Protection modes
Simple encrypts in the browser. Advanced encrypts on your machine. We store ciphertext only.
Last updated: 2026-09-20
Simple Protection
Simple Protection encrypts secret values in your browser before upload. Setup stays in the dashboard.
On our servers
We store ciphertext and an encrypted key blob. Never your Vault password or readable secrets. Unlock on each device with your Vault password.
Advanced Protection
Advanced Protection encrypts secret values on your machine with the CLI before anything reaches getmyenv. Choose this when you want encryption outside the browser.
On our servers
We store ciphertext, deliver it to approved machines, and enforce access. We never receive readable secret values.
On our servers
We never see your Vault password or plaintext secrets - only encrypted data. After a secret is loaded into your app process, that process holds it.