", "use_case": "per-project env variables for secrets", "switched_from": "", "story": "GitLab discovers widespread NPM supply chain attack"}, {"id": 747488336, "item_id": 46718021, "url": "https://news.ycombinator.com/item?id=46718021", "by": "ReluctantLaser", "date": "2026-01-22", "stance": "recommend", "quote": "I use direnv mostly", "excerpt": "I feel I see these solutions somewhat often, but you can execute a command and use that as a value. To me, I'm not sure why people aren't calling their secret store as part of it. I use direnv mostly, but seems `.env` supports the same thing. e.g: MY_SECRET=$(pass show path/to/my/secret) Of course substitute that for Vault/SSM/whatever. There are other solutions to this problem too, but I show this to people as there", "context": "", "use_case": "loading env secrets", "switched_from": "", "story": "Show HN: Dotenv Mask Editor: No more embarrassing screen leaks of your .env"}, {"id": 771946961, "item_id": 48246685, "url": "https://news.ycombinator.com/item?id=48246685", "by": "mindwok", "date": "2026-05-23", "stance": "recommend", "quote": "I use direnv (https://direnv.net/) with a hook to infisical's export command.", "excerpt": "IMO env files are a bit of an anti-pattern, env vars should be set outside the context of your app so that your app doesn't need to care where they come from, it just uses standard env var APIs to read them. This means developers can choose how they load them and what tools they use to do so. With that said, the problem still exists just one layer higher. If they are secrets, I use Infisical (https://infisical.com/) ", "context": "", "use_case": "loading env vars per project", "switched_from": "", "story": "Ask HN: How do small teams securely share env files?"}]}, {"text": " No complaints about direnv itself appear in these mentions;", "cites": [{"id": 786743616, "item_id": 49171476, "url": "https://news.ycombinator.com/item?id=49171476", "by": "prologic", "date": "2026-08-04", "stance": "recommend", "quote": "This is why I love direnv (the tool) and just a simple .envrc (not .env).", "excerpt": "This is why I love direnv (the tool) and just a simple .envrc (not .env). It has none of the problems posited in the OP's article. It assumes nothing, only that direnv manges loading up the .envrc into your shell.", "context": "", "use_case": "loading environment config", "switched_from": "", "story": "Where .env Went Wrong"}]}, {"text": " it suits developers who pair it with Nix, asdf or mise to keep project environments consistent.", "cites": [{"id": 737640658, "item_id": 46102541, "url": "https://news.ycombinator.com/item?id=46102541", "by": "Ingon", "date": "2025-11-30", "stance": "neutral", "quote": "in my projects (with direnv)", "excerpt": "I am excited for having a new version of NixOS. Few days ago I realized that November is almost gone and went looking for when I can expect the new release. And right on schedule it popped out (was checking throughout the day). Big props to the release managers (and of course the maintainers) I use nix via flakes on my own machines (via NixOS), in my projects (with direnv), on my infrastructure/servers (NixOS deployi", "context": "", "use_case": "project environments", "switched_from": "", "story": "NixOS 25.11 released"}, {"id": 776834369, "item_id": 48552148, "url": "https://news.ycombinator.com/item?id=48552148", "by": "InvertedRhodium", "date": "2026-06-16", "stance": "recommend", "quote": "We use direnv with asdf to ensure everyone is in the same version now.", "excerpt": "One person upgrading terraform can break the state format for backwards compatibility. We use direnv with asdf to ensure everyone is in the same version now.", "context": "", "use_case": "pinning tool versions", "switched_from": "", "story": "What job interviews taught me about Kubernetes"}, {"id": 800328080, "item_id": 50020505, "url": "https://news.ycombinator.com/item?id=50020505", "by": "alex0ptr", "date": "2026-10-09", "stance": "neutral", "quote": "I use a lot of direnv / mise.", "excerpt": "Yes, exactly. This is especially frustrating when I leave an agent running for a long time and it gets stuck on my build scripts because it's waiting for my approval. I just want to avoid leaving my credentials and secrets on the filesystem. EDIT: I use a lot of direnv / mise. So reloading credentials with different values is common.", "context": "", "use_case": "environment and credential loading", "switched_from": "", "story": "Once: Cache CLI commands"}]}], "praise": [{"label": "Secrets loading", "summary": "Commenters use .envrc to fetch secrets at load time from pass, Infisical or Vault rather than storing them in plain text.", "quotes": [{"id": 737242672, "item_id": 46077667, "url": "https://news.ycombinator.com/item?id=46077667", "by": "sakisv", "date": "2025-11-28", "stance": "recommend", "quote": "The