dotenvx alternative: Crunu vs encrypted .env files

The difference between dotenvx and Crunu is who holds the private key. dotenvx encrypts each value in a .env file with that file's public key, so the encrypted file can be committed and shipped with your code; the matching private key, such as DOTENV_PRIVATE_KEY_PRODUCTION for .env.production, decrypts it wherever it is set. Crunu has no key to pass around: each environment key is sealed separately to every person, machine and pipeline allowed to read it, and none of them ever sees anyone else's key.

dotenvx is a clever, small design built from tools developers already use: Git, .env files and public-key cryptography. This page is about what changes when a team, not one developer, has to manage who holds those private keys.

Who each one fits

dotenvx fits developers and small teams who like .env files and want them encrypted in Git, with nothing to run. One private key per environment on the server, in CI or in your OS keychain is all your infrastructure needs. The core CLI is open source under the BSD 3-Clause license, and there are SDKs for several languages. Its paid service, Dotenvx Armor, adds key custody, team access, approvals and audit on top.

Crunu fits teams where several people, servers and pipelines read different environments and the list changes. Nobody receives a copy of a production key to keep in a password manager. Each recipient gets its own sealed copy of only the environments it needs, and a departure rotates those keys in one step.

Who holds the private key

In dotenvx, the private key is the access list. Whoever has DOTENV_PRIVATE_KEY_PRODUCTION can decrypt .env.production, from any copy of the repository, including every commit in its history. Giving a new teammate production access means giving them that key. dotenvx does not document a re-key for when someone leaves. With the core CLI, the way to keep an old key from reading future changes is a new keypair, a re-encrypted file, and the new key replaced everywhere the old one was set: laptops, servers and every CI secret that held it. Dotenvx Armor lets a team share access without sharing the private key, but that is a paid service with its own trust model.

Crunu starts from the other end. A developer with access to development holds the development key and nothing else, so they cannot read production even with a full copy of the database. Machines and pipelines get their own keys too. When someone leaves, the member removal flow rotates every environment key they held, shows which versions they received and when, and lists the values to reissue at each provider. Nobody has to redistribute a new private key to everyone who stays.

The trade-off is that Crunu always involves a server. It stores only ciphertext and cannot decrypt, but it still sees metadata such as project names, email addresses and timestamps, as the limitations page explains. dotenvx core needs no server at all.

Where dotenvx is stronger

• Secrets travel with the code. Encrypted .env files ship in the same commit and the same artifact as the code that reads them. With core dotenvx your infrastructure only needs one private key per environment. Crunu needs its agent and a server it can reach at least once per lease.
• Windows and SDKs. dotenvx lists key storage in macOS Keychain, Windows Credential Manager and Linux Secret Service, plus SDKs for languages including Node.js, Python, Ruby, Rust and PHP. Crunu has no Windows agent and no SDKs; applications use crunu run.
• Drop-in for dotenv. If your code already loads .env files, dotenvx changes very little. Crunu adds projects, environments and accounts.
• Paid controls Crunu lacks. Armor lists human approval before decrypt, decrypting from a software enclave, and Google and GitHub sign-in. Crunu has access requests for environments, but no approval step for each decrypt and no SSO.
• Open-source core. The dotenvx CLI is BSD 3-Clause. Crunu's source code is not published.

Moving from dotenvx to Crunu

The encrypted files stay in Git history, readable by anyone who still holds an old private key. Reissue the values that matter at their providers after the move.

Other dotenvx alternatives

If you want to keep encrypted files in Git, SOPS encrypts values in .env, YAML, JSON and INI files with age, PGP or cloud KMS keys, and documents how to remove a key and rotate the data key. git-crypt encrypts whole files transparently, without a way to revoke access. SOPS vs Ansible Vault covers the trade-offs between file tools in more depth.

If you want a hosted vault where the vendor still cannot read values, Phase and Bitwarden Secrets Manager also encrypt on the client. Doppler and Infisical decrypt on their servers in exchange for syncs to many platforms. The who can decrypt guide compares them all.