Install dotenvx using Winget - wingetCollections

dotenvx dotenvx

cli dotenv dotenvx encryption env environment variables

Use this command to install dotenvx:

winget install --id=dotenvx.dotenvx -e

a better dotenv–from the creator of dotenv

dotenvx is a cross-platform tool designed to simplify environment variable management for developers and DevOps teams. Built by the creator of dotenv, dotenvx enhances security and flexibility with encrypted variables, multi-environment support, and seamless integration across programming languages and frameworks.

Key Features:

Cross-platform compatibility, supporting Windows, macOS, Linux, and other environments.
Multi-environment configuration, allowing users to manage different .env files for development, testing, and production.
Encrypted environment variables, ensuring sensitive data is protected both at rest and in transit.
CLI-based interface enabling direct execution of scripts or commands with injected environment variables.
Support for a wide range of programming languages (Node.js, Python, Go, Rust, Java, etc.) and frameworks (Next.js, Rails, Laravel).

Audience & Benefit: Ideal for developers working on projects that require secure and efficient management of environment variables. dotenvx helps teams streamline workflows, reduce configuration errors, and enhance security by encrypting sensitive data. It is particularly beneficial for organizations deploying applications across multiple environments or using diverse programming languages.

The tool can be installed via winget on Windows, making it easy to integrate into existing development pipelines.

README

a secure dotenv–from the creator of dotenv.

run anywhere (cross-platform)
multi-environment
encrypted envs

Read the whitepaper

Quickstart

Install and use it in code just like dotenv.

npm install @dotenvx/dotenvx --save

// index.js
require('@dotenvx/dotenvx').config()
// or import '@dotenvx/dotenvx/config' // for esm

console.log(`Hello ${process.env.HELLO}`)

or install globally - unlocks dotenv for any language, framework, or platform!

with curl 🌐

curl -sfS https://dotenvx.sh | sh
dotenvx help

with brew 🍺

brew install dotenvx/brew/dotenvx
dotenvx help

with docker 🐳

docker run -it --rm -v $(pwd):/app dotenv/dotenvx help

with github releases 🐙

curl -L -o dotenvx.tar.gz "https://github.com/dotenvx/dotenvx/releases/latest/download/dotenvx-$(uname -s)-$(uname -m).tar.gz"
tar -xzf dotenvx.tar.gz
./dotenvx help

Related Programs

Versions

1.48.4

1.48.3

1.48.2

1.48.1

1.48.0

1.47.7

1.47.6

1.47.5

1.47.4

1.47.3

show 83 more

Website

github.com

License

Last Updated

8/5/2025

winget install dotenvx
dotenvx help

$ echo "HELLO=World" &gt; .env
$ echo "console.log('Hello ' + process.env.HELLO)" &gt; index.js

$ node index.js
Hello undefined # without dotenvx

$ dotenvx run -- node index.js
Hello World # with dotenvx
&gt; :-D

// package.json
{
  "type": "module",
  "dependencies": {
    "chalk": "^5.3.0"
  }
}

// index.ts
import chalk from 'chalk'
console.log(chalk.blue(`Hello ${process.env.HELLO}`))

$ npm install
$ echo "HELLO=World" &gt; .env

$ dotenvx run -- npx tsx index.ts
Hello World

$ echo "HELLO=World" &gt; .env
$ echo "console.log('Hello ' + Deno.env.get('HELLO'))" &gt; index.ts

$ deno run --allow-env index.ts
Hello undefined

$ dotenvx run -- deno run --allow-env index.ts
Hello World

$ echo "HELLO=Test" &gt; .env.test
$ echo "console.log('Hello ' + process.env.HELLO)" &gt; index.js

$ bun index.js
Hello undefined

$ dotenvx run -f .env.test -- bun index.js
Hello Test

$ echo "HELLO=World" &gt; .env
$ echo 'import os;print("Hello " + os.getenv("HELLO", ""))' &gt; index.py

$ dotenvx run -- python3 index.py
Hello World

$ echo "HELLO=World" &gt; .env
$ echo ' index.php

$ dotenvx run -- php index.php
Hello World

$ echo "HELLO=World" &gt; .env
$ echo 'puts "Hello #{ENV["HELLO"]}"' &gt; index.rb

$ dotenvx run -- ruby index.rb
Hello World

$ echo "HELLO=World" &gt; .env
$ echo 'package main; import ("fmt"; "os"); func main() { fmt.Printf("Hello %s\n", os.Getenv("HELLO")) }' &gt; main.go

$ dotenvx run -- go run main.go
Hello World

$ echo "HELLO=World" &gt; .env
$ echo 'fn main() {let hello = std::env::var("HELLO").unwrap_or("".to_string());println!("Hello {hello}");}' &gt; src/main.rs

$ dotenvx run -- cargo run
Hello World

$ echo "HELLO=World" &gt; .env
$ echo 'public class Index { public static void main(String[] args) { System.out.println("Hello " + System.getenv("HELLO")); } }' &gt; index.java

$ dotenvx run -- java index.java
Hello World

$ echo "HELLO=World" &gt; .env
$ echo '(println "Hello" (System/getenv "HELLO"))' &gt; index.clj

$ dotenvx run -- clojure -M index.clj
Hello World

$ echo "HELLO=World" &gt; .env
$ echo 'fun main() { val hello = System.getenv("HELLO") ?: ""; println("Hello $hello") }' &gt; index.kt
$ kotlinc index.kt -include-runtime -d index.jar

$ dotenvx run -- java -jar index.jar
Hello World

$ dotnet new console -n HelloWorld -o HelloWorld
$ cd HelloWorld
$ echo "HELLO=World" | Out-File -FilePath .env -Encoding utf8
$ echo 'Console.WriteLine($"Hello {Environment.GetEnvironmentVariable("HELLO")}");' &gt; Program.cs

$ dotenvx run -- dotnet run
Hello World

$ echo "HELLO=World" &gt; .env

$ dotenvx run --quiet -- sh -c 'echo Hello $HELLO'
Hello World

$ echo "HELLO=World" &gt; .env

$ dotenvx run --quiet -- sh -c 'echo Hello $HELLO'
Hello World

# run every day at 8am
0 8 * * * dotenvx run -- /path/to/myscript.sh

$ dotenvx run -- next dev
$ dotenvx run -- npm start
$ dotenvx run -- bin/rails s
$ dotenvx run -- php artisan serve

