Stop sending production secrets over Slack.
EnvGuard provides mathematically proven client-side encryption for .env files. Decrypted only by the recipient. Invisible to our servers.
Enterprise Grade Security
Features designed for paranoid teams.
Client-Side Encryption
Cryptographic operations happen strictly in the browser using the native Web Crypto API. Plain text never touches a network request.
Burn After Reading
Ensure a secret is only viewed once. The moment the recipient decrypts the payload, it is instantly and permanently wiped from the database.
2FA Key Wrapping
Add a password to your links. We use PBKDF2 to derive a wrapping key, ensuring even intercepted URLs cannot be decrypted without the PIN.
Granular TTL Expiry
Set strict Time-To-Live limits ranging from 24 hours to 60 days. Automated CRON jobs scrub expired ciphertexts at the database level.
Instant .env Parsing
Drag and drop raw `.env` files. Our client-side FileReader extracts and renders the keys into a beautiful, masked IDE-style UI for the receiver.
Tamper Detection
Powered by the Galois/Counter Mode (GCM). If a single byte of the encrypted payload is altered in transit, decryption mathematically fails.
Secure Transfer
How to securely share environment variables.
Upload your .env file
Paste your raw variables into the client-side secure editor. The plain text remains strictly in your browser memory.
Generate a Zero-Knowledge Link
The data is encrypted locally using AES-256-GCM. The vital decryption key is generated exclusively as a URL hash fragment.
Share the Link
Send the link to your colleague. Their browser parses the hash fragment and decrypts the payload locally, rendering the secret variables.
Ecosystem Compatibility
The Stack
No black boxes. Pure cryptographic math.
We believe security tools should be transparent. EnvGuard is built on a vanilla web stack prioritizing speed, removing third-party dependencies, and leveraging the immense power of modern browser APIs.
- Web Crypto API (AES-256-GCM)
- Vercel Edge Serverless Functions
- Supabase Postgres (RLS Enforced)
- Pure HTML/JS DOM Manipulation
1. Browser Sandbox
Plain Text → Ciphertext + Key
Ciphertext
Sent to Supabase
Decryption Key
Stays in URL Hash
Transparent Pricing
Security shouldn't be a premium feature.
Public Cloud
Everything you need to share secrets securely. Hosted on our Vercel/Supabase infrastructure.
- Unlimited Encryptions
- Burn After Reading
- Max 50KB Payload Size
- Up to 60 Days TTL
Self-Hosted
Own your infrastructure. Fork the repository and deploy EnvGuard entirely on your own domain and database.
- 100% Open Source Code
- Bring Your Own Supabase
- Custom TTL Limits
- Full Audit Control
Frequently Asked Questions
Can EnvGuard read my environment variables?
Where is the decryption key stored?
What happens when a link expires?
How does the 2FA Password work?
Built to solve real developer friction.
EnvGuard was architected and built by a full-stack developer based in India, driven by a simple frustration: passing sensitive deployment credentials across development teams was inherently unsafe.
Relying on chat platforms or email to transmit STRIPE_KEYS or DATABASE_URLS leaves permanent footprints on third-party servers. EnvGuard was created to eliminate that footprint entirely.
Secure your environment today.
No signups. No credit cards. Just pure, mathematically sound client-side encryption.
Create Secure Link