way I solve the plain text problem is through a combination of direnv[1] and pass[2].", "excerpt": "The way I solve the plain text problem is through a combination of direnv[1] and pass[2]. For a given project, I have a `./creds` directory which is managed with pass and it contains all the access tokens and api keys that are relevant for that project, one per file, for example, `./creds/cloudflare/api_token`. Pass encrypts all these files via gpg, for which I use a key stored on a Yubikey. Next to the `./creds` dir", "context": "", "use_case": "per-project env variables for secrets", "switched_from": "", "story": "GitLab discovers widespread NPM supply chain attack"}, {"id": 747488336, "item_id": 46718021, "url": "https://news.ycombinator.com/item?id=46718021", "by": "ReluctantLaser", "date": "2026-01-22", "stance": "recommend", "quote": "I use direnv mostly", "excerpt": "I feel I see these solutions somewhat often, but you can execute a command and use that as a value. To me, I'm not sure why people aren't calling their secret store as part of it. I use direnv mostly, but seems `.env` supports the same thing. e.g: MY_SECRET=$(pass show path/to/my/secret) Of course substitute that for Vault/SSM/whatever. There are other solutions to this problem too, but I show this to people as there", "context": "", "use_case": "loading env secrets", "switched_from": "", "story": "Show HN: Dotenv Mask Editor: No more embarrassing screen leaks of your .env"}, {"id": 771946961, "item_id": 48246685, "url": "https://news.ycombinator.com/item?id=48246685", "by": "mindwok", "date": "2026-05-23", "stance": "recommend", "quote": "I use direnv (https://direnv.net/) with a hook to infisical's export command.", "excerpt": "IMO env files are a bit of an anti-pattern, env vars should be set outside the context of your app so that your app doesn't need to care where they come from, it just uses standard env var APIs to read them. This means developers can choose how they load them and what tools they use to do so. With that said, the problem still exists just one layer higher. If they are secrets, I use Infisical (https://infisical.com/) ", "context": "", "use_case": "loading env vars per project", "switched_from": "", "story": "Ask HN: How do small teams securely share env files?"}]}, {"label": "Nix integration", "summary": "Commenters use it with Nix flakes in projects, and one notes that Zed works smoothly with Nix and direnv.", "quotes": [{"id": 737640658, "item_id": 46102541, "url": "https://news.ycombinator.com/item?id=46102541", "by": "Ingon", "date": "2025-11-30", "stance": "neutral", "quote": "in my projects (with direnv)", "excerpt": "I am excited for having a new version of NixOS. Few days ago I realized that November is almost gone and went looking for when I can expect the new release. And right on schedule it popped out (was checking throughout the day). Big props to the release managers (and of course the maintainers) I use nix via flakes on my own machines (via NixOS), in my projects (with direnv), on my infrastructure/servers (NixOS deployi", "context": "", "use_case": "project environments", "switched_from": "", "story": "NixOS 25.11 released"}, {"id": 743989812, "item_id": 46499363, "url": "https://news.ycombinator.com/item?id=46499363", "by": "koito17", "date": "2026-01-05", "stance": "neutral", "quote": "I appreciate that Zed works smoothly with Nix and Direnv", "excerpt": "I used to be a daily Emacs user (both at work and for personal projects). Since trying out Zed a little over a year ago, now I only use Emacs for Magit and the occasional IRC message through the built-in ERC client. For VS Code users, there's actually a special feature where a subset of VS Code settings can be migrated to Zed settings. Cannot vouch for its stability, but the functionality is there. Sorely missing a R", "context": "", "use_case": "per-project environments", "switched_from": "", "story": "I switched from VSCode to Zed"}]}, {"label": "Simple .envrc", "summary": "One commenter values that it assumes nothing beyond loading a plain .envrc into the shell.", "quotes": [{"id": 786743616, "item_id": 49171476, "url": "https://news.ycombinator.com/item?id=49171476", "by": "prologic", "date": "2026-08-04", "stance": "recommend", "quote": "This is why I love direnv (the tool) and just a simple .envrc (not .env).", "excerpt": "This is why I love direnv (the tool) and just a simple .envrc (not .env). It has none of the problems posited in the OP's article. It assumes nothing, only that direnv manges loading up the .envrc into your shell.", "context": "", "use_case": "loading environment config", "switched_from": "", "story": "Where .env Went Wrong"}]}, {"label": "Team version