MiniEnv is the smallest way to share a .env file.
Encrypted on your Mac with age before it goes anywhere. One list of who can read it. Free for five people.
Someone leaves.
They lose everything,
at once.
Remove a person and every value they had access to is re-encrypted on your Mac, before the change is accepted. There is no window where they can still read new values, and no background job that gets round to it later.
What it does not do, and what no tool can do, is reach backwards. Anything they already pulled, they still have. Rotate that at the source: the database, the provider. Not just here.
Read the full model, including the limits we have not closed yet.
We never hold
anything readable.
We didn't invent our own cryptography. MiniEnv uses age, the same standard the serious tools rely on. Values are encrypted on your machine before they leave it, so our server only ever stores ciphertext. If the whole database leaked tomorrow, an attacker would walk away with unreadable blobs.
Read the full security page: how push-to-Vercel works when we cannot read your values, everything our server can still see if it is breached tomorrow, and the six limitations we have not fixed yet.
The vault, for the
secrets that aren't
KEY=value.
A service-account JSON, an Apple .p8, a PEM or SSH deploy key, recovery codes, a connection string, a plain note. Same encryption as your env vars, kept as a separate collection so nothing that touches .env files or Vercel can reach it.
Each entry gets a free-text label, not a shouty variable name, and a kind that only picks an icon. No client is allowed to parse a value because of it.
A moving truck
for one chair.
Vault, Doppler and Infisical are built for security teams: roles, policies, compliance dashboards. If three people share a Stripe key, none of that helps.
| MiniEnv | Vault · Doppler · Infisical | |
|---|---|---|
| Setup | Download, sign in, share a project | Define projects, roles and scopes before anyone reads a value. Vault, a server too. |
| Access model | The people you invite | Roles, policies, service accounts, machine identities |
| Built for | Teams of 3 to 10 sharing real keys | Security and compliance organisations |
| Five people | Free | Doppler $16/mo · Infisical free, until you add a CI token · Vault self-hosted, plus a server |
| Ten people | $29.99/mo, flat | Doppler $56–210 · Infisical $200–230 · Vault, ask sales |
Prices from each vendor's public pricing page, checked 30 August 2026. Infisical bills "any human or machine that authenticates" as an identity, so CI tokens count as seats.
Full comparisons, including 1Password, dotenvx, SOPS and just sending the file. Every price dated, and every page says where the other tool wins.
Or never leave
the terminal.
The CLI does the same encryption on your machine, with the same Keychain identity as the app. No command ever prints a value, at any verbosity.
It comes with the app: Settings, Account, Install command line tool. It updates whenever the app does.
Free until your
team outgrows it.
One download either way. Pro is unlocked inside the app, whenever you actually need it.