# dotsec

> Encrypt your .env into a .sec file — committed to git, decrypted at runtime

Latest version **7.0.1** (published 2026-06-13) · MIT license · 0 weekly downloads

## Install

```sh
npm install dotsec
pnpm add dotsec
yarn add dotsec
bun add dotsec
```

Provides the command `dotsec`.

## Health

**Score 45/100 (D)** — status: active.

Positive: no vulnerabilities.

Warnings: low downloads; no types; no esm support.

## Facts

| | |
|---|---|
| Version | 7.0.1 |
| Published | 2026-06-13 |
| First published | 2022-02-22 |
| Weekly downloads | 0 |
| License | MIT |
| TypeScript types | none |
| Module format | CommonJS |
| Node | >=16.0.0 |
| Dependencies | 0 |
| Unpacked size | 3.6 KB |
| Known vulnerabilities | 0 |
| Install scripts | no |
| GitHub stars | 1 |
| Maintainers | jpwesselink |

## Links

- npm: https://www.npmjs.com/package/dotsec
- Repository: https://github.com/jpwesselink/dotsec-rs
- Homepage: https://jpwesselink.github.io/dotsec-rs
- Issues: https://github.com/jpwesselink/dotsec-rs/issues
- npm.io page: https://npm.io/package/dotsec

## Recent versions

- 7.0.1 (latest) — 2026-06-13
- 7.0.2-beta.12dd527 (beta) — 2026-11-07
- 7.0.2-chore-deps-majors.ae789d7 (chore-deps-majors) — 2026-11-07
- 7.0.2-fix-empty-text-directive.e5b7885 (fix-empty-text-directive) — 2026-11-06
- 7.0.2-chore-ci-runners-and-audit.f6280f4 (chore-ci-runners-and-audit) — 2026-11-06
- 7.0.2-release-plz-2026-07-14T09-03-14Z.2b05332 (release-plz-2026-07-14T09-03-14Z) — 2026-07-14
- 7.0.2-release-plz-2026-07-14T09-03-15Z.a4b3680 (release-plz-2026-07-14T09-03-15Z) — 2026-07-14
- 7.0.2-fix-mac-failure-diagnostic.a8023af (fix-mac-failure-diagnostic) — 2026-06-15
- 7.0.2-fix-validator-false-positive-default-encrypt.acdf749 (fix-validator-false-positive-default-encrypt) — 2026-06-15
- 7.0.1-release-plz-2026-06-13T21-05-28Z.92df634 (release-plz-2026-06-13T21-05-28Z) — 2026-06-13
- 7.0.1-fix-tty-guard-interactive-prompts.c96f526 (fix-tty-guard-interactive-prompts) — 2026-06-13
- 7.0.1-test-harden-set-description-stdin.22ac7ce (test-harden-set-description-stdin) — 2026-06-13
- 7.0.1-docs-security-review-followup.c9b51fb (docs-security-review-followup) — 2026-06-13
- 7.0.1-docs-home-what-is-sec.c214399 (docs-home-what-is-sec) — 2026-06-13
- 7.0.0-release-plz-2026-06-13T13-54-55Z.fcecb0c (release-plz-2026-06-13T13-54-55Z) — 2026-06-13
- … 336 more at https://npm.io/package/dotsec/versions

## README

# dotsec

`.env` files, encrypted and committed to git.

dotsec encrypts your secrets into a `.sec` file — committed alongside your code as the single source of truth. Decrypt at runtime with no secrets ever written to disk.

## Install

```bash
npm install -g dotsec
```

## Quick start

```bash
dotsec set API_KEY sk-live-xxx --encrypt   # creates .sec + keypair on first run
dotsec set PORT 3000                       # plaintext variable
dotsec run -- node server.js               # inject decrypted vars into your process
```

No AWS account. No config file. No setup step. `.sec` goes into git, `.sec.key` stays out.

## Common commands

```bash
dotsec set KEY value --encrypt     # add/update an encrypted variable
dotsec import -y                   # .env → .sec (auto-detect types)
dotsec run -- <command>            # run with decrypted env vars injected
dotsec show --reveal               # display decrypted contents
dotsec export -o .env              # .sec → .env
dotsec validate                    # check types and constraints
dotsec extract-schema              # extract directives → dotsec.schema
dotsec schema export --format ts   # generate TypeScript types
dotsec rotate-key                  # re-encrypt all values with a new DEK
```

## CI/CD

Set the private key as an environment variable — no file writes needed:

```bash
export DOTSEC_PRIVATE_KEY="AGE-SECRET-KEY-1..."
```

## Documentation

**[Docs →](https://jpwesselink.github.io/dotsec-rs)**

## License

MIT — [github.com/jpwesselink/dotsec-rs](https://github.com/jpwesselink/dotsec-rs)

---
_Source: https://npm.io/package/dotsec · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._