$ docker run -it --rm -v $(pwd):/app dotenv/dotenvx run -- node index.js

FROM node:latest
RUN echo "HELLO=World" &gt; .env &amp;&amp; echo "console.log('Hello ' + process.env.HELLO)" &gt; index.js
RUN curl -fsS https://dotenvx.sh/install.sh | sh
CMD ["dotenvx", "run", "--", "echo", "Hello $HELLO"]

name: build
on: [push]
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v3
    - uses: actions/setup-node@v3
      with:
        node-version: 16
    - run: curl -fsS https://dotenvx.sh/install.sh | sh
    - run: dotenvx run -- node build.js
      env:
        DOTENV_KEY: ${{ secrets.DOTENV_KEY }}

# heroku
heroku buildpacks:add https://github.com/dotenvx/heroku-buildpack-dotenvx

# docker
RUN curl -fsS https://dotenvx.sh/install.sh | sh

# vercel
npm install @dotenvx/dotenvx --save

// pm2
"scripts": {
  "start": "dotenvx run -- pm2-runtime start ecosystem.config.js --env production"
},

# alternatively use npx
$ npx @dotenvx/dotenvx run -- node index.js
$ npx @dotenvx/dotenvx run -- next dev
$ npx @dotenvx/dotenvx run -- npm start

$ npm install @dotenvx/dotenvx --save

{
  "scripts": {
    "start": "./node_modules/.bin/dotenvx run -- node index.js"
  },
  "dependencies": {
    "@dotenvx/dotenvx": "^0.5.0"
  }
}

$ npm run start

&gt; start
&gt; ./node_modules/.bin/dotenvx run -- node index.js

[dotenvx@1.X.X] injecting env (1) from .env.production
Hello World

# use dotenvx with asdf
$ asdf plugin add dotenvx
$ asdf install dotenvx latest

# use as a git submodule
$ git dotenvx run -- node index.js
$ git dotenvx run -- next dev
$ git dotenvx run -- npm start

# .env
USERNAME="username"
DATABASE_URL="postgres://${USERNAME}@localhost/my_database"

// index.js
console.log('DATABASE_URL', process.env.DATABASE_URL)

$ dotenvx run --debug -- node index.js
[dotenvx@0.14.1] injecting env (2) from .env
DATABASE_URL postgres://username@localhost/my_database

# .env
DATABASE_URL="postgres://$(whoami)@localhost/my_database"

// index.js
console.log('DATABASE_URL', process.env.DATABASE_URL)

$ dotenvx run --debug -- node index.js
[dotenvx@0.14.1] injecting env (1) from .env
DATABASE_URL postgres://yourusername@localhost/my_database

$ echo "HELLO=production" &gt; .env.production
$ echo "console.log('Hello ' + process.env.HELLO)" &gt; index.js

$ dotenvx run -f .env.production -- node index.js
[dotenvx@1.X.X] injecting env (1) from .env.production
Hello production
&gt; ^^

$ echo "HELLO=local" &gt; .env.local

$ echo "HELLO=World" &gt; .env

$ dotenvx run -f .env.local -f .env -- node index.js
[dotenvx@1.X.X] injecting env (1) from .env.local,.env
Hello local

$ echo "HELLO=local" &gt; .env.local

$ echo "HELLO=World" &gt; .env

$ dotenvx run -f .env.local -f .env --overload -- node index.js
[dotenvx@1.X.X] injecting env (1) from .env.local,.env
Hello World

$ echo "HELLO=production" &gt; .env.production

$ dotenvx run -f .env.production --verbose -- node index.js
[dotenvx][verbose] injecting env from /path/to/.env.production
[dotenvx][verbose] HELLO set
[dotenvx@1.X.X] injecting env (1) from .env.production
Hello production

$ echo "HELLO=production" &gt; .env.production

$ dotenvx run -f .env.production --debug -- node index.js
[dotenvx][debug] configuring options
[dotenvx][debug] {"envFile":[".env.production"]}
[dotenvx][verbose] injecting env from /path/to/.env.production
[dotenvx][debug] reading env from /path/to/.env.production
[dotenvx][debug] parsing env from /path/to/.env.production
[dotenvx][debug] {"HELLO":"production"}
[dotenvx][debug] writing env from /path/to/.env.production
[dotenvx][verbose] HELLO set
[dotenvx][debug] HELLO set to production
[dotenvx@1.X.X] injecting env (1) from .env.production
Hello production

$ echo "HELLO=production" &gt; .env.production

$ dotenvx run -f .env.production --quiet -- node index.js
Hello production

$ echo "HELLO=production" &gt; .env.production

$ dotenvx run -f .env.production --log-level=error -- node index.js
Hello production

$ echo "HELLO=development local" &gt; .env.development.local
$ echo "HELLO=local" &gt; .env.local
$ echo "HELLO=development" &gt; .env.development
$ echo "HELLO=env" &gt; .env

$ dotenvx run --convention=nextjs -- node index.js
Hello development local

$ dotenvx run --convention=flow -- node index.js
Hello development local

$ dotenvx encrypt
✔ encrypted (.env)

$ echo "HELLO=World" &gt; .env
$ dotenvx encrypt
$ echo "console.log('Hello ' + process.env.HELLO)" &gt; index.js

$ dotenvx run -- node index.js
[dotenvx@1.X.X] injecting env (2) from .env
Hello World

$ echo "HELLO=Production" &gt; .env.production
$ dotenvx encrypt -f .env.production
$ echo "console.log('Hello ' + process.env.HELLO)" &gt; index.js

$ DOTENV_PRIVATE_KEY_PRODUCTION="&lt;.env.production private key&gt;" dotenvx run -- node index.js
[dotenvx@1.X.X] injecting env (2) from .env.production
Hello Production

$ echo "HELLO=Ci" &gt; .env.ci
$ dotenvx encrypt -f .env.ci
$ echo "console.log('Hello ' + process.env.HELLO)" &gt; index.js

