Envy is a CLI-first secrets manager: encrypt .env values locally with AES-256-GCM, sync them across your team through Zero-Knowledge End-to-End Encryption, and manage everything through this extension without touching a terminal.
Requires the envy-secrets CLI to be installed and available on your PATH (pip install envy-secrets). See the main project README for the full CLI and architecture docs, or visit envy.krishnajain.codes to create a cloud account.
Features
Native Source Control integration — Envy shows up as a source control provider right alongside Git, with "Local Changes (Unpushed)" / "Remote Changes (Unpulled)" and one-click Push/Pull.
Secrets Explorer — Browse and edit every profile (dev, staging, prod, ...) and secret directly in the sidebar tree.
Activity Graph — A Git Graph–style timeline of who changed what, when, from CLI or web, plus a live view of unsynced local changes.
Inline hover & CodeLens — Hover process.env.YOUR_KEY in code to see its value (masked or revealed).
Drift detection — A status bar badge warns you when local secrets differ from Envy Cloud.
Local Dashboard — Launch the full envy ui dashboard embedded in a webview or in your browser, without leaving VS Code.
Cloud clone/push/pull — Bring a project's secrets in with one command, or sync ongoing changes to your team.
Requirements
Python 3.10+ and the CLI: pip install envy-secrets
An Envy Cloud account for sync features (envy cloud login from a terminal, or Envy: Login to Cloud from the Command Palette)
Getting Started
Open a folder that has (or should have) an .envy/ directory.
Run Envy: Initialize Project from the Command Palette, or Envy: Clone Project to pull down an existing cloud project.
Use the Envy icon in the Activity Bar to browse secrets, switch profiles, and view the activity graph.
Commands
Command
Description
Envy: Initialize Project
Set up .envy/ in the current workspace
Envy: Set Secret / Set Secret (Schema-Aware)
Add a secret to a profile
Envy: Switch Profile
Change the active profile
Envy: Run Command With Profile
Run a terminal command with secrets injected into its environment
Clone an existing cloud project into the current folder
Envy: Add Remote Origin
Link the current workspace to a cloud project
Envy: Open Dashboard / Open Dashboard (Embedded)
Launch the local envy ui dashboard
Envy: Show Blame
View change history for a specific secret
Envy: Check Secret Health
Warn about expired or expiring secrets
Envy: Import .env File / Export to .env File
Convert between .env and encrypted storage
Extension Settings
Setting
Default
Description
envy.cliPath
envy
Path to the envy CLI binary
envy.defaultProfile
dev
Profile assumed when none is active yet
envy.dashboardPort
8888
Port used for envy ui --port
envy.autoCheckOnStartup
true
Run envy check on activation and warn about expiring secrets
envy.driftCheckIntervalMinutes
5
How often to poll for unsynced secrets in the status bar
Security
All encryption happens client-side. Envy Cloud never sees plaintext secrets or private keys — see the Zero-Knowledge E2EE Architecture docs for details.
