.env Encryption Tool

A .env file that holds a live Stripe key is a file that cannot be committed, emailed, or stored on a shared drive safely. The .env Encryption Tool changes that: it wraps secret values with AES-256-GCM using a passphrase, turning them into opaque ENC: tokens while leaving the rest of the file intact.

Encryption happens entirely in the browser with the Web Crypto API. A PBKDF2 key derivation means a strong passphrase is all the protection the file needs; AES-GCM adds authentication, so tampered or mistyped ciphertext is detected instead of silently mis-decrypted.

You choose the strategy: encrypt every value for a fully locked file, or encrypt only listed keys and keep a readable companion file for the rest. Decryption is one click with the same passphrase.

• AES-256-GCM: authenticated encryption per value.
• PBKDF2 key derivation: passphrase to key.
• ENC: tokens: encrypted values are clearly marked.
• Encrypt all or by key list: your choice.
• Tamper detection: GCM tag verifies integrity.
• Decrypt with passphrase: round-trip supported.
• Base64 output: portable and shareable.
• 100% client-side: Web Crypto, no upload.

1. Paste your .env into the input and choose what to encrypt (all values or a key list).
2. Enter a passphrase — make it long; the key is derived from it.
3. Click Encrypt. Secret values become ENC: tokens.
4. To read it back: switch to Decrypt, paste the output, enter the same passphrase, and click Decrypt.

Example 1 — Sharing config on a drive. A team keeps an encrypted .env on a shared drive. Passphrase is shared once in the team password vault; keys are useless to anyone else.

Example 2 — Shipping a demo bundle. A demo archive includes an encrypted .env, so the live keys survive transit even if the bundle leaks.

Example 3 — Selective wrapping. Only DATABASE_URL and API_KEY get encrypted; APP_NAME and PORT stay plaintext and greppable.

Example 4 — Backup at rest. A nightly config backup is encrypted with a vaulted passphrase before landing on the backup server.

Example 5 — Wrong passphrase test. A teammate pastes the encrypted file and a wrong passphrase; the tool reports authentication failure instead of garbage output.

• Offline protection: no server, no account.
• Real crypto: AES-256-GCM + PBKDF2 in your browser.
• Selective or full: match your threat model.
• Authenticated: tampering is detected.
• Portable: plain base64 output.
• Free: use as often as needed.