Lock your secrets locally.
Use them everywhere.
Open-source CLI for local-first, encrypted, and stream-safe secret management. Install with pip install envlockr
Key Features
Local-First Security
Secrets encrypted on your machine with Fernet authenticated encryption. The master key lives in your OS keychain — disk access alone gets an attacker nothing.
One Vault, Every Project
Stop copying .env files between repos. Add STRIPE_KEY once, then envlockr run injects it in any project — React, Python, Node, Docker, all of them.
Key Liveness Checks
envlockr verify pings each provider — Stripe, OpenAI, Anthropic, GitHub, Slack — and flags revoked or rotated keys before they break production.
Stream-Safe Mode
No .env on screen while coding, streaming, or screen-sharing. run injects secrets into the process — nothing visible, nothing on disk.
Built for the AI-agent era
Vibe coding with Claude Code, Copilot, or Cursor? Every plaintext .env in your repo is readable by any tool you point at it. EnvLockr keeps values out of reach.
- Agents use keys they can't read. Secrets are injected into the child process at spawn — never printed, never written to disk, never in the agent's context window.
- No .env to leak. Nothing to accidentally commit, screen-share, or slurp into a prompt.
- True story: EnvLockr v2.0.0 was published to PyPI by an AI agent using
envlockr runto inject a publish token it was never able to see.
How It Works
# 1. Install (keychain extra = key in OS credential store) pip install "envlockr[keychain]" # 2. Store your keys — or migrate an existing .env envlockr add STRIPE_KEY envlockr import .env && rm .env # 3. Run anything with secrets injected — no .env on disk envlockr run -- npm run dev # 4. Check which keys are still live envlockr verify
Use with your favorite frameworks
# same vault, every project cd ~/projects/next-app && envlockr run -- npm run dev cd ~/projects/api-python && envlockr run -- python app.py cd ~/projects/legacy-tool && envlockr export --output .env # npm workflows too — wrapper on npm proxies to the CLI npm install -g envlockr # package.json: "dev": "envlockr run -- next dev"
How EnvLockr compares
Each feature exists somewhere. The combination doesn't.
| Capability | EnvLockr | dotenvx | envchain | 1Password CLI |
|---|---|---|---|---|
| Local-first, no account | ✔ | ✔ | ✔ | ✘ paid |
| Master key off-disk by default | ✔ | manual setup | ✔ | ✔ |
| Windows keychain support | ✔ | manual | ✘ | ✔ |
| Run command, no .env written | ✔ | encrypted file | ✔ | ✔ |
| Verify stored keys still live | ✔ | ✘ | ✘ | ✘ |
| .env import / export | ✔ | ✔ | ✘ | templates |
| Free & open source | ✔ MIT | ✔ | ✔ | ✘ |
Need team sync, RBAC, and audit logs? Use Infisical or Doppler — genuinely. EnvLockr is for solo devs and small projects that don't want a cloud dependency.
Honest crypto, no buzzwords
What's encrypted, and how
Secret values are encrypted with Fernet (AES-128-CBC + HMAC-SHA256 authenticated encryption, via the audited Python cryptography library) and stored in ~/.envlockr/vault.json.
Password-protected vault exports use PBKDF2-HMAC-SHA256 with 600,000 iterations and a random per-file salt.
Where the key lives
With the keychain extra, the master key sits in Windows Credential Manager, macOS Keychain, or libsecret — reading vault.json alone is useless to an attacker.
No keychain available? EnvLockr falls back to a 0600 key file and warns you about it — no silent downgrades. Full security policy →
Stop leaking keys. Start in 30 seconds.
pip install "envlockr[keychain]"