$ DOTENV_PRIVATE_KEY_CI="&lt;.env.ci private key&gt;" dotenvx run -- node index.js
[dotenvx@1.X.X] injecting env (2) from .env.ci
Hello Ci

$ dotenvx set HELLO World -f .env
$ dotenvx set HELLO Production -f .env.production
$ echo "console.log('Hello ' + process.env.HELLO)" &gt; index.js

$ DOTENV_PRIVATE_KEY="&lt;.env private key&gt;" DOTENV_PRIVATE_KEY_PRODUCTION="&lt;.env.production private key&gt;" dotenvx run -- node index.js
[dotenvx@1.X.X] injecting env (3) from .env, .env.production
Hello World

$ mkdir app1
$ mkdir app2
$ dotenvx set HELLO app1 -f app1/.env.ci
$ dotenvx set HELLO app2 -f app2/.env.ci
$ echo "console.log('Hello ' + process.env.HELLO)" &gt; index.js

$ DOTENV_PRIVATE_KEY_CI="," dotenvx run -f app1/.env.ci -f app2/.env.ci -- node index.js
[dotenvx@1.X.X] injecting env (2) from app1/.env.ci,app2/.env.ci
Hello app1

$ DOTENV_PRIVATE_KEY_CI="," dotenvx run -f app1/.env.ci -f app2/.env.ci --overload -- node index.js
[dotenvx@1.X.X] injecting env (2) from app1/.env.ci,app2/.env.ci
Hello app2

$ echo "HELLO=World" &gt; .env
$ dotenvx encrypt --stdout
$ dotenvx encrypt --stdout &gt; .env.encrypted

# .env
USERNAME="username"
DATABASE_URL="postgres://${USERNAME}@localhost/my_database"

// index.js
console.log('DATABASE_URL', process.env.DATABASE_URL)

$ dotenvx run --debug -- node index.js
[dotenvx@1.X.X] injecting env (2) from .env
DATABASE_URL postgres://username@localhost/my_database

# .env
# Default value syntax: use value if set, otherwise use default
DATABASE_HOST=${DB_HOST:-localhost}
DATABASE_PORT=${DB_PORT:-5432}

# Alternative syntax (no colon): use value if set, otherwise use default
API_URL=${API_BASE_URL-https://api.example.com}

// index.js
console.log('DATABASE_HOST', process.env.DATABASE_HOST)
console.log('DATABASE_PORT', process.env.DATABASE_PORT)
console.log('API_URL', process.env.API_URL)

$ dotenvx run --debug -- node index.js
[dotenvx@1.X.X] injecting env (3) from .env
DATABASE_HOST localhost
DATABASE_PORT 5432
API_URL https://api.example.com

# .env
NODE_ENV=production

# Alternate value syntax: use alternate if set and non-empty, otherwise empty
DEBUG_MODE=${NODE_ENV:+false}
LOG_LEVEL=${NODE_ENV:+error}

# Alternative syntax (no colon): use alternate if set, otherwise empty  
CACHE_ENABLED=${NODE_ENV+true}

// index.js
console.log('NODE_ENV', process.env.NODE_ENV)
console.log('DEBUG_MODE', process.env.DEBUG_MODE)
console.log('LOG_LEVEL', process.env.LOG_LEVEL)
console.log('CACHE_ENABLED', process.env.CACHE_ENABLED)

$ dotenvx run --debug -- node index.js
[dotenvx@1.X.X] injecting env (4) from .env
NODE_ENV production
DEBUG_MODE false
LOG_LEVEL error
CACHE_ENABLED true

# .env
DEFINED_VAR=hello
EMPTY_VAR=
# UNDEFINED_VAR is not set

# Default value syntax - use variable if set/non-empty, otherwise use default
TEST1=${DEFINED_VAR:-fallback}     # Result: "hello"
TEST2=${EMPTY_VAR:-fallback}       # Result: "fallback"  
TEST3=${UNDEFINED_VAR:-fallback}   # Result: "fallback"

# Default value syntax (no colon) - use variable if set, otherwise use default
TEST4=${DEFINED_VAR-fallback}      # Result: "hello"
TEST5=${EMPTY_VAR-fallback}        # Result: "" (empty, but set)
TEST6=${UNDEFINED_VAR-fallback}    # Result: "fallback"

# Alternate value syntax - use alternate if variable is set/non-empty, otherwise empty
TEST7=${DEFINED_VAR:+alternate}    # Result: "alternate"
TEST8=${EMPTY_VAR:+alternate}      # Result: "" (empty)
TEST9=${UNDEFINED_VAR:+alternate}  # Result: "" (empty)

# Alternate value syntax (no colon) - use alternate if variable is set, otherwise empty  
TEST10=${DEFINED_VAR+alternate}    # Result: "alternate"
TEST11=${EMPTY_VAR+alternate}      # Result: "alternate" (empty but set)
TEST12=${UNDEFINED_VAR+alternate}  # Result: "" (empty)

# .env
DATABASE_URL="postgres://$(whoami)@localhost/my_database"

// index.js
console.log('DATABASE_URL', process.env.DATABASE_URL)

$ dotenvx run --debug -- node index.js
[dotenvx@1.X.X] injecting env (1) from .env
DATABASE_URL postgres://yourusername@localhost/my_database

$ dotenvx run --env="HELLO=World" -- sh -c 'echo Hello $HELLO'
Hello World

# .env
MULTILINE_PEM="-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnNl1tL3QjKp3DZWM0T3u
LgGJQwu9WqyzHKZ6WIA5T+7zPjO1L8l3S8k8YzBrfH4mqWOD1GBI8Yjq2L1ac3Y/
bTdfHN8CmQr2iDJC0C6zY8YV93oZB3x0zC/LPbRYpF8f6OqX1lZj5vo2zJZy4fI/
kKcI5jHYc8VJq+KCuRZrvn+3V+KuL9tF9v8ZgjF2PZbU+LsCy5Yqg1M8f5Jp5f6V
u4QuUoobAgMBAAE=
-----END PUBLIC KEY-----"

// index.js
console.log('MULTILINE_PEM', process.env.MULTILINE_PEM)

