{"slug": "dotenvx", "name": "dotenvx", "category": "files", "category_name": "Files, sync and backup", "description": "", "recommenders": 3, "commenters": 7, "warners": 1, "score": 2.33, "rising": 0.35, "first": "2025-12-08", "latest": "2026-08-16", "why": "I've settled on dotenvx [0] for committing encrypted .env files.", "why_is_quote": true, "has_verdict": false, "sentiment": {"recommend": 3, "neutral": 1, "compare": 2, "warn": 1}, "spark": [0, 1, 0, 1, 0, 0, 0, 0, 0, 1, 0, 0], "listed": true, "loved": [], "caveat": "", "short_quote": "I've settled on dotenvx [0] for committing encrypted .env files.", "kind": "", "icon": true, "domain": "dotenvx.com", "github_repo": null, "official_url": "https://dotenvx.com", "pricing": "", "aliases": ["dotenvx", "Dotenvx"], "verdict": null, "praise": [{"label": "", "summary": "", "quotes": [{"id": 789085120, "item_id": 49317820, "url": "https://news.ycombinator.com/item?id=49317820", "by": "ryuuseijin", "date": "2026-08-16", "version": null, "stance": "recommend", "quote": "For development on linux I like to use dotenvx", "excerpt": "For development on linux I like to use dotenvx, which lets you put encrypted secrets in an .env file and supply the private key separately. I have a small wrapper script [1] that prompts for the private key which allows me to paste it from my password manager and launches a shell with the env variables decrypted. This allows me to avoid storing any secrets while still having shell session open where I can terminate a", "context": "", "use_case": "Encrypted env secrets for dev", "switched_from": "", "story": "Show HN: Laptop is the last place your secrets are still in plaintext"}, {"id": 754200226, "item_id": 47137514, "url": "https://news.ycombinator.com/item?id=47137514", "by": "ctmnt", "date": "2026-02-24", "version": null, "stance": "recommend", "quote": "use sops + age [1] or dotenvx [2] (or similar) to encrypt just the values", "excerpt": "Really depends on your threat model and use case. The problems with .env files: plain text on disk, no access control, no rotation mechanism, no audit trail, trivial to leak accidentally, secrets go into env variables (which are exposed and often leak). Which of those do you care about? What are you trying to prevent? At the simplest level, keeping .env-ish files, use sops + age [1] or dotenvx [2] (or similar) to enc", "context": "", "use_case": "Encrypting .env values", "switched_from": "", "story": "Show HN: enveil \u2013 hide your .env secrets from prAIng eyes"}, {"id": 739115456, "item_id": 46194716, "url": "https://news.ycombinator.com/item?id=46194716", "by": "madeforhnyo", "date": "2025-12-08", "version": null, "stance": "recommend", "quote": "I've settled on dotenvx [0] for committing encrypted .env files.", "excerpt": "Being a node dev - by necessity, I've settled on dotenvx [0] for committing encrypted .env files. [0] https://dotenvx.com/", "context": "Node developer", "use_case": "Encrypted .env files in git", "switched_from": "", "story": "Show HN: Lockenv \u2013 Simple encrypted secrets storage for Git"}]}], "caveats": [{"label": "", "summary": "", "quotes": [{"id": 765524784, "item_id": 47845299, "url": "https://news.ycombinator.com/item?id=47845299", "by": "TheDong", "date": "2026-04-20", "version": null, "stance": "warn", "quote": "It's kinda like sops but not as good.", "excerpt": "dotenvx is a way to encrypt your secrets at rest. It's kinda like sops but not as good. https://getsops.io/ Notice how their tutorial says \"run 'dotenvx run -- yourapp'\". If you did 'dotenvx run -- env', all your secrets would be printed right there in plaintext, at runtime, since they're just encrypted at rest. The equivalent in vercel would be encrypted in the database (the encrypted '.env' file), with a decryption", "context": "", "use_case": "", "switched_from": "", "story": "A Roblox cheat and one AI tool brought down Vercel's platform"}]}], "who": [{"by": "madeforhnyo", "context": "Node