Share
Share .env files and API keys securely
Send a .env file, an API key or a token. It's sealed in this browser and deleted after the reads you allow.
How it works
How to share a .env file securely
Paste or open the file
Paste the variables or open a .env file from your device. It's read in this browser and encrypted with AES-256-GCM before upload.
Set reads and expiry
Choose how many times the link can be opened, from 1 to 100, and when it expires. Add a password if the link travels somewhere shared.
They open it, then it's gone
Their browser decrypts it and lists each variable with a copy button, or saves it as a .env file. After the last read the server deletes it.
When to use it
Built for the credentials developers pass around
- Onboarding a teammate
- Hand over a project's local .env in one link instead of a wall of pasted lines in Slack.
- A key for a contractor
- Give a freelancer one API key with one read and a short expiry, then rotate it when the work ends.
- Setting up CI or a deploy
- Move a token from your machine to whoever is configuring the pipeline without it landing in an issue or a wiki.
- A few readers, one value
- Allow 3 or 5 reads when several people need the same secret. The link stops working after the last one.
Limits and storage
Read limits, expiry and what we store
- Encryption
- AES-256-GCM in your browser with a random 256-bit key carried after the # in the link. An optional password is stretched with PBKDF2-SHA256 (600,000 rounds).
- Server keeps
- Ciphertext, IV, salt, the encryption mode, a hash it checks before each read, the reads remaining and the expiry time.
- Never sent
- Your variables, the key in the link and the password.
- Size
- Up to 200,000 characters of text. Files up to 256 KB can be opened; binary files are refused.
- Reads
- 1 to 100. Each open uses one, and the read that uses up the limit deletes the secret.
- Expiry
- 1 hour, 1 day, 7 days, or a date you pick up to 30 days out.
- Key detection
- Common formats such as AWS, Stripe, GitHub and Slack keys, private keys, JWTs and database URLs are recognised in your browser to label what you pasted. Nothing about them is sent.
Every stored field is listed on the privacy page. For habits that keep shared keys safe, read how to share .env files securely.
FAQ
Sharing secrets with EnvShare
Is it safe to share an API key with a link?
Safer than chat or email, where a key stays in the history indefinitely. EnvShare encrypts the key in your browser, the link works only for the reads you allow, and the server deletes the ciphertext after the last one. Until then anyone holding the full link can read it, so treat the link like the key.
Can ProtectedShare see my secrets?
No. The server stores ciphertext and a hash it uses to check the reader's key. The key sits after the # in the link, which browsers don't send to servers. The code is open source under the MIT license, so you can check.
Do link previews or bots use up reads?
No. Loading the page doesn't use a read: the reader has to click Open first. A preview bot also never gets the key, because the part of the link after the # isn't sent to servers.
Can the recipient keep a copy?
Yes. Once it's decrypted on their screen they can copy it, download it or take a screenshot, and nothing can prevent that. A read limit controls the copy on our server, not theirs. Share credentials you can rotate, and rotate the important ones after the handoff.
How is EnvShare different from a secure note?
Both encrypt in your browser. EnvShare is built for credentials: it takes up to 200,000 characters or a .env file, allows 1 to 100 reads, and shows the reader each variable with its own copy button. A secure note is for one reader, with Markdown and an option for password-only links.
Should I use a secrets manager instead?
For secrets your apps use every day, yes. A vault or your platform's secret store is the right home for them. EnvShare is for the handoff between people, like onboarding a developer or giving a contractor a key, where setting up shared vault access would be overkill.
How do I know if it was opened?
My links, in the browser that created the link, shows how many reads were used and when it was first and last opened. You can delete the secret there before anyone reads it.