$ dotenvx run -- node index.js
MULTILINE_PEM -----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnNl1tL3QjKp3DZWM0T3u
LgGJQwu9WqyzHKZ6WIA5T+7zPjO1L8l3S8k8YzBrfH4mqWOD1GBI8Yjq2L1ac3Y/
bTdfHN8CmQr2iDJC0C6zY8YV93oZB3x0zC/LPbRYpF8f6OqX1lZj5vo2zJZy4fI/
kKcI5jHYc8VJq+KCuRZrvn+3V+KuL9tF9v8ZgjF2PZbU+LsCy5Yqg1M8f5Jp5f6V
u4QuUoobAgMBAAE=
-----END PUBLIC KEY-----

$ dotenvx run -f .env.missing -- echo $HELLO
[MISSING_ENV_FILE] missing .env.missing file (/Users/scottmotte/Code/dotenvx/playground/apr-16/.env.missing)
[MISSING_ENV_FILE] https://github.com/dotenvx/dotenvx/issues/484 and re-run [dotenvx run -- echo]

$ echo "HELLO=World" &gt; .env
$ dotenvx get GOODBYE
[MISSING_KEY] missing GOODBYE key

$ echo "HELLO=local" &gt; .env.local
$ echo "HELLO=World" &gt; .env
$ echo "console.log('Hello ' + process.env.HELLO)" &gt; index.js

$ dotenvx run -f .env.local -f .env -- node index.js
[dotenvx@1.X.X] injecting env (1) from .env.local, .env
Hello local

$ echo "HELLO=World" &gt; .env
$ echo "console.log('Hello ' + process.env.HELLO)" &gt; index.js

$ dotenvx run --env HELLO=String -f .env -- node index.js
[dotenvx@1.X.X] injecting env (1) from .env, and --env flag
Hello String

$ echo "HELLO=local" &gt; .env.local
$ echo "HELLO=World" &gt; .env
$ echo "console.log('Hello ' + process.env.HELLO)" &gt; index.js

$ dotenvx run -f .env.local -f .env --overload -- node index.js
[dotenvx@1.X.X] injecting env (1) from .env.local, .env
Hello World

# .env.prod contains: MODEL_REGISTRY=registry.company.com/models/v1
$ echo "MODEL_REGISTRY=registry.company.com/models/v1" &gt; .env.prod
$ echo "console.log('MODEL_REGISTRY:', process.env.MODEL_REGISTRY)" &gt; app.js

# Without environment variable set - uses .env.prod value
$ dotenvx run -f .env.prod -- node app.js
MODEL_REGISTRY: registry.company.com/models/v1

# With environment variable set (e.g., via Azure Container Service) - environment variable takes precedence
$ MODEL_REGISTRY=registry.azure.com/models/v2 dotenvx run -f .env.prod -- node app.js
MODEL_REGISTRY: registry.azure.com/models/v2

# To force .env.prod to override environment variables, use --overload
$ MODEL_REGISTRY=registry.azure.com/models/v2 dotenvx run -f .env.prod --overload -- node app.js
MODEL_REGISTRY: registry.company.com/models/v1

$ touch .env
$ dotenvx set HELLO encrypted
$ echo "console.log('Hello ' + process.env.HELLO)" &gt; index.js

# check your .env.keys files for your privateKey
$ DOTENV_PRIVATE_KEY="122...0b8" dotenvx run -- node index.js
[dotenvx@1.X.X] injecting env (2) from .env
Hello encrypted

$ touch .env.production
$ dotenvx set HELLO "production encrypted" -f .env.production
$ echo "console.log('Hello ' + process.env.HELLO)" &gt; index.js

# check .env.keys for your privateKey
$ DOTENV_PRIVATE_KEY_PRODUCTION="122...0b8" dotenvx run -- node index.js
[dotenvx@1.X.X] injecting env (2) from .env.production
Hello production encrypted

$ touch .env.ci
$ dotenvx set HELLO "ci encrypted" -f .env.ci
$ echo "console.log('Hello ' + process.env.HELLO)" &gt; index.js

# check .env.keys for your privateKey
$ DOTENV_PRIVATE_KEY_CI="122...0b8" dotenvx run -- node index.js
[dotenvx@1.X.X] injecting env (2) from .env.ci
Hello ci encrypted

$ touch .env
$ touch .env.production
$ dotenvx set HELLO encrypted
$ dotenvx set HELLO "production encrypted" -f .env.production
$ echo "console.log('Hello ' + process.env.HELLO)" &gt; index.js

# check .env.keys for your privateKeys
$ DOTENV_PRIVATE_KEY="122...0b8" DOTENV_PRIVATE_KEY_PRODUCTION="122...0b8" dotenvx run -- node index.js
[dotenvx@1.X.X] injecting env (3) from .env, .env.production
Hello encrypted

$ DOTENV_PRIVATE_KEY_PRODUCTION="122...0b8" DOTENV_PRIVATE_KEY="122...0b8" dotenvx run -- node index.js
[dotenvx@1.X.X] injecting env (3) from .env.production, .env
Hello production encrypted

$ echo "HELLO=production" &gt; .env.production
$ echo "console.log('Hello ' + process.env.HELLO)" &gt; index.js

$ dotenvx run -f .env.production --verbose -- node index.js
loading env from .env.production (/path/to/.env.production)
HELLO set
[dotenvx@1.X.X] injecting env (1) from .env.production
Hello production

$ echo "HELLO=production" &gt; .env.production
$ echo "console.log('Hello ' + process.env.HELLO)" &gt; index.js

$ dotenvx run -f .env.production --debug -- node index.js
process command [node index.js]
options: {"env":[],"envFile":[".env.production"]}
loading env from .env.production (/path/to/.env.production)
{"HELLO":"production"}
HELLO set
HELLO set to production
[dotenvx@1.X.X] injecting env (1) from .env.production
executing process command [node index.js]
expanding process command to [/opt/homebrew/bin/node index.js]
Hello production

$ echo "HELLO=production" &gt; .env.production
$ echo "console.log('Hello ' + process.env.HELLO)" &gt; index.js

$ dotenvx run -f .env.production --quiet -- node index.js
Hello production

$ echo "HELLO=production" &gt; .env.production
$ echo "console.log('Hello ' + process.env.HELLO)" &gt; index.js

$ dotenvx run -f .env.production --log-level=error -- node index.js
Hello production

$ echo "console.log('Hello ' + process.env.HELLO)" &gt; index.js

$ dotenvx run -f .env.missing --strict -- node index.js
[MISSING_ENV_FILE] missing .env.missing file (/path/to/.env.missing)
[MISSING_ENV_FILE] ? add one with [echo "HELLO=World" &gt; .env.missing]

$ echo "console.log('Hello ' + process.env.HELLO)" &gt; index.js

$ dotenvx run -f .env.missing --ignore=MISSING_ENV_FILE -- node index.js
...

