Encrypted at rest
Every secret is encrypted locally with AES-GCM. On disk, your data is just an unreadable block without your password.
AES-GCM encrypted · Synced via iCloud
envclo — the encrypted .env secrets manager for macOS
Keep your API keys, tokens and environment variables in a native macOS app, encrypted at rest with AES-GCM and Argon2. The encrypted vault syncs through your iCloud Drive — Apple only ever sees ciphertext.
Apple Silicon (arm64) · v0.1.3 · Free
envclo is completely free. If it saves you time, you can support its development.
What envclo does
A safer way to manage your projects' secrets, without ever exposing them.
Argon2-derived key
Your master password is turned into an encryption key via Argon2, the reference algorithm against brute-force attacks.
Synced via iCloud
The encrypted vault is stored in your iCloud Drive and follows you across all your Macs. Apple only ever stores ciphertext — never your secrets in plain text.
Built for your .env files
Organize the environment variables of all your projects in a single vault, safe from leaked, unversioned .env files.
Quick copy
Grab a value in one click to your clipboard, without ever exposing it in plain sight longer than necessary.
Native and lightweight
Built with Tauri v2: a Rust core and a React interface. Fast, light on memory, and genuinely native.
How it works
Three steps, and your secrets are safe.
1
Create your vault
On first launch, choose a master password. It's the only key to unlock your secrets — and it's never stored.
2
Add your secrets
Paste your environment variables, API keys and tokens. Everything is encrypted instantly before it's written to disk.
3
Find them everywhere
Unlock the vault, copy the value you need, and get back to work. Simple, secure, frictionless.
Frequently asked questions
What is envclo?
envclo is a desktop app that stores and manages your .env secrets (API keys, tokens, credentials) in a locally encrypted vault. It keeps plain-text .env files from lying around on your machine.
Where are my secrets stored?
The vault is stored encrypted in your iCloud Drive, which syncs it automatically across all your Macs. Apple only stores the encrypted file (AES-GCM): without your master password, which never leaves your machine, no one — not even Apple — can decrypt it.
How does the encryption work?
Your data is encrypted with AES-GCM. The encryption key is derived from your master password via Argon2, a function designed to resist brute-force attacks. The password itself is never stored.
Which platforms is envclo available on?
envclo is available exclusively on macOS (Apple Silicon, arm64). Because the encrypted vault is stored and synced through your iCloud Drive, the app is built for the Apple ecosystem — there is no Windows or Linux version.
What happens if I forget my master password?
Since the password is never stored and is used to derive the encryption key, there is no way to recover a vault whose password is lost. That's the price of truly local encryption.
Ready to secure your secrets?
Download envclo for free and keep your API keys where they belong: with you.
Download for macOS