How it works

Zero-knowledge relay in three steps.

The decryption key travels exclusively inside the share code — the relay server is completely blind to it.

Developer A — Sender
  • 1Generate random 256-bit key in local memory
  • 2Generate random 96-bit IV
  • 3Encrypt .env with AES-256-GCM
  • 4POST ciphertext + IV + auth tag to relay
  • 5Build share code: phrase#hexKey
  • 6Send code via Slack / Teams / Signal
ciphertext
only
Relay Server (blind)
  • AReceives & stores ciphertext only
  • BReturns 3-word phrase identifier
  • COn GET: returns encrypted payload once...
  • D...then permanently deletes it
  • EAuto-expires payloads after 10m TTL
  • FRate limit: 10 req/min per IP
encrypted
payload
Developer B — Receiver
  • 7Run npx share-env pull <code>
  • 8Parse share code: phrase + key
  • 9GET relay using phrase only (no key)
  • 10Decrypt locally using extracted key
  • 11Smart-merge into existing .env
  • 12Write merged result to disk

Features

Built with security non-negotiable.

Zero-Knowledge Encryption
AES-256-GCM key is generated locally and never transmitted. A fully compromised relay yields only unreadable ciphertext.
Burn-After-Reading
Payload is permanently deleted from the relay the moment it is pulled. It cannot be retrieved a second time by anyone.
Smart Merge
Detects conflicts key-by-key when you already have a .env and lets you interactively choose local or remote values.
Git Guardrails
Refuses to run unless your .gitignore explicitly ignores .env and .env.* — blocking accidental secret commits.
Zero Setup
No global install, no accounts, no config files. Run via npx share-env. Requires only Node.js 18+.
10-Minute TTL
Share codes expire after 10 minutes. Uncollected payloads are permanently purged — nothing lingers.