A progressive toolkit for environment secrets
dotsync keeps every .env in sync across your team in real time. Encrypted on your machine with AES-256-GCM, keyed by Argon2id, and unreadable by the server — self-host it or use ours.
curl -fsSL https://dotsync.onrender.com/install | bash1Everything a team needs, nothing it doesn't
A small, sharp surface area built for engineers who already know what they want from a secrets workflow.
Zero-knowledge encryption
Every value is sealed with AES-256-GCM before it leaves your machine. The server stores ciphertext it can never open.
Real-time sync
Push once and every teammate's shell picks up the new revision in under a second — no Slack pastes, no stale files.
Argon2id key derivation
Passphrases become keys through memory-hard Argon2id, so brute-forcing a stolen vault stays economically hopeless.
CLI-first workflow
init, push, pull, run, diff, history. Everything is one command, scriptable in CI, and friendly to your muscle memory.
Versioned history
Every push is a revision. Diff any two, roll back a bad deploy, and see exactly who changed which key and when.
Offline-safe
Local vault cache keeps builds green when the network is down, then reconciles cleanly the moment you're back.
Four layers, one trust boundary
The boundary sits on your laptop. Everything past it only ever sees bytes it cannot interpret — which is what makes self-hosting an infrastructure choice, not a security one.
CLI client
Reads your .env, resolves project + environment, and never transmits plaintext.
Crypto layer
Argon2id derives the vault key from your passphrase; AES-256-GCM seals each value with its own nonce.
Sync engine
Revision-based diffing pushes only the ciphertext that changed, then streams updates to subscribed clients.
Storage node
Ours or yours. It holds opaque blobs, access policy and audit metadata — and nothing readable.
Built for teams that read the source
No dashboard tour required, no seat math, no vendor holding your secrets in the clear.
How to verify: clone the repo, run dotsync push --dry-run and inspect the request body — it contains ciphertext only.
Open source, in the open
Every decision lands as a public issue. Every release ships with a signed checksum.
Docs written by the people who ship it
Short pages, runnable examples, no marketing filler in the middle of a code block.
Teams that stopped
pasting secrets
Feedback from engineering teams running dotsync in production.
“We deleted a shared 1Password vault, a pinned Slack thread and a Notion page the week we adopted dotsync. Onboarding a new backend dev went from an afternoon to one command.”
“The part that sold our security team was boring: the server never sees plaintext, and they could read the code that proves it in an afternoon.”
“dotsync run — is now in every one of our Makefiles. Nothing hits disk, CI stopped leaking envs into build logs, and rollbacks are a revision number.”
Your next .env should sync itself
Free forever for hosted use, MIT licensed, and one command away.
curl -fsSL https://dotsync.onrender.com/install | bash