Your .env files,
under control.

Yes. Snapshots are encrypted with AES-256-GCM, using a key held via Electron safeStorage and protected by your macOS Keychain. Your .env file contents, variable names, and values are never sent anywhere. Optional anonymous usage telemetry (off by default) only sends feature usage signals, never keys, values, or file contents. Full detail on the security page, including every network request the app makes.

Yes, and you would find that out in thirty seconds anyway. Electron is the reason one person can ship an editor, a diff view, a comparison grid and a git panel that all work; what it costs you is memory. Nothing sensitive happens in the window — file access, encryption and git all run in the main process, which is also where Laravel's encrypted format is reimplemented in Node so you never need PHP. I did rebuild the whole thing natively in Swift once, get it close to parity, and delete it — that story is here, and the short version of the trade-off is here.

No, neither. Dotvault is a standalone macOS app with a one-time licence key: no cloud account to create, no CLI to install, no ongoing service to depend on. Buying goes through Lemon Squeezy, who act as merchant of record and hold your name, email address and card details for the transaction. What comes back to me is your name, email and licence details, never your card. Enter your key, point it at a project folder, and you're working.

Nothing you'd notice on the day. Every tier includes twelve months of updates, and when that window closes the copy you have carries on working exactly as it did. You just stop receiving new releases until you renew. The licence key itself never expires, so there is no lock, no read-only mode, and no nagging.

Yes. Your licence doesn't lapse while you wait, so there's nothing to reactivate and nothing stops working in the meantime. There's no new key either: you buy a renewal and the date on the licence you already have moves. Nothing to paste, nothing to swap over. If you've left a gap, the twelve months run from the day you renew rather than from the day the old window closed, so waiting costs you nothing beyond the releases you skipped. Renew early and it's added to the end of what you've got, so that costs you nothing either.

Team (5) is sold for five developers and Team (10) for ten. Every tier gives two machines per developer, so Team (5) activates on ten machines and Team (10) on twenty. It's one licence key you share with your team rather than an invite system, so there are no seats to administer. If someone leaves and their Mac goes with them, free that activation up from the Lemon Squeezy customer portal linked in your purchase email. What it doesn't buy is a shared secrets manager: there's no sync and no team vault, and everyone's .env files stay in their own repos and on their own machines.

The app carries on working. Your licence lives on your machine, and the weekly check with the licensing server can fail forever without anything being taken away, so a shut-down store or a bus with my name on it doesn't lock you out of your own secrets. Your .env files are ordinary files on your disk that you could open in any editor, which is deliberate. The one thing that would stop is activating a brand new machine, since that does need Lemon Squeezy to answer.

Apple is ending Intel support in macOS 27, and carrying a second architecture I could not test properly on every release would have been worse than not carrying it. If you're on an Intel Mac, the trial is the free way to confirm this isn't for you. If you already have Dotvault on one, it keeps working — it just stops finding updates. An Apple Silicon build won't run on an Intel Mac at all — Rosetta translates in the other direction only, so there's no coaxing it. Why I made the call when I did, and what it means for you.

Your licence moves with you: every tier allows two machines per developer, and deactivating an old machine frees the slot immediately. Snapshot history is the awkward part — it's encrypted with a key that stays on the machine that made it, so a fresh install starts with an empty History tab. Your .env files are untouched either way. The full answer, including what survives a Migration Assistant move.

Yes, with one thing to know first: a project is a single folder and the scan isn't recursive, so a monorepo with three packages is three projects in the sidebar rather than one. Search works across all of them; the comparison grid works within one. What that's like in practice.

Standard .env files: anything named .env or starting with .env (e.g., .env.local, .env.production). Each line should be KEY=value format. Comments and blank lines are preserved.

Every time you save a file, Dotvault creates an encrypted snapshot. You can browse, compare, and restore any previous version from the History tab. An initial snapshot is captured automatically the first time you open a file.

No. Dotvault implements Laravel's AES-256-CBC encryption natively in Node.js. You can open, edit, create, rotate keys, and convert formats, all without PHP or artisan commands. After encrypting a file, Dotvault walks you through cleaning up git state so the plaintext never ends up committed by accident.

Dotvault scans your project's package.json, composer.json, Gemfile, requirements.txt, and pyproject.toml to identify frameworks and packages. Over 110 are recognised across npm, Composer, pip, and gem ecosystems.

After saving a .env file, Dotvault checks if any keys are missing from .env.example. You get a prompt to selectively add them: keys-only (safe for git) or keys+values.

Cmd+S to save, Cmd+Z to undo, Cmd+Shift+Z to redo, Cmd+K for cross-project search. Open Help → Keyboard Shortcuts for the full list.

Yes. Right-click any project in the sidebar for Open in Finder, Terminal, or Editor. Set your preferred apps in Settings.