Keyline
Share .env files encrypted before they leave your laptop
Subscription1,507 impressions#7 of its week1 comment
Comments
>log in to comment- PDFops· 3mo ago
The .env-sharing pain is real — I sync two dev boxes and gitignored env files are exactly what git can't carry. I ended up committing sops/age-encrypted files so the repo itself carries the secrets. Curious where keyline sits: out-of-band share links only, or can the encrypted file live in the repo? And recipient public keys, or a shared passphrase?
Keyline is a zero-knowledge .env secrets manager that encrypts files on your laptop and syncs them securely to teammates.
- for
- Small dev teams and solo developers who need to share environment variables safely.
- pricing
- freemium · free trial
- license
- MIT
Key features
- One-command CLI — Install, link, push and pull .env files with simple commands on macOS, Linux or Windows.
- Client-side encryption — AES-256-GCM encryption happens locally; servers only store ciphertext.
- Per-environment access control — Grant read/write rights per env (dev, staging, prod) and revoke instantly.
- Tamper-evident audit log — Every read, write or denied attempt is logged and publicly hash-chained daily.
- Agent support — Run CI bots or AI agents with secrets injected in memory via keyline run.
Use cases
- Sync production .env files between developers without exposing them in chat or repos.
- Grant CI/CD bots read-only access to dev secrets and revoke when jobs finish.
- Audit who accessed or rotated a key after a security incident.
Keyline pricing
- Solo$01 developer · Up to 2 environments · 7-day audit history
- Team$19/monthUp to 10 members · Unlimited environments & projects · Per-environment access control · Unlimited audit log
Keyline FAQ
What happens if we lose our encryption key?+
The workspace key can be recovered from any active admin’s device, or via an optional sealed recovery file you store yourself.
Do we need to change our application code?+
No code changes are required; you simply run keyline pull (or keyline run) and the app reads the same environment variables.
How is Keyline different from Doppler or Vault?+
Keyline is .env-native, zero-knowledge, and priced flat for small teams, whereas Doppler and Vault are broader, heavier solutions.
Is the service zero-knowledge?+
Yes, encryption and decryption occur entirely on client machines; the server never sees plaintext secrets.
Summarized by DevHunt from keyline.sh · Sep 28, 2026. Details may change; check the official site.
_PhotoGrid.png?width=64)
