What happened to EnvKey
A tool that shut down, and what to reach for instead
This page used to be a comparison. It can’t really be one any more, because EnvKey is gone.
Dane, who built it, announced the wind-down in August 2024 after nearly seven years, on the honest grounds that running it had stopped being financially sustainable. EnvKey Cloud carried on for another six months and stopped serving on 1 February 2025, and the company was dissolved. At the time of writing, envkey.com doesn’t resolve at all.
I’ve rewritten this page rather than quietly deleting it, because people still search for EnvKey and a 404 helps nobody.
It was a good tool
Worth saying plainly, because a competitor shutting down is not something to be smug about. EnvKey was properly built. End-to-end encrypted config that synced across machines, role-based access per app and environment, a real audit trail, and an MIT licence on the whole thing. It was sized for small and mid-sized teams who wanted something more serious than passing .env files around in Slack, and it did that job well without demanding you stand up a HashiCorp Vault cluster first.
It’s a reminder that a tool being good is not the same as a tool being a viable business, which is a thing I think about fairly often as someone selling a small piece of software.
What is actually left
The code. EnvKey was MIT licensed and the repository is still sat on GitHub, so you can clone it and run the whole platform yourself, for free, forever if you like.
Be clear-eyed about what that means now, though. The last commit was August 2024. There is no company behind it, nobody is triaging security reports, and no one is shipping a fix if a dependency turns out to have a hole in it. Self-hosting an abandoned secrets platform is a much bigger commitment than self-hosting a maintained one, and secrets infrastructure is about the worst place to take on that kind of debt. Some teams will still do it, and for a frozen internal deployment that never touches the internet it’s a defensible call. Most people should move.
Where EnvKey’s users went
| If you used EnvKey for | Have a look at |
|---|---|
| Team secrets sync, self-hosted | Infisical, which built the migration tooling when EnvKey wound down |
| Team secrets sync, hosted | Doppler, or Infisical Cloud |
| Getting secrets into CI and production without plaintext in git | dotenvx |
| Credential brokering at platform scale | HashiCorp Vault, or OpenBao if you want it under an open-source licence |
Editing the .env files on your own Mac |
Dotvault, but read the next bit first |
Infisical is the closest like-for-like, and it’s the one EnvKey’s own users were pointed at, so it’s the sensible first stop.
Dotvault is not an EnvKey replacement
I want to be direct about this, because it would be easy to be weaselly and it would also be useless to you.
If you were using EnvKey, the thing you were buying was team sync: one canonical set of values, encrypted, pushed out to every machine and environment that needed them, with controls over who could see what. Dotvault does none of that. There’s no server, no sync, no accounts, no sharing, and no way to hand a teammate a secret. If that’s the hole EnvKey left in your setup, Dotvault will not fill it, and you should go and look at Infisical.
What Dotvault is for
The other half of the problem, the one EnvKey never really touched.
Even on a team with a proper secrets platform, every developer still ends up with a local .env or .env.local on their own machine that they edit by hand. That file drifts. It picks up a value you meant to change back. Something breaks and you can’t remember what it looked like this morning. Dotvault is a macOS app for exactly that file: snapshots of every save so you can go back, side-by-side diffs, inline notes so you remember what a variable was for, and framework awareness so it knows a Laravel .env from a Next.js one.
It’s a one-time purchase with twelve months of updates included, no account, and nothing of yours leaves your Mac. Which is a much smaller promise than EnvKey made, and a much smaller product. That’s rather the point: there’s less of it to shut down.