Security & Privacy
EnvVault — The Professional Vault for Developers
A local-first desktop vault for developer secrets. Stop storing API keys and database credentials in plain-text .env files: EnvVault encrypts everything at rest with AES-256-GCM, versions every change, and never phones home. Built with Tauri (Rust) and React, shipping as a commercial one-time-purchase product.
Tauri Rust React TypeScript SQLite AES-256-GCM Argon2id
Key Features
- Zero-knowledge, local-first architecture — no cloud sync, no telemetry, air-gap ready
- AES-256-GCM encryption with Argon2id password hashing
- Built-in version timeline with diff viewer and instant rollback
- Command palette (⌘K) and fuzzy search across projects, branches and environments
- Auto-lock after inactivity; atomic writes that survive power loss
- Beyond .env: API keys, SSH configs and database credentials in one vault
Challenges Overcome
- Designing a zero-knowledge model where the master password never leaves the device
- Making military-grade encryption feel instant in day-to-day developer workflow
- Shipping a cross-platform desktop app (macOS, Windows, Linux) from a single codebase
Results & Impact
A commercial product with one-time licensing — no subscription
Documentation site at envvault.dev
Solves .gitignore leaks, config drift and multi-client secret sprawl in one tool