$ echo "HELLO=development local" &gt; .env.development.local
$ echo "HELLO=local" &gt; .env.local
$ echo "HELLO=development" &gt; .env.development
$ echo "HELLO=env" &gt; .env
$ echo "console.log('Hello ' + process.env.HELLO)" &gt; index.js

$ dotenvx run --convention=nextjs -- node index.js
[dotenvx@1.X.X] injecting env (1) from .env.development.local, .env.local, .env.development, .env
Hello development local

$ echo "HELLO=development local" &gt; .env.development.local
$ echo "HELLO=development" &gt; .env.development
$ echo "HELLO=local" &gt; .env.local
$ echo "HELLO=env" &gt; .env
$ echo "console.log('Hello ' + process.env.HELLO)" &gt; index.js

$ NODE_ENV=development dotenvx run --convention=flow -- node index.js 
[dotenvx@1.X.X] injecting env (1) from .env.development.local, .env.development, .env.local, .env
Hello development local

$ DOTENV_ENV=development dotenvx run --convention=flow -- node index.js 
[dotenvx@1.X.X] injecting env (1) from .env.development.local, .env.development, .env.local, .env
Hello development local

$ mkdir -p apps/app1
$ touch apps/app1/.env
$ dotenvx set HELLO world -fk .env.keys -f apps/app1/.env

$ dotenvx run -fk .env.keys -f apps/app1/.env -- yourcommand

$ echo "HELLO=World" &gt; .env

$ dotenvx get HELLO
World

$ echo "HELLO=World" &gt; .env
$ echo "HELLO=production" &gt; .env.production

$ dotenvx get HELLO -f .env.production
production

$ mkdir -p apps/app1
$ touch apps/app1/.env
$ dotenvx set HELLO world -fk .env.keys -f apps/app1/.env

$ dotenvx get HELLO -fk .env.keys -f apps/app1/.env
world

$ dotenvx get HELLO --env HELLO=String -f .env.production
String

$ echo "HELLO=World" &gt; .env
$ echo "HELLO=production" &gt; .env.production

$ dotenvx get HELLO -f .env.production --env HELLO=String -f .env --overload
World

$ dotenvx get DOES_NOT_EXIST --strict
[MISSING_KEY] missing DOES_NOT_EXIST key

$ echo "HELLO=development local" &gt; .env.development.local
$ echo "HELLO=local" &gt; .env.local
$ echo "HELLO=development" &gt; .env.development
$ echo "HELLO=env" &gt; .env
$ echo "console.log('Hello ' + process.env.HELLO)" &gt; index.js

$ dotenvx get HELLO --convention=nextjs
development local

$ echo "HELLO=development local" &gt; .env.development.local
$ echo "HELLO=development" &gt; .env.development
$ echo "HELLO=local" &gt; .env.local
$ echo "HELLO=env" &gt; .env
$ echo "console.log('Hello ' + process.env.HELLO)" &gt; index.js

$ NODE_ENV=development dotenvx get HELLO --convention=flow
development local

$ DOTENV_ENV=development dotenvx get HELLO --convention=flow
development local

$ echo "HELLO=World" &gt; .env

$ dotenvx get
{"HELLO":"World"}

$ echo "HELLO=World" &gt; .env
$ echo "KEY=value" &gt;&gt; .env

$ dotenvx get --format shell
HELLO=World KEY=value

$ echo "console.log('Hello ' + process.env.KEY + ' ' + process.env.HELLO)" &gt; index.js
$ env $(dotenvx get --format=shell) node index.js
Hello value World

$ echo "console.log('Hello ' + process.env.KEY + ' ' + process.env.HELLO)" &gt; index.js
$ export $(dotenvx get --format=shell)
$ node index.js
Hello value World

$ echo "HELLO=World" &gt; .env
$ echo "KEY=value" &gt;&gt; .env

$ dotenvx get --format eval
HELLO="World"
KEY="value"

$ echo "console.log('Hello ' + process.env.KEY + ' ' + process.env.HELLO)" &gt; index.js
$ eval $(dotenvx get --format=eval) node index.js
Hello value World

$ echo "HELLO=World" &gt; .env

$ dotenvx get --all
{"PWD":"/some/file/path","USER":"username","LIBRARY_PATH":"/usr/local/lib", ..., "HELLO":"World"}

$ echo "HELLO=World" &gt; .env

$ dotenvx get --all --pretty-print
{
  "PWD": "/some/filepath",
  "USER": "username",
  "LIBRARY_PATH": "/usr/local/lib",
  ...,
  "HELLO": "World"
}

$ touch .env

$ dotenvx set HELLO World
set HELLO with encryption (.env)

$ touch .env.production

$ dotenvx set HELLO production -f .env.production
set HELLO with encryption (.env.production)

$ mkdir -p apps/app1
$ touch apps/app1/.env

$ dotenvx set HELLO world -fk .env.keys -f apps/app1/.env
set HELLO with encryption (.env)

$ dotenvx get -fk .env.keys -f apps/app1/.env

$ cd apps/app1
$ dotenvx get -fk ../../.env.keys -f .env

$ touch .env.ci

$ dotenvx set HELLO "my ci" -f .env.ci
set HELLO with encryption (.env.ci)

$ touch .env.ci

$ dotenvx set HELLO -f .env.ci -- "- + * ÷"
set HELLO with encryption (.env.ci)

$ touch .env

$ dotenvx set HELLO World --plain
set HELLO (.env)

