lockenv
A free command-line tool that encrypts your .env secrets file so you can safely commit it to Git, with a pre-commit hook that catches accidental leaks before they happen.
🔗 Visit lockenv
Description
Almost every team has the same secret-management problem: .env files hold API keys and passwords, so they can never be committed to Git — which means sharing them means Slack messages, shared drives, or a separate secrets tool to set up. lockenv encrypts the file itself with strong, modern cryptography so the encrypted version can live safely in Git right next to the code it belongs to, decrypted only by whoever holds the key.
lockenv is an open-source (MIT) Rust CLI using age encryption (X25519 + ChaCha20-Poly1305, ASCII-armored). A single `lockenv init` command generates a key, configures .gitignore, and installs a pre-commit hook that blocks accidental commits of unencrypted secrets. Beyond lock/unlock, it offers a `diff` command that compares two environments without ever printing the actual secret values, plus `audit`, `edit` and `example` commands. It needs no cloud account or SaaS subscription — everything runs offline — and ships as cross-platform binaries (Linux, macOS Intel/Apple Silicon, Windows) or via Cargo. Its README documents an explicit comparison against git-crypt, SOPS and HashiCorp Vault.
💬 Our review
The short version: lockenv is the fastest path from "our .env is a liability" to "our secrets are encrypted in Git" — one command, no cloud account required.
SOPS and git-crypt solve the same core problem but both demand more setup (key management conventions, GPG or KMS integration) before they're useful, and HashiCorp Vault is a full server you'd run and maintain just to hold secrets a small team could manage in a file. lockenv trades some of Vault's centralized access control for radical simplicity: one binary, one command, works fully offline. It's free, so the only real cost is that key distribution to new teammates is still a manual, ad-hoc step — fine for a small team, a friction point past a certain size. Worth adopting the moment you're tired of Slack-DMing .env files; reach for Vault instead if you need centralized, audited access control across a larger org.
💰 Pricing
📊 Global score
🤖 AI-enriched data
Gratuit, licence MIT
Pros
Zéro configuration réelle : une commande met en place chiffrement + filet de sécurité pre-commit
Aucune dépendance externe ni service cloud requis
Commande 'diff' unique qui compare des fichiers env sans exposer les secrets
Cons
Projet très jeune, adoption encore limitée
Pas de gestion/distribution de clé intégrée — le partage entre coéquipiers reste manuel
Mainteneur unique, pérennité non prouvée