pinning", "summary": "One team pairs it with asdf so everyone runs the same tool versions.", "quotes": [{"id": 776834369, "item_id": 48552148, "url": "https://news.ycombinator.com/item?id=48552148", "by": "InvertedRhodium", "date": "2026-06-16", "stance": "recommend", "quote": "We use direnv with asdf to ensure everyone is in the same version now.", "excerpt": "One person upgrading terraform can break the state format for backwards compatibility. We use direnv with asdf to ensure everyone is in the same version now.", "context": "", "use_case": "pinning tool versions", "switched_from": "", "story": "What job interviews taught me about Kubernetes"}]}], "caveats": [], "who": [], "tags": ["for secrets management", "for Nix users", "for teams", "for zsh users"], "use_cases": ["environment and credential loading", "loading environment config", "environment variables", "pinning tool versions", "loading env vars per project", "loading env secrets"], "compared": [{"slug": "mise", "name": "mise", "co": 6, "switched_from": 0, "switched_to": 1}, {"slug": "asdf", "name": "asdf", "co": 3, "switched_from": 0, "switched_to": 0}, {"slug": "nix", "name": "Nix", "co": 2, "switched_from": 0, "switched_to": 0}, {"slug": "pass", "name": "pass", "co": 2, "switched_from": 0, "switched_to": 0}], "makers": [], "threads": [{"url": "https://news.ycombinator.com/item?id=50018239", "title": "Once: Cache CLI commands", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=49124291", "title": "Where .env Went Wrong", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=49158287", "title": "Use Task Runners for Common Coding Tasks", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=48546428", "title": "What job interviews taught me about Kubernetes", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=48245740", "title": "Ask HN: How do small teams securely share env files?", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=46713473", "title": "Show HN: Dotenv Mask Editor: No more embarrassing screen leaks of your .env", "mentions": 1}], "sentiment_by_month": {"2025-11": {"recommend": 1, "neutral": 1}, "2025-12": {}, "2026-01": {"neutral": 2, "recommend": 1}, "2026-02": {}, "2026-03": {}, "2026-04": {}, "2026-05": {"recommend": 1}, "2026-06": {"recommend": 1}, "2026-07": {}, "2026-08": {"neutral": 1, "recommend": 1}, "2026-09": {}, "2026-10": {"neutral": 1}}, "quotes": [{"id": 800328080, "item_id": 50020505, "url": "https://news.ycombinator.com/item?id=50020505", "by": "alex0ptr", "date": "2026-10-09", "stance": "neutral", "quote": "I use a lot of direnv / mise.", "excerpt": "Yes, exactly. This is especially frustrating when I leave an agent running for a long time and it gets stuck on my build scripts because it's waiting for my approval. I just want to avoid leaving my credentials and secrets on the filesystem. EDIT: I use a lot of direnv / mise. So reloading credentials with different values is common.", "context": "", "use_case": "environment and credential loading", "switched_from": "", "story": "Once: Cache CLI commands"}, {"id": 786743616, "item_id": 49171476, "url": "https://news.ycombinator.com/item?id=49171476", "by": "prologic", "date": "2026-08-04", "stance": "recommend", "quote": "This is why I love direnv (the tool) and just a simple .envrc (not .env).", "excerpt": "This is why I love direnv (the tool) and just a simple .envrc (not .env). It has none of the problems posited in the OP's article. It assumes nothing, only that direnv manges loading up the .envrc into your shell.", "context": "", "use_case": "loading environment config", "switched_from": "", "story": "Where .env Went Wrong"}, {"id": 786601794, "item_id": 49162612, "url": "https://news.ycombinator.com/item?id=49162612", "by": "Arrowmaster", "date": "2026-08-03", "stance": "neutral", "quote": "I looked at mise to replace direnv in the few places I use it", "excerpt": "I have been using just for some projects and really like it. I looked at mise to replace direnv in the few places I use it, but between mise trying to do so many things and the in terminal advertisement for a problematic company I want nothing to do with, I have halted all plans I had for learning more about mise.", "context": "", "use_case": "environment variables", "switched_from": "", "story": "Use Task Runners for Common Coding Tasks"}, {"id": 776834369, "item_id": 48552148, "url": "https://news.ycombinator.com/item?id=48552148", "by": "InvertedRhodium", "date": "2026-06-16", "stance": "recommend", "quote": "We use direnv with asdf to ensure everyone is in the same version now.", "excerpt": "One person upgrading terraform can break the state format for backwards compatibility. We use direnv with asdf to ensure everyone is in the same version now.", "context": "", "use_case": "pinning tool