EnvShare is a developer tool designed for local-first environment variable management and zero-knowledge encrypted variable transfers directly inside Visual Studio Code.
Key Features
1. Local-First Encrypted Vault
Per-User Isolation: Local secrets are partitioned per authenticated user ID and encrypted with AES-256-GCM.
Hardware/Keychain Backed: Master encryption seeds are securely stored in VS Code SecretStorage.
Zero Cross-Account Leakage: Logging out clears decrypted in-memory state; unauthenticated sessions cannot read or mutate stored secrets.
2. Zero-Knowledge Online Transfers
Client-Side Encryption: Environment variables are encrypted client-side using ephemeral ECDH (NIST P-256) and AES-256-GCM before reaching the network.
Zero-Knowledge Relay: The relay backend stores only encrypted ciphertext, authentication tags, and public keys. The server never has access to your plaintext secrets or private keys.
Recipient Verification: Look up verified team members by email or user ID.
Transfer Controls: Set expiration times (15 min to 7 days) and one-time consumption policies.
3. Safe Secret Inspection (Vault Eye)
Masked by Default: All vault variables display masked placeholders (••••••••) by default.
Inline Eye Toggle: Temporarily reveal individual secret values in-memory with a single click.
Ephemeral State: Reveal states are never persisted to disk or settings and reset upon reload or logout.
Explicit Clipboard Copy: Copy secret values directly without logging or echoing sensitive values in output channels.
4. Interactive Inbound Conflict Resolution
Diff & Merge: When receiving an inbound transfer, compare incoming values against your local .env and vault.
Granular Actions: Overwrite, rename, or skip variables individually before saving.
5. Email-First OTP Authentication
Passwordless: Connect your account securely using 6-digit one-time verification codes sent to your email.
No Unauthenticated Enumeration: Seamless flow for existing accounts without exposing account status to unauthenticated callers.
Getting Started
1. Install & Connect
Open the EnvShare container in the Activity Bar.
In the Requests & Account view, click Log In and enter your work email.
Enter the 6-digit OTP received in your inbox to establish your local cryptographic session.
2. Add Secrets to Local Vault
Open your workspace .env file or explore the Workspace .env Files tree view.
Right-click any variable and select EnvShare: Add Variable to Vault, or run the command EnvShare: Select Environment Variables.
3. Share Encrypted Variables
Run EnvShare: Share Variables from the Command Palette (Ctrl+Shift+P / Cmd+Shift+P).
Select the variables you wish to share.
Enter the recipient's email address or user ID.
Select expiration time and consumption policy, then confirm.
The recipient will receive the transfer in their Requests & Account panel.
Configuration
You can customize the relay server connection in VS Code Settings (Ctrl+, / Cmd+,) under Extensions > EnvShare:
Setting
Default
Description
envshare.backendUrl
http://127.0.0.1:8000
URL of the Zero-Knowledge Relay backend (e.g., https://your-relay.onrender.com or local dev instance).
envshare.userEmail
""
Optional default email identifier for your workstation.
Current Status & Limitations
Early Release: This extension is in active development.
Self-Hosted / Test Relay: By default, the extension expects a running relay service (local or hosted on platforms such as Render). Ensure envshare.backendUrl points to an active relay instance.
Zero-Knowledge Architecture: Plaintext secret values never touch the relay server. However, always ensure your local machine and master secret storage remain secure.
