# dotenvenc

> Encrypt and decrypt your .env file so you can store sensitive information (passwords etc.) in source control

Latest version **3.0.2** (published 2022-11-08) · 0 weekly downloads

> **Deprecated.** This package is deprecated.

## Install

```sh
npm install dotenvenc
pnpm add dotenvenc
yarn add dotenvenc
bun add dotenvenc
```

Provides the command `dotenvenc`.

## Health

**Score 10/100 (F)** — status: deprecated.

Negative: deprecated.

## Facts

| | |
|---|---|
| Version | 3.0.2 |
| Published | 2022-11-08 |
| First published | 2017-07-15 |
| Weekly downloads | 0 |
| TypeScript types | none |
| Module format | CommonJS |
| Dependencies | 2 |
| Unpacked size | 33 KB |
| Known vulnerabilities | 0 |
| Install scripts | no |
| GitHub stars | 59 |
| Author | Thalis Kalfigkopoulos |
| Maintainers | tkalfigo |
| Keywords | 1password, dotenv, decrypt, encrypt, env, environment, keys, secrets, password, token |

## Links

- npm: https://www.npmjs.com/package/dotenvenc
- Repository: https://github.com/tkalfigo/dotenvenc
- Homepage: https://github.com/tkalfigo/dotenvenc#readme
- Issues: https://github.com/tkalfigo/dotenvenc/issues
- npm.io page: https://npm.io/package/dotenvenc

## Dependencies (2)

- [md5-file](https://npm.io/package/md5-file.md) 3.1.1
- [minimist](https://npm.io/package/minimist.md) 1.2.6

## Alternatives

- [replicas-cli](https://npm.io/package/replicas-cli.md) — 3.0K weekly downloads
- [env-contract](https://npm.io/package/env-contract.md) — 133 weekly downloads
- [@openveo/api](https://npm.io/package/@openveo/api.md) — 61 weekly downloads
- [@ryniaubenpm2/cumque-error-reiciendis](https://npm.io/package/@ryniaubenpm2/cumque-error-reiciendis.md) — 54 weekly downloads
- [ts-global-type-extra](https://npm.io/package/ts-global-type-extra.md) — 11 weekly downloads

## Recent versions

- 3.0.2 (latest) — 2022-11-08
- 3.0.1 — 2021-09-04
- 2.1.0 — 2021-09-04
- 3.0.0 — 2021-09-04
- 2.0.1 — 2020-07-15
- 2.0.0 — 2020-07-15
- 1.0.6 — 2020-07-15
- 1.0.5 — 2020-07-15
- 1.0.4 — 2017-08-11
- 1.0.3 — 2017-07-17
- 1.0.2 — 2017-07-16
- 1.0.1 — 2017-07-16
- 1.0.0 — 2017-07-15

## README

# dotenvenc

Encrypt and decrypt your .env so it doesn't expose sensitive information (passwords, tokens etc.)

## Use case

You have a `.env` file in your project (usually at the app's root folder) and are using it with a package
like [`dotenv`](https://www.npmjs.com/package/dotenv) to expose its contents as environment variables in your app.
But your `.env` contains sensitive information (passwords, tokens etc.) in clear-text so you don't want to place it in
your versioned code. Using `dotenvenc` you generate from `.env` an encrypted version `.env.enc` and only share
this in your project. In your code you regenerate `.env` from `.env.enc` at runtime when you need to access the sensitive data.

NOTE: this package is meaningful only if used in combination with a package like [`dotenv`](https://www.npmjs.com/package/dotenv) 
which actually creates the environment variables found in the generated decrypted `.env` file.

TIP: add `.env` in your `.gitignore` so it's guaranteed to never get versioned.

