EnvVault
Secure environment variables
Keep developer secrets in macOS Keychain, rotate them on time, and move between environments safely.
The Problem
API keys often end up scattered across notes, messages, and plain-text .env files, where they can be difficult to rotate and easy to copy into the wrong project or commit to Git. Managing several environments makes that risk harder to see.
The Solution
EnvVault keeps secret values in macOS Keychain while providing a separate dashboard for projects, environments, expiry dates, and rotation status. Production confirmation gates, clipboard clearing, and .gitignore checks add safeguards to everyday import, export, and copy workflows.
What you get
Keychain-backed secrets
Store API keys, tokens, and environment variables exclusively in macOS Keychain rather than a plain-text file, SwiftData, or a server.
Rotation and expiry dashboard
Track credential age, provider expiry dates, upcoming rotations, and overdue secrets without exposing their values.
Projects and environments
Group secrets into local, development, staging, and production environments, with extra confirmation gates for production-sensitive data.
.env import and export
Import common .env file variants and export a selected environment with an added Git safety warning for production.
Clipboard and Git safeguards
Automatically clear copied secrets after 30 seconds and check whether the project’s .gitignore covers .env patterns.
Quick access and optional sync
Search projects and copy keys from the menu bar, with optional iCloud sync that encrypts the complete vault on your Mac before upload.
Questions
- Where does EnvVault store secret values?
- Secret values are stored exclusively in macOS Keychain. They do not touch a plain-text file, SwiftData, or a developer-operated server unless you explicitly export them to a .env file.
- Do I need an account or cloud service?
- No. EnvVault has no account, analytics, or backend. Optional iCloud sync encrypts the complete vault on your device before it is uploaded.
- Which .env files can I import?
- EnvVault can import files such as .env, .env.local, .env.dev, and .env.production, then export an environment back to a .env file when needed.
- Which Mac versions are supported?
- EnvVault requires macOS 14 or later.
Try EnvVault
Keep developer secrets in macOS Keychain, rotate them on time, and move between environments safely.