open source · v1.0 · MIT

A progressive toolkit for environment secrets

dotsync keeps every .env in sync across your team in real time. Encrypted on your machine with AES-256-GCM, keyed by Argon2id, and unreadable by the server — self-host it or use ours.

$curl -fsSL https://dotsync.onrender.com/install | bash
zero-knowledge by design sub-second propagation self-hostable
1
● livezero-knowledgeAES-256-GCMrev #48
Features

Everything a team needs, nothing it doesn't

A small, sharp surface area built for engineers who already know what they want from a secrets workflow.

Zero-knowledge encryption

Every value is sealed with AES-256-GCM before it leaves your machine. The server stores ciphertext it can never open.

Real-time sync

Push once and every teammate's shell picks up the new revision in under a second — no Slack pastes, no stale files.

Argon2id key derivation

Passphrases become keys through memory-hard Argon2id, so brute-forcing a stolen vault stays economically hopeless.

CLI-first workflow

init, push, pull, run, diff, history. Everything is one command, scriptable in CI, and friendly to your muscle memory.

Versioned history

Every push is a revision. Diff any two, roll back a bad deploy, and see exactly who changed which key and when.

Offline-safe

Local vault cache keeps builds green when the network is down, then reconciles cleanly the moment you're back.

Architecture

Four layers, one trust boundary

The boundary sits on your laptop. Everything past it only ever sees bytes it cannot interpret — which is what makes self-hosting an infrastructure choice, not a security one.

Read the threat model
01

CLI client

Reads your .env, resolves project + environment, and never transmits plaintext.

02

Crypto layer

Argon2id derives the vault key from your passphrase; AES-256-GCM seals each value with its own nonce.

03

Sync engine

Revision-based diffing pushes only the ciphertext that changed, then streams updates to subscribed clients.

04

Storage node

Ours or yours. It holds opaque blobs, access policy and audit metadata — and nothing readable.

Why dotsync

Built for teams that read the source

No dashboard tour required, no seat math, no vendor holding your secrets in the clear.

ConcerndotsyncTypical SaaS
Plaintext on the server NeverUsually, at rest
Self-host the whole stack Yes, same binaryEnterprise tier
Works offline Cached vaultRarely
Time to first sync Under a minuteDashboard onboarding
Source you can audit MIT, all of itPartial or closed
Price for small teams $0Per-seat, monthly

How to verify: clone the repo, run dotsync push --dry-run and inspect the request body — it contains ciphertext only.

Community

Open source, in the open

Every decision lands as a public issue. Every release ships with a signed checksum.

0+
GitHub stars
0
Contributors
0%
Test coverage
0.0M
Syncs / month
Testimonials

Teams that stopped pasting secrets

Feedback from engineering teams running dotsync in production.

We deleted a shared 1Password vault, a pinned Slack thread and a Notion page the week we adopted dotsync. Onboarding a new backend dev went from an afternoon to one command.
MKMarta KovačStaff Engineer, Ledgerline
The part that sold our security team was boring: the server never sees plaintext, and they could read the code that proves it in an afternoon.
DRDev RamanathanHead of Platform, Corvus Health
dotsync run — is now in every one of our Makefiles. Nothing hits disk, CI stopped leaking envs into build logs, and rollbacks are a revision number.
AFAline FerreiraInfra Lead, Northbound

Your next .env should sync itself

Free forever for hosted use, MIT licensed, and one command away.

$curl -fsSL https://dotsync.onrender.com/install | bash