confseal

AES-256-GCM · Zero-config · Node.js ≥ 18

Environment secrets, sealed in your repo.

confseal encrypts your environment variables and stores them per environment — right inside your repository. Version-controlled, shareable with your team, and safe to commit.

$npm install -g confseal
Get startedView on GitHub
~/my-project

$ confseal init

✅ Generated encryption key at .confseal.key

✅ Initialized encrypted store in .confseal/

$ confseal set "API_KEY=abc123" --env production

✅ Set API_KEY in production

$ confseal pull production

✅ Successfully pulled production into .env

Features

Everything you need. Nothing you don't.

A single-purpose CLI that keeps secrets encrypted, versioned, and out of your way.

AES-256-GCM encryption

Authenticated encryption built on Node's native crypto module. No extra crypto dependencies, nothing extra to audit.

Per-environment stores

development, staging, and production out of the box — or name your own. Every environment gets its own encrypted store.

Git-safe by default

Encrypted .enc files are committed while the key and raw .env stay ignored. Secrets never leak into your history.

Flexible key handling

Read the key from a .confseal.key file or the CONFSEAL_KEY environment variable — whatever fits your workflow.

Clear, actionable errors

Missing key? Malformed store? confseal tells you exactly what went wrong and how to fix it.

Zero config

One command scaffolds the store, generates your key, and updates .gitignore. That is the entire setup.

How it works

Three commands. That's the workflow.

Encrypted stores live in your repo next to your code. The key and the raw .env never do.

  1. 01
    confseal init

    Scaffold the encrypted store, generate a decryption key, and update .gitignore in a single shot.

  2. 02
    confseal set "API_KEY=abc123" --env production

    Set individual variables per environment — or encrypt your whole local .env at once with confseal push.

  3. 03
    confseal pull production

    Decrypt any environment into your local .env. Pass --merge to keep the values you already have.

my-project/
├── .env # raw variables (git-ignored)
├── .gitignore # updated to ignore key + .env
├── .confseal.key # decryption key (git-ignored, mode 0600)
└── .confseal/
├── development.enc # encrypted store (committed)
├── staging.enc # encrypted store (committed)
└── production.enc # encrypted store (committed)

Commands

A CLI you can learn in one glance

confseal init

Scaffold the encrypted store, generate a key, and add .gitignore rules.

confseal pull <environment> [--merge]

Decrypt a store into your local .env. Overwrites by default; --merge keeps existing values.

confseal push <environment>

Encrypt your local .env into the given environment store.

confseal set <KEY=VALUE> --env <environment>

Set or update a single variable without touching your local .env.

Security

Sealed means sealed.

Every store is encrypted with AES-256-GCM. The payload holds the IV, the GCM auth tag, and the ciphertext — so tampering or corruption fails loudly on decrypt.

Tamper-proof by design

The 12-byte IV, 16-byte auth tag, and ciphertext are stored base64-encoded. GCM authentication means a flipped bit anywhere in the store is detected — never silently decrypted.

Key management, your way

confseal resolves the key from the CONFSEAL_KEY environment variable first, then the .confseal.key file — created with mode 0600.

Treat .confseal.key like a password. The .gitignore rules written by confseal init keep the key and your raw .env out of version control — while the encrypted stores get committed and shared.

Seal your first secret in under a minute.

Install the CLI, run three commands, and never Slack a .env file again.

$npm install -g confseal
Read the README on GitHub