macOS · App + CLI

Your .env files,
locked in the Keychain.

A device-authenticated vault for project secrets. Import, edit, and export clean .env files. Nothing leaves your Mac.

Apple-notarized · macOS 13+ · penv CLI included

Acme Web App

KeyValueScope

DATABASE_URL••••••••Production

STRIPE_SECRET_KEY••••••••Production

JWT_PRIVATE_KEY••••••••Production

SENTRY_DSN••••••••Staging

REDIS_URL••••••••Staging

OPENAI_API_KEY••••••••Development

API_BASE_URL••••••••Development

+ New Variable7 variables · Unlocked

Keychain-backedApple's secure enclave

Device authTouch ID on every read

No networkNo account. No telemetry.

CLI includedpenv ships in the DMG

The penv CLI

Same vault, from your terminal.

$ penv import .env

✓ 7 secrets encrypted into Acme Web App

$ penv export --scope production

✓ wrote .env (Touch ID confirmed)