What Dotvault actually does

Your .env files are not encrypted, and that is on purpose

Start here, because it is the thing most likely to be misunderstood. A normal .env file in your project stays exactly where it is, as plain text, readable by anything that can read the folder. Dotvault does not encrypt it, and it should not: your framework, your test runner and your Docker build all need to read that file. An editor that silently encrypted it would break every one of them.

What Dotvault encrypts is its own snapshot history, and any Laravel encrypted env files you ask it to open. Those two are below.

Snapshot history

Every time you save, Dotvault keeps a snapshot so you can roll back. Those snapshots hold the full contents of your file, so they are encrypted at rest.

• Cipher: AES-256-GCM, which is authenticated, so tampering with stored ciphertext is detected rather than silently decrypted into nonsense.
• IV: 12 random bytes, generated fresh for every single snapshot and stored alongside it. Never reused.
• Where the ciphertext lives: a SQLite database in the app's own support directory, not in your project folder and not in your repo.
• Where the key lives: 32 random bytes, generated on first run, written to a file in that same directory and encrypted with Electron's safeStorage. On macOS safeStorage keeps its master key in the Keychain, so the Keychain protects the key that protects your key.

I have said elsewhere that "the key is in your Keychain". That is close enough to be defensible and not quite accurate, so the sentence above is what you will actually find on disk if you go looking. Decrypted snapshot contents exist only in memory, and only for as long as it takes to show them to you.

Laravel encrypted env files

Dotvault opens and edits Laravel's encrypted env files natively, without shelling out to PHP or artisan. It implements Laravel's own format rather than inventing one, so a file Dotvault writes is a file php artisan env:decrypt can read.

• Ciphers: AES-256-CBC and AES-128-CBC, selected from your key length, matching Laravel.
• Integrity: HMAC-SHA256, compared in constant time.
• Keys: stored per file, scoped by absolute path, in the app's database and encrypted with safeStorage like the snapshot key. Path scoping means renaming a project or re-adding it does not lose the key.

Everything that leaves your machine

Dotvault is not an offline app, and I should stop implying it is. It makes five kinds of request. None of them carry the contents of your env files, your key names, your values, your file paths or your project names. Here is all of it.

What happens when you are offline

Day to day, nothing. Every feature that touches your files works with no network at all: editing, snapshots, diffs, git integration, encryption and decryption. Go on a plane and the app does not care.

Licensing is the one thing that reaches the network, and it fails open. Dotvault revalidates every time it starts, and roughly weekly after that. If it cannot reach the licence server, for an hour or for a year, it carries on working on the last good check and keeps your licence on disk, so there is nothing to reactivate when you reconnect.

Two things can lock a licensed copy, and a failed request is not one of them. The first is the licence server positively saying the licence is no longer valid, after a refund or a deactivation. The second is your Mac's clock going backwards by more than an hour, which Dotvault reads as someone winding a date back rather than as a normal day. That one clears itself the moment the clock is right again. A network failure never locks anything, because being offline is not evidence of anything and I am not willing to lock you out of your own secrets over an outage on my side.

Checking that what you downloaded is what I built

Dotvault is signed with my Apple Developer ID and notarised by Apple. That is the check worth doing, because Apple verifies the signature against a certificate I had to prove my identity to obtain. Run this against the installed app:

spctl -a -vvv -t install /Applications/Dotvault.app

Word for word, that should give you:

/Applications/Dotvault.app: accepted
source=Notarized Developer ID
origin=Developer ID Application: Will Wilson (RR6BMR5766)

My Apple Team ID is RR6BMR5766, and it is baked into the binary rather than something I can just assert here. If that last line names anyone else, you did not get the app from me. If you would rather read it straight from the signature,codesign -dv /Applications/Dotvault.app prints the same team identifier.

Every release also publishes a SHA-256 of the disk image next to it, so you can confirm the download completed intact:

shasum -a 256 ~/Downloads/Dotvault-latest.dmg
curl -s https://releases.dotvault.dev/Dotvault-latest.dmg.sha256

Be clear about what that proves, though. The checksum and the download come from the same server, so it catches a truncated or corrupted file, not someone who has taken over that server. The signature check is the one that would catch that, because I cannot forge Apple's notarisation and neither can anyone else. Use the checksum for integrity and spctl for trust.

What Dotvault does not protect you from

Every tool has a boundary, and pretending otherwise is how people get caught out. Dotvault's job is to stop your secrets sitting on someone else's server and to give you history and visibility over files you were previously editing blind. It is not a defence against these:

• A compromised Mac. Anything running as you can read your .env files directly, because they are plain text and they have to be. Malware does not need to go through Dotvault, and encrypting snapshots does not help once an attacker is already inside your session.
• Someone with your unlocked machine. App lock and Touch ID raise the bar on a borrowed laptop. They are not a serious obstacle to anyone with time and your logged-in account.
• Losing your encryption key. If you lose the key to a Laravel encrypted file and have no copy anywhere else, that file is gone. There is no recovery, no backdoor and no reset link. That is encryption working, not failing.
• Committing a secret to git. Dotvault warns you and helps you clean up, but it cannot reach into a repository you have already pushed. Rotate the key.
• A leak somewhere else entirely. A key pasted into a chat, sitting in your shell history, or printed by a CI log is not something a local editor can see.