Your .env files, encrypted,
on every Mac you own.

eVault is a native macOS vault for environment files and secrets. It syncs through your own iCloud, never through our servers, because we don't have any.

Download for macOS Source on GitHub

macOS 14 or later. Free tier included; no account required.

Zero-knowledge by construction

Encrypted before it leaves memory

Every revision is an immutable AES-256-GCM file. Your passphrase derives the key on your Mac. iCloud, Dropbox or git only ever carry ciphertext.

No conflict copies, ever

Files are never overwritten, so any sync service works and offline edits on two Macs merge cleanly. Full history and restore come free.

Touch ID, auto-lock, clean clipboard

Unlock with Touch ID, lock on sleep, and copied secrets are hidden from clipboard managers and cleared automatically.

Recovery key

Forgot the passphrase? A one-time recovery key gets you back in. Lose both and the vault is unrecoverable, by design.

Sandboxed, no network

The app has no network entitlement. Sync happens through iCloud Drive or CloudKit, both handled by macOS, not by eVault.

Open core

The vault format and crypto are open source. Read the threat model, audit the code, build it yourself.

Built for the terminal too

$ evault link my-saas .env.local       # bind this directory to an env file
$ eval "$(evault hook zsh)"            # variables load on cd, unload on leave
$ evault run my-saas .env -- npm start # or inject just for one command
$ evault deploy vercel my-saas .env.production --target production
$ evault scan .                        # find secrets committed by mistake
$ evault example my-saas .env > .env.example

Pricing

Free

$0
  • 3 projects, unlimited env files
  • Folder sync (iCloud Drive, Dropbox, git)
  • Editor, history, restore, Touch ID
  • Full CLI
Download

Pro

$29 one-time
  • Unlimited projects
  • iCloud sync with CloudKit
  • Menu bar quick copy
  • Developer tools: env diff, .env.example, secret scan, JWT, generators
  • Shell integration
  • Updates for one year
Buy Pro

Checkout and invoicing by Polar. Your key arrives by email within a minute; 14-day refunds. Lost your key?

Team

Coming
  • Share projects with teammates
  • Per-member keys, no shared passphrase
  • Audit log of who pulled what
  • Rotation reminders
Join the waitlist

How sync works

A vault is a folder. vault.json holds your key-derivation parameters and the vault key, wrapped by a key derived from your passphrase. Every change to an item writes a new .evr file that is never modified again. Two modes:

Folder

Put the vault in iCloud Drive, Dropbox, Syncthing, or a git repo. Works with the free tier and needs no account.

iCloud (Pro)

The vault lives in the app and mirrors to your private CloudKit database. Other Macs on your Apple Account open it with the passphrase.