v1.0.9 on npm  ·  MIT License  ·  Node.js 18+

Stop DMing
.env files.

End-to-end encrypted .env file sharing for developer teams. The decryption key never touches the relay server. One pull and the payload is gone — no accounts, no setup, no risk.

share-env is the safest way to share dotenv files, share .env files, or transfer dot env files between developers — replacing the dangerous practice of pasting secrets into Slack or email.

See how it worksCLI referenceCompare tools
Copied!
$npx share-env pushclick to copy
zsh — ~/projects/my-app — share-env
AES-256
GCM authenticated encryption
0
accounts, config or API keys needed
10m
TTL — auto-deleted if uncollected
1×
pull only — burned after reading

The Problem

Your secrets deserve better than a Slack message.

Every day, developers share .env files via chat, email, and shared docs. Those secrets live in logs and history forever. This is the single biggest source of accidental secret exposure in development teams.

The dangerous way (what most teams do)
  • Paste .env file contents into Slack / Discord
  • Email the dotenv file as an attachment
  • Share a Google Doc with API keys visible
  • Commit .env to git "just this once"
  • Screenshot the env file and send it
share-env — secure .env file sharing
  • AES-256-GCM encrypted before leaving your machine
  • Relay server sees only ciphertext — never the key
  • Payload deleted on first pull (burn-after-reading)
  • Auto-expires after 10 minutes if uncollected
  • Blocks the tool if .gitignore does not cover .env

How it works

Three steps. Ten seconds.

01

Push

Run npx share-env push. Your .env file is encrypted with AES-256-GCM locally. Only ciphertext goes to the relay.

$ npx share-env push
02

Share the code

Send the one-time share code (phrase#key) via Slack, Signal, or email. The code is useless without the key portion.

apple-brave-cloud#a3f9b2...
03

Pull

Your teammate runs npx share-env pull <code>. The .env is decrypted locally. The payload is permanently deleted.

$ npx share-env pull <code>
Full flow explanation →

Trust & Security

Built to be auditable.

Every line of the encryption logic is public. You can verify share-env does exactly what it claims.

Verified encryption

AES-256-GCM is implemented using Node.js's built-in crypto module — no third-party encryption library. Source is public and auditable.

Open source (MIT)

The entire codebase is MIT licensed and publicly available on GitHub. Fork it, audit it, self-host it. No black boxes.

Self-hostable relay

Run your own relay server on any Node.js host. The CLI's --server flag lets you point to any URL. Complete control.

Zero-knowledge design

The relay server stores only ciphertext. The 256-bit AES key travels exclusively in your share code — not through the relay.

Git guardrail (mandatory)

share-env refuses to run if your .gitignore does not cover .env. The guardrail cannot be disabled or bypassed.

No data retention

Payloads are stored in relay memory only. No database, no logs, no persistence beyond the 10-minute TTL.

Common Questions

Questions about .env file sharing.

What is share-env and how does it work?
share-env is a free CLI tool for securely sharing .env files (dotenv files) using AES-256-GCM encryption. Run npx share-env push to encrypt and upload your .env to a zero-knowledge relay. Share the one-time code with your teammate. They run npx share-env pull <code> to decrypt it locally. The payload self-destructs after one pull.
Is it safe to share .env files on Slack?
No. Sharing .env files on Slack exposes them to permanent message logs searchable by admins, potential workspace breaches, and third-party bot access. Use share-env instead — it encrypts your dotenv file before upload, and the relay server never sees the decryption key.
How do I share a .env file securely with my team?
Run npx share-env push in your project directory. Send the generated share code via any channel. Your teammate runs npx share-env pull <code>. The .env is decrypted locally — the relay server only ever stored unreadable ciphertext.
Does share-env work without installing anything?
Yes. Run share-env directly with npx — no global install needed. Requires only Node.js 18+.
See all 20 FAQ answers →
Related searches & topics
.envdotenvdot envshare envenv share.env file sharingshare .envshare dot env.env sharedot env file shareshare dot env filesafely share dot env file.env file share safelysecure .env sharingencrypted dotenvshare environment variablesnpx share-envshare-env npmdotenv encryptionAES-256-GCM dotenv.env securitydotenv best practicesenv file transfershare .env without slack.env nodejs.env nextjs.env react.env dockerdotenv npm packageenv file collaborationzero knowledge .envburn after reading envone-time .env shareephemeral env sharingself host relay serverdotenv mergeenv conflict resolution.env gitignoresecure secret sharing clideveloper secret sharing

Get started now

One command to share your .env safely.

No install. No account. No risk. Works anywhere Node.js 18+ is available.

bash
$ npx share-env push
Read the docs →Security modelCompare tools