Secrets management for teams who care about verifiable security.
Enver encrypts and splits environment variables client-side using Shamir's Secret Sharing and AES-256-GCM. The server is a blind courier—it never holds a key or sees your plaintext.
✓ Split master secret into 5 Shamir shares
→ Ciphertext payload prepared (client-side)
Engineered with provable principles.
Traditional secret vaults rely on trust. Enver relies on mathematics, cryptographic bounds, and zero-knowledge data flows.
Client-Side Cryptography
All environment payload encryption is handled before bytes leave your machine. Secrets are encrypted using authenticated AES-256-GCM.
Shamir's Secret Sharing
Master keys are split into polynomial shares (5 shares with a 3-share threshold). Compromising a single database share reveals zero secret data.
IP-Pinned Authentication
API tokens can be automatically bound to the originator IP address. Even in the event of credential leakage, tokens cannot be executed across network boundaries.
Granular Role Scopes
Issue tokens strictly bounded to read:secrets, write:secrets, or admin scopes to enforce least-privilege access across your CI/CD pipelines.
Immutable Audit Trail
Every creation, decryption request, and team permission mutation is indexed in audit logs with precise timestamps and identity attribution.
Toolchain Parity
Interact seamlessly via the standalone CLI or the VS Code extension with real-time environment variable leakage detection.
How the zero-knowledge flow works.
Local Client-Side Derivation
When running `ev push`, Enver reads your local environment variables, derives a key via PBKDF2 with 100,000 iterations, performs AES-256-GCM encryption, and fragments the key using Shamir's Secret Sharing into 5 separate shares.
PBKDF2(LockKey, Salt) → AES-GCM + SSS(5, 3)Zero-Knowledge Cloud Transit
The server receives solely ciphertext and key shares. Because the server does not hold the user's private lock key, it is cryptographically impossible for the host to decrypt or reconstruct the original environment payloads.
Ciphertext + Shares Stored StatelesslyLocal Decryption & Ingestion
Upon `ev pull`, authorized team members download the 5 shares, reconstruct the master key locally using the Shamir polynomial threshold (k=3), decrypt with their lock key, and atomically merge into their workspace `.env`.
Local Polynomial Evaluation → Plaintext .envFamiliar, scriptable CLI workflows.
Designed to fit naturally into your terminal, Docker files, and CI pipelines with zero configuration friction.
brew install enver-os/tap/ev