Is Dotvault an Electron app?

Yes, it is. You would find that out in about thirty seconds by opening the app bundle, so you may as well hear it from me first.

The trade is a straightforward one. Electron is the reason one person can ship this at all. The editor, the diff view, the comparison grid, the history panel and the git integration add up to a lot of interface for a solo developer, and building all of it twice would have meant building it half as well. What that costs you is memory and disk space, and an Electron app is never going to be as light as something written directly against AppKit. I would rather be honest about that than pretend otherwise.

What it does not cost is anything to do with your secrets. Nothing sensitive happens in the window you are looking at. File access, encryption and every git command run in the main process, in Node, and the decrypted contents of a file only ever exist in memory. Laravel’s encrypted env format is reimplemented there too — AES-256-CBC, HMAC verification, and the PHP serialisation Laravel expects on the way back out — which is why Dotvault opens an encrypted env file on a machine with no PHP and no artisan anywhere near it.

If you want the long version of why it stayed that way, I did try the alternative. I rebuilt Dotvault natively in Swift and SwiftUI, with GRDB underneath and CryptoKit for the encryption, and got it close enough to feature parity to be dangerous — and then deleted every line of it.

Two things killed it. The first was the env file parser: parse a file, write it straight back out, and you should get the same bytes you started with, comments and blank lines and disabled variables included. That is one shared piece of plain TypeScript here, and in Swift it was me re-earning every edge case by hand to arrive back where I already was. The second was the encryption. Porting a tested, working security boundary to CryptoKit meant taking all of the risk of getting encryption subtly wrong in exchange for a benefit you would never once see. Nobody has ever bought an env file manager because of which crypto library it links against.

The whole story is written up here, including the part where I admit the rewrite was fixing a problem I had rather than one you had. Electron and React are a slightly boring, well-trodden base, and boring is a compliment — it means the parsing, the diffing and the file watching are solved, and I get to spend the time on things you would actually notice.

Dotvault is signed with an Apple Developer ID and notarised by Apple, and the security page lists every network request the app makes, which is the part I would actually want to check if I were you.