## Installation

Install and save as a local dependency in your project:
```bash
npm i dotenvenc
```

## Encryption

### Step 1

Generate the encrypted `.env.enc` from the clear-text `.env` (for this file's format, consult the [`dotenv`](https://www.npmjs.com/package/dotenv) docs)
using the installed command line script `dotenvenc`:

```bash
<PROJECT_PATH>/node_modules/.bin/dotenvenc -e myPassword
```

Also you can define custom pathnames for both the input and output file of the encryption or decryption operation.

For example to create encrypt a custom clear-text file `/somewhere/.env.custom` into custom encrypted file `./somewhere/else/.env.enc.custom`:

```bash
<PROJECT_PATH>/node_modules/.bin/dotenvenc -e -i /somewhere/.env.custom -o ./somewhere/else/.env.enc.custom myPassword
```

You need to do this once in the beginning or when you make changes to your `.env`.

If `-i` and `-o` are ommitted, the defaults are:

   * `./.env` for the unencrypted file used as input for the encryption or as output for the decryption
   * `./.env.enc` for the encrypted file used as output for the encryption or as input for the decryption

NOTE: If you have npm@5.2.0 or better, then you have in your path also [npx](https://www.npmjs.com/package/npx), so the above command is simply:
```bash
npx dotenvenc ...
```

#### Step 2

Save the key `myPassword` as environment variable in your `.bashrc` or `.bash_profile`:
```bash
export DOTENVENC_KEY='myPassword';
```

You can choose any name for this variable.

## Decryption

Once you have created the `.env.enc` you need to regenerate the clear-text `.env` at runtime to access the password, tokens etc.

Assuming your `.env` with the sensitive data is:
```
DB_PASS='mySupercalifragilisticexpialidociousPassword'
CHASTITY_KEY='youShallNotPass'
```
and you have generated `.env.enc` with the key `myPassword` which you saved in environment variale `DOTENVENC_KEY` (see `Ecryption` above), there are two ways to do this.

### Option 1: Javascript code

```javascript
require('dotenvenc').decrypt({ passwd: process.env.DOTENVENC_KEY});
require('dotenv').config();
// From here on you have access the passwords through process.env.DB_PASS and process.env.CHASTITIY_KEY
```

Or if you used custom encrypted and decrypted pathnames e.g. `./somewhere/.env.enc.custom` and `./somewhere/else/.env.custom` respectively, then:

```javascript
require('dotenvenc').decrypt({ passwd: process.env.DOTENVENC_KEY, encryptedPathname: './somewhere/.env.enc.custom', decryptedPathname: './somewhere/else/.env.custom'});
require('dotenv').config();
// From here on you have access the passwords through process.env.DB_PASS and process.env.CHASTITIY_KEY
```

### Option 2: Command line

Using the script mentioned earlier with the `-d` flag:
```bash
<PROJECT_PATH>/node_modules/.bin/dotenvenc -d myPassword
```

Or if you used custom encrypted and decrypted pathnames e.g. `./somewhere/.env.enc.custom` and `./somewhere/else/.env.custom` respectively, then:

```bash
<PROJECT_PATH>/node_modules/.bin/dotenvenc -d  -i ./somewhere/.env.enc.custom -o ./somewhere/else/.env.custom myPassword
```

This can be useful if you corrupt your `.env` (remember that `.env` is an unversioned file). With the `dotenvenc` script
you can recreate it to its last functioning state from your `.env.enc` unless you corrupted that one too by running
the `Encryption` step above on the corrupted `.env` (then you're done!)

NOTE: this only regenerates the `.env` from the encrypted `.env.enc` file (no environment variables are created from its contents).

## Testing

There are two sample files used for the tests.

File `.env.sample` with contents:

```
FOO=bar
```

and its encrypted counterpart `.env.enc.sample`.

To run the tests:

```bash
npm t
```

## Inspired by

* [Keeping passwords in source control](http://ejohn.org/blog/keeping-passwords-in-source-control/)
* [envenc](https://www.npmjs.com/package/envenc)

---
_Source: https://npm.io/package/dotenvenc · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._