$ echo "HELLO=World" &gt; .env

$ dotenvx encrypt
✔ encrypted (.env)
✔ key added to .env.keys (DOTENV_PRIVATE_KEY)
⮕  next run [dotenvx ext gitignore --pattern .env.keys] to gitignore .env.keys
⮕  next run [DOTENV_PRIVATE_KEY='122...0b8' dotenvx run -- yourcommand] to test decryption locally

$ echo "HELLO=World" &gt; .env
$ echo "HELLO=Production" &gt; .env.production

$ dotenvx encrypt -f .env.production
✔ encrypted (.env.production)
✔ key added to .env.keys (DOTENV_PRIVATE_KEY_PRODUCTION)
⮕  next run [dotenvx ext gitignore --pattern .env.keys] to gitignore .env.keys
⮕  next run [DOTENV_PRIVATE_KEY='bff...bc4' dotenvx run -- yourcommand] to test decryption locally

$ mkdir -p apps/app1
$ echo "HELLO=World" &gt; apps/app1/.env

$ dotenvx encrypt -fk .env.keys -f apps/app1/.env
✔ encrypted (apps/app1/.env)

$ dotenvx run -fk .env.keys -f apps/app1/.env

$ cd apps/app1
$ dotenvx run -fk ../../.env.keys -f .env

$ echo "HELLO=World\nHELLO2=Universe" &gt; .env

$ dotenvx encrypt -k HELLO2
✔ encrypted (.env)

$ echo "HELLO=World\nHOLA=Mundo" &gt; .env

$ dotenvx encrypt -k "HE*"
✔ encrypted (.env)

$ echo "HELLO=World\nHELLO2=Universe" &gt; .env

$ dotenvx encrypt -ek HELLO
✔ encrypted (.env)

$ echo "HELLO=World\nHOLA=Mundo" &gt; .env

$ dotenvx encrypt -ek "HO*"
✔ encrypted (.env)

$ echo "HELLO=World" &gt; .env
$ dotenvx encrypt --stdout
#/-------------------[DOTENV_PUBLIC_KEY]--------------------/
#/            public-key encryption for .env files          /
#/       [how it works](https://dotenvx.com/encryption)     /
#/----------------------------------------------------------/
DOTENV_PUBLIC_KEY="034af93e93708b994c10f236c96ef88e47291066946cce2e8d98c9e02c741ced45"
# .env
HELLO="encrypted:BDqDBibm4wsYqMpCjTQ6BsDHmMadg9K3dAt+Z9HPMfLEIRVz50hmLXPXRuDBXaJi/LwWYEVUNiq0HISrslzQPaoyS8Lotg3gFWJTsNCdOWnqpjF2xNUX2RQiP05kAbEXM6MWVjDr"

$ echo "HELLO=World" &gt; .env
$ dotenvx encrypt --stdout &gt; somefile.txt

$ echo "HELLO=World" &gt; .env
$ dotenvx encrypt
✔ encrypted (.env)
$ dotenvx decrypt
✔ decrypted (.env)

$ echo "HELLO=World" &gt; .env
$ echo "HELLO=Production" &gt; .env.production

$ dotenvx encrypt -f .env.production
✔ encrypted (.env.production)
$ dotenvx decrypt -f .env.production
✔ decrypted (.env.production)

$ mkdir -p apps/app1
$ echo "HELLO=World" &gt; apps/app1/.env

$ dotenvx encrypt -fk .env.keys -f apps/app1/.env
✔ encrypted (apps/app1/.env)
$ dotenvx decrypt -fk .env.keys -f apps/app1/.env
✔ decrypted (apps/app1/.env)

$ echo "HELLO=World\nHOLA=Mundo" &gt; .env
$ dotenvx encrypt
✔ encrypted (.env)
$ dotenvx decrypt -k HELLO
✔ decrypted (.env)

$ echo "HELLO=World\nHOLA=Mundo" &gt; .env
$ dotenvx encrypt
✔ encrypted (.env)
$ dotenvx decrypt -k "HE*"
✔ encrypted (.env)

$ echo "HELLO=World\nHOLA=Mundo" &gt; .env
$ dotenvx encrypt
✔ encrypted (.env)
$ dotenvx decrypt -ek HOLA
✔ decrypted (.env)

$ echo "HELLO=World\nHOLA=Mundo" &gt; .env
$ dotenvx encrypt
✔ encrypted (.env)
$ dotenvx decrypt -ek "HO*"
✔ encrypted (.env)

$ dotenvx decrypt --stdout
#/-------------------[DOTENV_PUBLIC_KEY]--------------------/
#/            public-key encryption for .env files          /
#/       [how it works](https://dotenvx.com/encryption)     /
#/----------------------------------------------------------/
DOTENV_PUBLIC_KEY="034af93e93708b994c10f236c96ef88e47291066946cce2e8d98c9e02c741ced45"
# .env
HELLO="World"

$ dotenvx decrypt --stdout &gt; somefile.txt

$ echo "HELLO=World" &gt; .env
$ dotenvx encrypt

$ dotenvx keypair
{"DOTENV_PUBLIC_KEY":"","DOTENV_PRIVATE_KEY":""}

$ echo "HELLO=Production" &gt; .env.production
$ dotenvx encrypt -f .env.production

$ dotenvx keypair -f .env.production
{"DOTENV_PUBLIC_KEY_PRODUCTION":"","DOTENV_PRIVATE_KEY_PRODUCTION":""}

$ mkdir -p apps/app1
$ echo "HELLO=World" &gt; apps/app1/.env
$ dotenvx encrypt -fk .env.keys -f apps/app1/.env

$ dotenvx keypair -fk .env.keys -f apps/app1/.env
{"DOTENV_PUBLIC_KEY":"","DOTENV_PRIVATE_KEY":""}

$ echo "HELLO=World" &gt; .env
$ dotenvx encrypt

$ dotenvx keypair DOTENV_PRIVATE_KEY

$ echo "HELLO=World" &gt; .env
$ dotenx encrypt

$ dotenvx keypair --format shell
DOTENV_PUBLIC_KEY= DOTENV_PRIVATE_KEY=

$ touch .env
$ touch .env.production
$ mkdir -p apps/backend
$ touch apps/backend/.env

$ dotenvx ls
├─ .env.production
├─ .env
└─ apps
   └─ backend
      └─ .env

$ touch .env
$ touch .env.production
$ mkdir -p apps/backend
$ touch apps/backend/.env