developer", "url": "https://news.ycombinator.com/item?id=46194716", "date": "2025-12-08"}], "tags": [], "use_cases": ["encrypted env secrets for dev", "encrypting .env values", "managing env secrets", "encrypted .env files in git"], "compared": [{"slug": "sops", "name": "SOPS", "co": 3, "switched_from": 0, "switched_to": 0}, {"slug": "enveil", "name": "enveil", "co": 2, "switched_from": 0, "switched_to": 0}], "makers": [{"id": 791889505, "item_id": 49493094, "url": "https://news.ycombinator.com/item?id=49493094", "by": "scottmotte", "date": "2026-08-29", "version": null, "stance": "recommend", "quote": "encrypting your .env file and keeping the decryption key separate", "excerpt": "I'm the creator of Node dotenv and I gave this a lot of thought a couple years back. I put together a whitepaper on this. Ultimately your secrets do still have to hit your environment. But at-rest they should be split from the environment. Today I think that is encrypting your .env file and keeping the decryption key separate. Bring the decryption key only at runtime inside your environment. https://dotenvx.com/white", "context": "creator of Node dotenv", "use_case": "encrypting .env secrets", "switched_from": "", "story": "The Twelve-Factor App (2025)"}, {"id": 765701520, "item_id": 47856345, "url": "https://news.ycombinator.com/item?id=47856345", "by": "scottmotte", "date": "2026-04-21", "version": null, "stance": "recommend", "quote": "Dotenvx splits your secrets into two separate locations.", "excerpt": "Creator of dotenvx here. There is no silver bullet, but Dotenvx splits your secrets into two separate locations. 1. The private decryption key - which lives on Vercel in this example 2. The encrypted .env file which lives in your source code pushed to Vercel Attackers only got access to the first (as far as I know was reported). So your secrets would be safe in this attack if using Dotenvx. (A private key is useless ", "context": "", "use_case": "encrypting .env secrets", "switched_from": "", "story": "A Roblox cheat and one AI tool brought down Vercel's platform"}], "threads": [{"url": "https://news.ycombinator.com/item?id=47133055", "title": "Show HN: enveil \u2013 hide your .env secrets from prAIng eyes", "mentions": 3}, {"url": "https://news.ycombinator.com/item?id=47844431", "title": "A Roblox cheat and one AI tool brought down Vercel's platform", "mentions": 2}, {"url": "https://news.ycombinator.com/item?id=49472216", "title": "The Twelve-Factor App (2025)", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=49317546", "title": "Show HN: Laptop is the last place your secrets are still in plaintext", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=46825555", "title": "Ask HN: How are you managing secrets with AI agents?", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=46189480", "title": "Show HN: Lockenv \u2013 Simple encrypted secrets storage for Git", "mentions": 1}], "sentiment_by_month": {"2025-11": {}, "2025-12": {"recommend": 1}, "2026-01": {"neutral": 1}, "2026-02": {"compare": 2, "recommend": 1}, "2026-03": {}, "2026-04": {"warn": 1}, "2026-05": {}, "2026-06": {}, "2026-07": {}, "2026-08": {"recommend": 1}, "2026-09": {}, "2026-10": {}}, "versions": [], "version_unnamed": 0, "family_ref": null, "runs_on": null, "lines": [], "quotes": [{"id": 789085120, "item_id": 49317820, "url": "https://news.ycombinator.com/item?id=49317820", "by": "ryuuseijin", "date": "2026-08-16", "version": null, "stance": "recommend", "quote": "For development on linux I like to use dotenvx", "excerpt": "For development on linux I like to use dotenvx, which lets you put encrypted secrets in an .env file and supply the private key separately. I have a small wrapper script [1] that prompts for the private key which allows me to paste it from my password manager and launches a shell with the env variables decrypted. This allows me to avoid storing any secrets while still having shell session open where I can terminate a", "context": "", "use_case": "Encrypted env