Self-hosted · zero-knowledge · open source

Sync your .env files.
End-to-end encrypted.

dotMage moves your secrets between every machine you code on — laptop, work PC, CI runner. Encrypted on-device before they leave. Your server only ever stores ciphertext.

Deploy your server ▸ See how it works

One binary No DevOps .env native v1.1.0

~/code/myapp — zsh

· dotMage · E2E-encrypted .env manager $ dmage init myapp ✓ Created app 'myapp'. Pushed revision 1 from .env (12 keys). $ dmage push myapp ✓ Pushed revision 2 (3 keys changed). $ dmage exec myapp -- npm run dev › secrets injected · starting process… $ dmage pull myapp --env prod ✓ Decrypted 12 keys → .env (rev 3) $

Zero-knowledge by design

Your server never sees your secrets.

Encryption and decryption happen entirely on your devices. The server is a dumb, untrusted relay — it stores opaque blobs and metadata, nothing it can read.

Your laptop

.env (plaintext)

12 keys live only here, decrypted, in your project folder.

encrypt
on-device

→

aes-256-gcm

Your server

ciphertext only

Stores versioned blobs + metadata. Can't decrypt anything.

9f2a··c1 7e0b··44 a83d··9e b21f··07 5c66··d0 e4a9··38

decrypt
on-device

→

your key

Work PC / CI

.env (plaintext)

Pulls the blob, decrypts locally with your key. Same secrets.

Lose your key and even you can't read the data back. That's the point — no server admin, hosting provider, or attacker with database access ever can either.

Three commands

From zero to synced.

Bring your own box — a $5 VPS is plenty. dotMage is a single binary with no external dependencies.

Deploy server

One command pulls the Docker image and starts the server. A $5 VPS is plenty.

Auth a device

Point the CLI at your server's IP and port. You get a device token — no passwords, ever.

Push & pull

Version your .env from any device and pull it down everywhere else. Roll back anytime.

Built for the terminal

Everything you'd reach for.

Versioned revisions

Every push is an immutable, numbered revision with the device and timestamp that made it.

$ dmage history myapp

One-command rollback

Shipped a bad secret? Roll any environment back to a previous revision instantly.

$ dmage rollback myapp 2

Run with secrets

Inject decrypted env into any process without ever writing it to disk.

$ dmage exec myapp -- npm start

Multi-device

Add a second device from anywhere — just the bootstrap secret and your master password. No first device needed. Revoke any machine instantly.

$ dmage auth --server http://<ip>:9470

Full audit log

Every auth, push, pull, rollback and revoke is recorded — query it from CLI or the web admin.

$ dmage audit --app myapp

CI/CD ready

One scoped token per app+env. Drop it into GitHub Actions or GitLab CI — secrets are pulled and decrypted in the runner, no auth step needed.

$ dmage gen-ci-token --app myapp --env prod

Where it fits

Not another vault.

dotMage does one thing: sync .env files, end-to-end encrypted, on infrastructure you own.

	Self-hosted	E2E (zero-knowledge)	.env-native	No DevOps
dotMage	yes	yes	yes	yes
HashiCorp Vault	yes	no	no	heavy
Doppler	SaaS	sees secrets	yes	yes
1Password CLI	SaaS	yes	passwords	yes
git-crypt	in-repo	yes	git-bound	yes
sops	files	yes	yaml/json	KMS setup

Own your secrets.

Install the CLI, deploy the server, stop pasting .env files into Slack.

Install CLI Deploy server