Snapshots and history

Dotvault keeps a complete local history of every .env file you edit. You don’t have to opt in, tag anything, or remember to capture a version — snapshots happen automatically, every time you save.

What a snapshot is

A snapshot is an encrypted copy of a file’s contents at a single point in time. Snapshots live in Dotvault’s local database and are encrypted with AES-256-GCM. The encryption key sits in the macOS Keychain via Electron’s safeStorage API, which means snapshot contents never touch disk in plaintext and never leave your machine.

When snapshots are taken

• Initial snapshot. The first time you open an env file, Dotvault captures a snapshot of its current state. Even after your first edit, you can still roll back to exactly how the file looked when you found it.
• On save. Every time you save a file, Dotvault creates a new snapshot of the saved contents.

There’s no manual “take snapshot” button, and no limit you need to worry about. Just edit and save like normal.

Browsing history

Open the History tab for the current file and you’ll see the snapshots listed in reverse chronological order. Each entry shows when it was taken. Click one to view its contents.

Restoring a previous version

Find the snapshot you want in the History tab and click the restore icon. Dotvault loads that snapshot’s contents into the editor as unsaved changes — it doesn’t immediately overwrite the file on disk. This gives you a chance to look the restored contents over, tweak anything, and press Cmd+S only when you’re sure. If you change your mind, Cmd+Z or just don’t save.

Because restore goes through the normal save path, the restored version itself produces a new snapshot on save. You never lose the version you were sitting on before you hit restore.

Diffing between versions

Comparing two snapshots is how you answer questions like “what changed between yesterday and now?” or “which keys did I add this afternoon?”. Select the snapshots you want to compare from the History tab and Dotvault shows the differences side by side.

For comparing across files rather than across time — dev vs production, say — use the Diff tab instead.

What happens if you reinstall

Snapshots are encrypted with a key held in the macOS Keychain. If you reset your Keychain or reinstall macOS, all snapshot history is permanently lost. Your actual .env files on disk are completely unaffected — only Dotvault’s version history goes. If you’re migrating to a new Mac, migrate your Keychain along with the Dotvault data directory at ~/Library/Application Support/dotvault/.

Secrets safety

Snapshot contents never leave the main process in encrypted form, and raw secret values are never written to logs or devtools. If you’ve turned on app lock in Settings, unlocking the app is also required before any snapshot can be viewed or restored.