$ dotenvx ls apps/backend
└─ .env

$ touch .env
$ touch .env.production
$ mkdir -p apps/backend
$ touch apps/backend/.env
$ touch apps/backend/.env.prod

$ dotenvx ls -f **/.env.prod*
├─ .env.production
└─ apps
   └─ backend
      └─ .env.prod

$ touch .env
$ touch .env.production
$ mkdir -p apps/backend
$ touch apps/backend/.env
$ touch apps/backend/.env.prod

$ dotenvx ls -ef '**/.env.prod*'
├─ .env
└─ apps
   └─ backend
      └─ .env

$ echo "HELLO=World" &gt; .env
$ dotenvx encrypt
✔ encrypted (.env)
$ dotenvx rotate
✔ rotated (.env)

$ echo "HELLO=World" &gt; .env
$ echo "HELLO=Production" &gt; .env.production

$ dotenvx encrypt -f .env.production
✔ encrypted (.env.production)
$ dotenvx rotate -f .env.production
✔ rotated (.env.production)

$ mkdir -p apps/app1
$ echo "HELLO=World" &gt; apps/app1/.env

$ dotenvx encrypt -fk .env.keys -f apps/app1/.env
✔ encrypted (apps/app1/.env)
$ dotenvx rotate -fk .env.keys -f apps/app1/.env
✔ rotated (apps/app1/.env)

$ echo "HELLO=World\nHOLA=Mundo" &gt; .env
$ dotenvx encrypt
✔ encrypted (.env)
$ dotenvx rotate -k HELLO
✔ rotated (.env)

$ echo "HELLO=World\nHOLA=Mundo" &gt; .env
$ dotenvx encrypt
✔ encrypted (.env)
$ dotenvx rotate -k "HE*"
✔ rotated (.env)

$ echo "HELLO=World\nHOLA=Mundo" &gt; .env
$ dotenvx encrypt
✔ encrypted (.env)
$ dotenvx rotate -ek HOLA
✔ rotated (.env)

$ echo "HELLO=World\nHOLA=Mundo" &gt; .env
$ dotenvx encrypt
✔ encrypted (.env)
$ dotenvx rotate -ek "HO*"
✔ rotated (.env)

$ dotenvx rotate --stdout
#/-------------------[DOTENV_PUBLIC_KEY]--------------------/
#/            public-key encryption for .env files          /
#/       [how it works](https://dotenvx.com/encryption)     /
#/----------------------------------------------------------/
DOTENV_PUBLIC_KEY="034af93e93708b994c10f236c96ef88e47291066946cce2e8d98c9e02c741ced45"
# .env
HELLO="encrypted:12345"

$ dotenvx rotate --stdout &gt; somefile.txt

$ dotenvx help
Usage: dotenvx run -- yourcommand

a secure dotenv–from the creator of `dotenv`

Options:
  -l, --log-level       set log level (default: "info")
  -q, --quiet                  sets log level to error
  -v, --verbose                sets log level to verbose
  -d, --debug                  sets log level to debug
  -V, --version                output the version number
  -h, --help                   display help for command

Commands:
  run                inject env at runtime [dotenvx run -- yourcommand]
  get [KEY]          return a single environment variable
  set    set a single environment variable
  encrypt            convert .env file(s) to encrypted .env file(s)
  decrypt            convert encrypted .env file(s) to plain .env file(s)
  keypair [KEY]      print public/private keys for .env file(s)
  ls [directory]     print all .env files in a tree structure
 
Advanced: 
  pro                          🏆 pro
  ext                          🔌 extensions

$ dotenvx help run
Usage: @dotenvx/dotenvx run [options]

inject env at runtime [dotenvx run -- yourcommand]

Options:
  -e, --env             environment variable(s) set as string (example: "HELLO=World") (default: [])
  -f, --env-file          path(s) to your env file(s) (default: [])
  -fv, --env-vault-file   path(s) to your .env.vault file(s) (default: [])
  -o, --overload                    override existing env variables
  --convention                load a .env convention (available conventions: ['nextjs'])
  -h, --help                        display help for command

Examples:

  $ dotenvx run -- npm run dev
  $ dotenvx run -- flask --app index run
  $ dotenvx run -- php artisan serve
  $ dotenvx run -- bin/rails s

Try it:

  $ echo "HELLO=World" &gt; .env
  $ echo "console.log('Hello ' + process.env.HELLO)" &gt; index.js

  $ dotenvx run -- node index.js
  [dotenvx@1.X.X] injecting env (1) from .env
  Hello World

$ dotenvx --version
X.X.X

$ echo "HELLO=World" &gt; .env

$ dotenvx ext genexample
✔ updated .env.example (1)

# .env.example
HELLO=""

$ echo "HELLO=World" &gt; .env
$ echo "DB_HOST=example.com" &gt; .env.production

$ dotenvx ext genexample -f .env -f .env.production
✔ updated .env.example (2)

# .env.example
HELLO=""
DB_HOST=""

$ echo "HELLO=World" &gt; .env
$ mkdir -p apps/backend
$ echo "HELLO=Backend" &gt; apps/backend/.env

$ dotenvx ext genexample apps/backend
✔ updated .env.example (1)

# apps/backend/.env.example
HELLO=""

$ dotenvx ext gitignore
✔ ignored .env* (.gitignore)

$ dotenvx ext gitignore --pattern .env.keys
✔ ignored .env.keys (.gitignore)

$ dotenvx ext precommit
[dotenvx][precommit] .env files (1) protected (encrypted or gitignored)

$ dotenvx ext precommit --install
[dotenvx][precommit] dotenvx ext precommit installed [.git/hooks/pre-commit]

$ echo "HELLO=World" &gt; .env
$ mkdir -p apps/backend
$ echo "HELLO=Backend" &gt; apps/backend/.env

$ dotenvx ext precommit apps/backend
[dotenvx][precommit] apps/backend/.env not protected (encrypted or gitignored)

# Dockerfile
RUN curl -fsS https://dotenvx.sh | sh

...

RUN dotenvx ext prebuild
CMD ["dotenvx", "run", "--", "node", "index.js"]

# Dockerfile
RUN curl -fsS https://dotenvx.sh | sh

...

