EnvKey alternative after the shutdown: Crunu

EnvKey is no longer an option for new teams: its README announced that "as of August 1st, 2024, EnvKey Cloud is beginning a six month wind down" and that it would "shut down on February 1st, 2025". If you used EnvKey, you chose a tool that encrypted secrets end to end with NaCl, so its servers stored values they could not read. Crunu is built on the same idea, encryption only in the browser and the agent with a server that holds ciphertext, and it is actively developed, in a cloud service or on a server you host.

This page is for former EnvKey users, whether you moved to something else during the wind-down or are still running a self-hosted copy. It compares the last documented state of EnvKey with Crunu today, and is honest about what EnvKey did that Crunu does not.

Who each one fits

EnvKey still fits teams already running a self-hosted EnvKey that works for them, who are prepared to maintain it without upstream updates. The repository's last commit, on August 1, 2024, added the wind-down notice; the last releases date from March 2024. The code is MIT, though the README notes that Cloud and Business Self-Hosted included commercially licensed server-side extensions.

Crunu fits former EnvKey users who want to keep encryption on their own devices. Values are encrypted before they leave the browser or the crunu agent, each environment has its own key, and the server cannot decrypt for people, for machines or for CI. You can use the Crunu cloud or, on the Enterprise plan, host the server yourself on Docker, Cloudflare Workers, Vercel or Google Cloud Run, and a self-hosted server moves between those platforms with one archive.

Keeping end-to-end encryption after EnvKey

The hardest part of leaving EnvKey is not the move itself but what you might give up. Some secrets managers decrypt on their own servers. In the wind-down email that a customer posted to Hacker News, a secondary source, since the copy linked from EnvKey's README no longer loads, EnvKey named Infisical as a destination "similar in its spirit and goals to EnvKey". Infisical's current security documentation says its server "retrieves and decrypts requested data" before responding, with a root key that the operator provides. That may be fine for your team, but it is a different model from the one you chose with EnvKey.

Crunu keeps the model EnvKey users signed up for and applies it everywhere. People decrypt in the browser with keys derived from their password and a Secret Key that never leaves their devices. Servers decrypt in the crunu agent with their own machine keys, and pipelines with service tokens created in an administrator's browser. A stolen copy of the database holds only ciphertext and public keys. The server still sees metadata, such as project names, email addresses and timestamps, and the limitations page lists the rest.

Crunu is not the only option that keeps this model. Phase and Bitwarden Secrets Manager also encrypt on the client by default. What Crunu adds is a key per environment sealed to each recipient, OIDC-bound tokens for GitHub Actions, GitLab CI and Bitbucket Pipelines, and a member removal flow that rotates keys and shows what a departing person received.

Where EnvKey was stronger

• Configuration structure. EnvKey had branches, environment inheritance, re-usable blocks and local development environments. Crunu has projects and environments, but no inheritance and no references between values.
• Language wrappers. EnvKey shipped wrappers for Node.js, Python, Go, Ruby and PHP. Crunu has no SDKs.
• Open-source code. EnvKey's repository is MIT, so a team can still read and build it. Crunu's source code is not published.
• Platforms. The README described EnvKey as cross-platform, with a desktop app and CLI. The Crunu agent runs on Linux and macOS only, with no Windows build.

Moving from EnvKey to Crunu

Branches, inheritance and blocks do not carry over. Flatten each environment into the values it actually uses before you drag it in. If your exports sat in shared folders or chats during the wind-down, reissue those values at their providers.

Other EnvKey alternatives

If keeping encryption on your devices matters most, look at Phase, which is open source and can be self-hosted, and Bitwarden Secrets Manager, which decrypts on the client and has a free plan for two users. dotenvx takes a different route, with encrypted .env files committed next to your code.

If server-side decryption is acceptable in exchange for syncs and dynamic secrets, Infisical and Doppler are two options to compare; Doppler vs Infisical compares them. The who can decrypt guide sorts the whole field by who holds the keys.