Zero-knowledge .env sync

Your .env, everywhere.Encrypted before it leaves your machine.

Stop pasting secrets into chat.

npm i -g @xnah/hush

hush, zshdemo

Nothing leaves your machine until you run hush push, and then only ciphertext does. Values in this demo are masked exactly the way the CLI masks them.

How it works

Encryption is a local step, not a server feature.

hush does the crypto on your machine. The API moves opaque blobs and has no code path that turns one back into a .env file.

01
Encrypt locally
hush derives your key with Argon2id, encrypts the whole file with XChaCha20-Poly1305, and only then opens a connection. The plaintext never touches the network.
02
Sync ciphertext
The server stores an opaque blob, its size, a timestamp and who pushed it. Every push is a new immutable version, and only the newest few are kept.
03
Decrypt on any machine
Pull on a new laptop, a CI runner or a teammate's box. Each device unwraps the project key with its own private key and writes the .env back on that machine alone.

Features

Small surface, sharp edges.

Six things you will actually use, and nothing that needs a settings page.

Zero-knowledge

The server holds ciphertext, a size and a timestamp, never a key. Encryption happens in the CLI, before the request exists, with libsodium primitives and no homegrown crypto.

Diff and history

Every push is a numbered, immutable version. hush diff shows what changed with values masked, and hush history shows who pushed what, and when.

Missing-variable check

hush check names the variables your local file is missing before you deploy, and exits with code 4 when the two sides disagree, ready for pre-commit or CI.

`hush run` without files

hush run -- npm run dev injects the environment straight into the child process. Nothing is written to disk, which is what shared laptops and CI runners want.

Team invites

Invite by GitHub handle. The project key is sealed to that person's public key, so access is per-person and revocable instead of a password pasted into a group chat.

Rollback

hush rollback 3 restores an earlier version to your machine, and you can push it forward as a new version so the history never lies about what happened.

Candour

What the server can see.

We would rather hand you the whole list than let you guess at it. Everything in the right column is already unreadable before the request leaves your machine.

Sees

Project and environment names
Size of every stored version
Timestamps, created, pushed, pulled
Which account pushed which version
Your GitHub handle and avatar URL

Never sees

Variable names
Variable values
The project key
Your private key
Your passphrase
The recovery key

The left column is what audits, rate limits and billing need. It is not enough to reconstruct a single secret, there is no code path on the server that holds one.

Read the security model

Two minutes from here to a synced .env.

Install the CLI, approve this device once, push a version. Every machine after that pulls ciphertext that only your key can open.