Local-first AES-256-GCM encryption
Keep secrets on your machine with a zero-trust passphrase workflow.
Built for local-first secret handling
EnvDesk
A local-first .env manager for developers. Scan projects, encrypt local workspaces, mask sensitive values, and make env changes with fewer surprises.
Local-first
Encrypted
Open releases
EnvDesk — Desktop Workspace
4 env files•28 keys
Root: D:/Projects/...LOCAL
.env.production
SyncedAdd Key
| Key | Value | Status | Line | Actions | |
|---|---|---|---|---|---|
| DATABASE_URL | postgres://prod_user:**********@db.acme.example:5432/acme | secret | 1 | ||
| NEXT_PUBLIC_APP_URL | https://app.acme.example | secret | 2 | ||
| STRIPE_WEBHOOK_SECRET | whsec_**************** | secret | 3 | ||
| SENTRY_DSN | placeholder | placeholder | 4 |
Product Tour
See EnvDesk in Action
Watch the interactive product tour showcasing local secret encryption and rapid workspace filtering.
EnvDesk
Workflow
From unknown repo to readable env map.
EnvDesk is a focused desktop workspace for managing environment variables across all your projects.
1
Import a project folder or .env file.
Drop a directory or file. EnvDesk scans all .env files instantly.
2
Encrypt & unlock local workspace.
Protect your variables with AES-256-GCM passphrase encryption.
3
Preview & confirm disk changes.
Add, edit, delete, or reorder keys with an approval-first workflow before writing back to local files.
Why it helps
Built around the work developers actually do.
Folder & .env file import
Drop a whole repository or a single .env file. EnvDesk automatically discovers and maps all environment files.
Approval-first local file sync
Any change made in EnvDesk requires confirmation before writing back to local files, preventing accidental overwrites.
Inline editor & drag-drop reorder
Add, edit, mask, and drag-and-drop to reorder keys. Your app layout mirrors your .env file 1:1.
Install
Download the desktop build and start with one project folder.
Pick the build for your OS, then import a project folder locally to get started.