RUN dotenvx ext prebuild apps/backend
CMD ["dotenvx", "run", "--", "node", "apps/backend/index.js"]

$ dotenvx ext scan
100 commits scanned.
no leaks found

# .env
HELLO="World"

// index.js
require('@dotenvx/dotenvx').config()

console.log(`Hello ${process.env.HELLO}`)

$ node index.js
[dotenvx@1.X.X] injecting env (1) from .env
Hello World

# .env.local
HELLO="Me"

# .env
HELLO="World"

// index.js
require('@dotenvx/dotenvx').config({path: ['.env.local', '.env']})

// esm
// import dotenvx from "@dotenvx/dotenvx";
// dotenvx.config({path: ['.env.local', '.env']});

console.log(`Hello ${process.env.HELLO}`)

$ node index.js
[dotenvx@1.X.X] injecting env (1) from .env.local, .env
Hello Me

# .env.local
HELLO="Me"

# .env
HELLO="World"

// index.js
require('@dotenvx/dotenvx').config({path: ['.env.local', '.env'], overload: true})

// esm
// import dotenvx from "@dotenvx/dotenvx";
// dotenvx.config({path: ['.env.local', '.env'], overload: true});

console.log(`Hello ${process.env.HELLO}`)

$ node index.js
[dotenvx@1.X.X] injecting env (1) from .env.local, .env
Hello World

# .env
HELLO="World"

// index.js
require('@dotenvx/dotenvx').config({path: ['.env.missing', '.env'], quiet: true})

// esm
// import dotenvx from "@dotenvx/dotenvx";
// dotenvx.config({path: ['.env.missing', '.env'], quiet: true});

console.log(`Hello ${process.env.HELLO}`)

$ node index.js
Error: [MISSING_ENV_FILE] missing .env.missing file (/path/to/.env.missing)
Hello World

# .env
HELLO="World"

// index.js
require('@dotenvx/dotenvx').config({path: ['.env.missing', '.env'], strict: true})

// esm
// import dotenvx from "@dotenvx/dotenvx";
// dotenvx.config({path: ['.env.missing', '.env'], strict: true});

console.log(`Hello ${process.env.HELLO}`)

$ node index.js
Error: [MISSING_ENV_FILE] missing .env.missing file (/path/to/.env.missing)

# .env
HELLO="World"

// index.js
require('@dotenvx/dotenvx').config({path: ['.env.missing', '.env'], ignore: ['MISSING_ENV_FILE']})

// esm
// import dotenvx from "@dotenvx/dotenvx";
// dotenvx.config({path: ['.env.missing', '.env'], ignore: ['MISSING_ENV_FILE']});

console.log(`Hello ${process.env.HELLO}`)

$ node index.js
[dotenvx@1.X.X] injecting env (1) from .env
Hello World

# .env
HELLO="World"

// index.js
require('@dotenvx/dotenvx').config({path: ['.env'], envKeysFile: '../../.env.keys'})

// index.js
const dotenvx = require('@dotenvx/dotenvx')
const src = 'HELLO=World'
const parsed = dotenvx.parse(src)
console.log(`Hello ${parsed.HELLO}`)

$ node index.js
Hello World

// index.js
const dotenvx = require('@dotenvx/dotenvx')
const src = 'USER=Me'
const parsed = dotenvx.parse(src, { processEnv: {} })
console.log(`Hello ${parsed.USER}`)

$ node index.js
Hello Me

// index.js
const dotenvx = require('@dotenvx/dotenvx')
const src = 'HELLO="encrypted:BE9Y7LKANx77X1pv1HnEoil93fPa5c9rpL/1ps48uaRT9zM8VR6mHx9yM+HktKdsPGIZELuZ7rr2mn1gScsmWitppAgE/1lVprNYBCqiYeaTcKXjDUXU5LfsEsflnAsDhT/kWG1l"'
const parsed = dotenvx.parse(src, { privateKey: 'a4547dcd9d3429615a3649bb79e87edb62ee6a74b007075e9141ae44f5fb412c' })
console.log(`Hello ${parsed.HELLO}`)

$ node index.js
Hello World

// index.js
const dotenvx = require('@dotenvx/dotenvx')
dotenvx.set('HELLO', 'World', { path: '.env' })

// index.js
const dotenvx = require('@dotenvx/dotenvx')
const decryptedValue = dotenvx.get('HELLO')
console.log(decryptedValue)

$ curl -sfS https://dotenvx.sh/radar | sh

$ dotenvx-radar login
✔ logged in [username]

$ dotenvx run -- yourcommand
[dotenvx@1.0.0] 📡 radar active
[dotenvx@1.0.0] injecting env (1) from .env

$ dotenvx-radar login
press Enter to open [https://radar.dotenvx.com/login/device] and enter code [D9C1-03BC]... (Y/n)
⠹ waiting on browser authorization
✔ logged in [username] to this device and activated token [dxo_6kjPifI…]

$ dotenvx-radar logout
✔ logged out [username] from this device and revoked token [dxo_5ZrwRXV…]

$ dotenvx-radar status
on

$ dotenvx-radar settings
Usage: dotenvx-radar settings [options] [command]

⚙️  settings

Options:
  -h, --help       display help for command

Commands:
  username         print your username
  token [options]  print your access token (--unmask)
  hostname         print hostname
  help [command]   display help for command

# from this:
./node_modules/.bin/dotenvx run --env-file .env -- yourcommand
# to this:
./node_modules/.bin/dotenvx run -f .env -- yourcommand

dotenvx dotenvx

README

Quickstart

Related Programs

Run Anywhere

Multiple Environments

Encryption

Advanced

CLI 📟

Extensions 🔌

Library 📦

Radar 📡

Usage

UI

CLI

Whitepaper

Guides

FAQ

How does encryption work?

Is it safe to commit an encrypted .env file to code?

Why am I getting the error node: .env: not found?

What happened to the .env.vault file?

How do I migrate my .env.vault file(s) to encrypted .env files?

Contributing

Why am I getting the error `node: .env: not found`?

What happened to the `.env.vault` file?

How do I migrate my `.env.vault` file(s) to encrypted `.env` files?