secrets for dev", "switched_from": "", "story": "Show HN: Laptop is the last place your secrets are still in plaintext"}, {"id": 765524784, "item_id": 47845299, "url": "https://news.ycombinator.com/item?id=47845299", "by": "TheDong", "date": "2026-04-20", "version": null, "stance": "warn", "quote": "It's kinda like sops but not as good.", "excerpt": "dotenvx is a way to encrypt your secrets at rest. It's kinda like sops but not as good. https://getsops.io/ Notice how their tutorial says \"run 'dotenvx run -- yourapp'\". If you did 'dotenvx run -- env', all your secrets would be printed right there in plaintext, at runtime, since they're just encrypted at rest. The equivalent in vercel would be encrypted in the database (the encrypted '.env' file), with a decryption", "context": "", "use_case": "", "switched_from": "", "story": "A Roblox cheat and one AI tool brought down Vercel's platform"}, {"id": 754222914, "item_id": 47138932, "url": "https://news.ycombinator.com/item?id=47138932", "by": "secr", "date": "2026-02-24", "version": null, "stance": "compare", "quote": "The local encryption approach (enveil, sops, dotenvx)", "excerpt": "The thread keeps cycling between \"encrypt the file\" and \"proxy everything\" but there's a middle ground most small teams actually need. The local encryption approach (enveil, sops, dotenvx) solves accidental file reads but doesn't help with team sharing, you still end up sending secrets over Slack when someone joins the team or a key gets rotated. The proxy approach is robust but heavy for a 5-person startup. I've bee", "context": "", "use_case": "", "switched_from": "", "story": "Show HN: enveil \u2013 hide your .env secrets from prAIng eyes"}, {"id": 754200226, "item_id": 47137514, "url": "https://news.ycombinator.com/item?id=47137514", "by": "ctmnt", "date": "2026-02-24", "version": null, "stance": "recommend", "quote": "use sops + age [1] or dotenvx [2] (or similar) to encrypt just the values", "excerpt": "Really depends on your threat model and use case. The problems with .env files: plain text on disk, no access control, no rotation mechanism, no audit trail, trivial to leak accidentally, secrets go into env variables (which are exposed and often leak). Which of those do you care about? What are you trying to prevent? At the simplest level, keeping .env-ish files, use sops + age [1] or dotenvx [2] (or similar) to enc", "context": "", "use_case": "Encrypting .env values", "switched_from": "", "story": "Show HN: enveil \u2013 hide your .env secrets from prAIng eyes"}, {"id": 754153120, "item_id": 47134570, "url": "https://news.ycombinator.com/item?id=47134570", "by": "handfuloflight", "date": "2026-02-24", "version": null, "stance": "compare", "quote": "How does this compare with https://dotenvx.com/?", "excerpt": "How does this compare with https://dotenvx.com/?", "context": "", "use_case": "", "switched_from": "", "story": "Show HN: enveil \u2013 hide your .env secrets from prAIng eyes"}, {"id": 749239584, "item_id": 46827474, "url": "https://news.ycombinator.com/item?id=46827474", "by": "whinvik", "date": "2026-01-30", "version": null, "stance": "neutral", "quote": "Curious if anyone has experimented with dotenvx", "excerpt": "Curious if anyone has experimented with dotenvx - https://dotenvx.com/", "context": "", "use_case": "Managing env secrets", "switched_from": "", "story": "Ask HN: How are you managing secrets with AI agents?"}, {"id": 739115456, "item_id": 46194716, "url": "https://news.ycombinator.com/item?id=46194716", "by": "madeforhnyo", "date": "2025-12-08", "version": null, "stance": "recommend", "quote": "I've settled on dotenvx [0] for committing encrypted .env files.", "excerpt": "Being a node dev - by necessity, I've settled on dotenvx [0] for committing encrypted .env files. [0] https://dotenvx.com/", "context": "Node developer", "use_case": "Encrypted .env files in git", "switched_from": "", "story": "Show HN: Lockenv \u2013 Simple encrypted secrets storage for Git"}]}