versions", "switched_from": "", "story": "What job interviews taught me about Kubernetes"}, {"id": 771946961, "item_id": 48246685, "url": "https://news.ycombinator.com/item?id=48246685", "by": "mindwok", "date": "2026-05-23", "stance": "recommend", "quote": "I use direnv (https://direnv.net/) with a hook to infisical's export command.", "excerpt": "IMO env files are a bit of an anti-pattern, env vars should be set outside the context of your app so that your app doesn't need to care where they come from, it just uses standard env var APIs to read them. This means developers can choose how they load them and what tools they use to do so. With that said, the problem still exists just one layer higher. If they are secrets, I use Infisical (https://infisical.com/) ", "context": "", "use_case": "loading env vars per project", "switched_from": "", "story": "Ask HN: How do small teams securely share env files?"}, {"id": 747488336, "item_id": 46718021, "url": "https://news.ycombinator.com/item?id=46718021", "by": "ReluctantLaser", "date": "2026-01-22", "stance": "recommend", "quote": "I use direnv mostly", "excerpt": "I feel I see these solutions somewhat often, but you can execute a command and use that as a value. To me, I'm not sure why people aren't calling their secret store as part of it. I use direnv mostly, but seems `.env` supports the same thing. e.g: MY_SECRET=$(pass show path/to/my/secret) Of course substitute that for Vault/SSM/whatever. There are other solutions to this problem too, but I show this to people as there", "context": "", "use_case": "loading env secrets", "switched_from": "", "story": "Show HN: Dotenv Mask Editor: No more embarrassing screen leaks of your .env"}, {"id": 745132723, "item_id": 46570795, "url": "https://news.ycombinator.com/item?id=46570795", "by": "asadjb", "date": "2026-01-10", "stance": "neutral", "quote": "plugins=(direnv fzf)", "excerpt": "I've been an oh-my-zsh user for many years now, being very happy with the very small set of features I use from it. Previously I could never think of trying to figure out how to replicate the features I need without the other features from oh-my-zsh, which does make the shell noticeably slower. Just now, after reading this article, I used Claude code and have removed the OMZ config within 5 minutes. Here's my prompt ", "context": "", "use_case": "environment management", "switched_from": "", "story": "You probably don't need Oh My Zsh"}, {"id": 743989812, "item_id": 46499363, "url": "https://news.ycombinator.com/item?id=46499363", "by": "koito17", "date": "2026-01-05", "stance": "neutral", "quote": "I appreciate that Zed works smoothly with Nix and Direnv", "excerpt": "I used to be a daily Emacs user (both at work and for personal projects). Since trying out Zed a little over a year ago, now I only use Emacs for Magit and the occasional IRC message through the built-in ERC client. For VS Code users, there's actually a special feature where a subset of VS Code settings can be migrated to Zed settings. Cannot vouch for its stability, but the functionality is there. Sorely missing a R", "context": "", "use_case": "per-project environments", "switched_from": "", "story": "I switched from VSCode to Zed"}, {"id": 737640658, "item_id": 46102541, "url": "https://news.ycombinator.com/item?id=46102541", "by": "Ingon", "date": "2025-11-30", "stance": "neutral", "quote": "in my projects (with direnv)", "excerpt": "I am excited for having a new version of NixOS. Few days ago I realized that November is almost gone and went looking for when I can expect the new release. And right on schedule it popped out (was checking throughout the day). Big props to the release managers (and of course the maintainers) I use nix via flakes on my own machines (via NixOS), in my projects (with direnv), on my infrastructure/servers (NixOS deployi", "context": "", "use_case": "project environments", "switched_from": "", "story": "NixOS 25.11 released"}, {"id": 737242672, "item_id": 46077667, "url": "https://news.ycombinator.com/item?id=46077667", "by": "sakisv", "date": "2025-11-28", "stance": "recommend", "quote": "The way I solve the plain text problem is through a combination of direnv[1] and pass[2].", "excerpt": "The way I solve the plain text problem is through a combination of direnv[1] and pass[2]. For a given project, I have a `./creds` directory which is managed with pass and it contains all the access tokens and api keys that are relevant for that project, one per file, for example, `./creds/cloudflare/api_token`. Pass encrypts all these files via gpg, for which I use a key stored on a Yubikey. Next to the `./creds` dir", "context": "", "use_case": "per-project env variables for secrets", "switched_from": "", "story": "GitLab discovers widespread NPM supply chain attack"}]}