Vault

Encrypt in the browser or CLI. We store ciphertext only. Forget the password with no backup and the vault is gone.

Last updated: 2026-09-21

One vault model

Each project has one vault. Encrypt secret values in the browser (dashboard) or on your machine (CLI). Same encryption model in both.

On our servers

We store encrypted values and an encrypted copy of the project key. Never your Vault password or readable secrets. Unlock on each device with your Vault password.

Another machine

On another machine, pull (Development) or run asks for token and link if missing. Production CLI is read-only. See /docs/install and /docs/first-project.

Development may cache the wrapped project key locally after unlock. Production never caches it.

If you forget the password

Forget your Vault password with no backup and the vault is gone. Recovering account login does not recover vault access.

An encrypted .getmyenv backup is the recovery path. Create one from the dashboard Backups page or npx getmyenv backup, then restore with the Vault password that was used for that backup.

Once your app has the secret

After a secret is loaded into your app process, that process holds it.