Securing Your .env: A Look at envcrypt
The Problem
.env files are a developer's dumping ground for sensitive secrets—API keys, database URLs, tokens, you name it. They're convenient but dangerous. One accidental git add or an overeager AI tool scanning your project can expose everything. Encrypting these files manually is annoying and error-prone. You need something simple, fast, and reliable to make sure your secrets stay secret.
What This Does
envcrypt encrypts your .env file so you can keep it in your project without sweating over accidental leaks. The core is a Rust-based CLI (envcrypt/src/main.rs) for encrypting, decrypting, and managing secrets, paired with a library (envcrypt-lib/src/lib.rs) to seamlessly load encrypted .env files in Rust projects. If you’re working in Python, there’s an experimental loader (envcrypt-py/envcrypt/loader.py) that lets you deal with encrypted .env files too.
Encryption uses AES-256-GCM, so you get authenticated encryption—no silent data corruption nonsense. Keys are stored in ~/.envcrypt.yaml and can either be randomly generated or provided as a specific 64-character hex value. Encrypted values in .env files are prefixed with encrypted: for easy identification, while plain values are left untouched.
The CLI is where the real action happens. You can initialize, encrypt, decrypt, and even handle single-value encryption directly. Need to modify a file in-place? There’s a flag for that. Want to check if your .env is encrypted? envcrypt status has your back.
Real-World Use
Say you’ve got a Rust app with sensitive configuration values. Here’s the workflow: Encrypt your .env file with the CLI: Add the envcrypt-lib dependency to your project via Cargo.toml: Load the encrypted .env at runtime:
Now your app uses encrypted secrets without needing to rework how you handle environment variables.
The Bottom Line
envcrypt is great if you’re paranoid about secret leaks and already working in Rust. The encryption is solid, and the CLI is straightforward. Python support feels half-baked, so keep your expectations low on that front. For huge enterprise setups with proper secret management tools (e.g., Vault), this might be overkill. But for small-to-mid projects or solo devs who want an extra layer of protection, it’s a solid choice. Just don’t forget to back up your key—losing it means you’re screwed.