Encrypt and decrypt your .env so it doesn't expose sensitive information (passwords, tokens etc.)
You have a
.env file in your project (usually at the app's root folder) and are using it with a package
dotenv to expose its contents as environment variables in your app.
.env contains sensitive information (passwords, tokens etc.) in clear-text so you don't want to place it in
your versioned code. Using
dotenvenc you generate from
.env an encrypted version
.env.enc and only share
this in your project. In your code you regenerate
.env.enc at runtime when you need to access the sensitive data.
NOTE: this package is meaningful only if used in combination with a package like
which actually creates the environment variables found in the generated decrypted
.env in your
.gitignore so it's guaranteed to never get versioned.
Install and save as a local dependency in your project:
npm i dotenvenc
Generate the encrypted
.env.enc from the clear-text
.env (for this file's format, consult the
using the installed command line script
or equivalently with the explicit '-e' flag:
<PROJECT_PATH>/node_modules/.bin/dotenvenc -e myPassword
You need to do this once in the beginning or when you make changes to your
This script will search for the
.env in the folder where you execute the command and will move up till it either finds it
or till it reaches the app's root folder (app's root is considered to be the folder that contains a
is the location where commonly
.env and consequently
.env.enc are stored).
NOTE: If you have firstname.lastname@example.org or better, then you have in your path also npx, so the above command is simply:
npx dotenvenc myPassword
Save the key
myPassword as environment variable in your
You can choose any name for this variable.
Once you have created the
.env.enc (by default will be stored in same folder where
.env was found), you need to
regenerate the clear-text
.env at runtime to access the password, tokens etc.
There are two ways to do this.
From inside your project you regenerate the
.env and, combined with something like
dotenv, create from it the
corresponding environment variables to use in your code.
'myPassword'; // will only regenerate `.env`; it will not create any environment variables from it; // this will read the generated `.env` and populate process.env.* accordingly
.env with the sensitive data is:
and you have generated
.env.enc with the key
myPassword which you saved in environment variale
Then in your project code:
processenvDOTENVENC_KEY;;// From here on you have access the passwords through process.env.DB_PASS and process.env.CHASTITIY_KEY
Option 2: Command line
Using the script mentioned earlier with the
<PROJECT_PATH>/node_modules/.bin/dotenvenc -d myPassword
This can be useful if you corrupt your
.env (remember that
.env is an unversioned file). With the
you can recreate it to its last functioning state from your
.env.enc unless you corrupted that one too by running
Encryption step above on the corrupted
.env (then you done!)
NOTE: this only regenerates the
.env from the encrypted
.env.enc file (no environment variables are created from its contents).
There are two sample files used for the tests.
.env.sample with contents:
and its encrypted counterpart file
To run the tests: