# EnvKey alternative after the shutdown: Crunu > EnvKey Cloud shut down on February 1, 2025. How Crunu compares for former EnvKey users: encryption on devices, hosting, CI and moving your values. URL: https://crunu.com/alternatives/envkey Language: en Updated: 2026-10-30 EnvKey Cloud stopped new sign-ups in August 2024 and shut down on February 1, 2025, and the repository has had no new code since. Crunu keeps EnvKey's core idea, encryption on your devices with a server that cannot read values, and adds keys per environment, OIDC for CI and key rotation on removal. EnvKey is no longer an option for new teams: its README announced that "as of August 1st, 2024, EnvKey Cloud is beginning a six month wind down" and that it would "shut down on February 1st, 2025". If you used EnvKey, you chose a tool that encrypted secrets end to end with NaCl, so its servers stored values they could not read. Crunu is built on the same idea, encryption only in the browser and the agent with a server that holds ciphertext, and it is actively developed, in a cloud service or on a server you host. This page is for former EnvKey users, whether you moved to something else during the wind-down or are still running a self-hosted copy. It compares the last documented state of EnvKey with Crunu today, and is honest about what EnvKey did that Crunu does not. > **Note:** Crunu wrote this comparison. EnvKey's website and documentation site did not respond when we checked on October 30, 2026, so every statement about EnvKey comes from its GitHub repository, its source code and its wind-down notice. Sources are listed with this page. If something is wrong, tell us at . ## Who each one fits **EnvKey still fits** teams already running a self-hosted EnvKey that works for them, who are prepared to maintain it without upstream updates. The repository's last commit, on August 1, 2024, added the wind-down notice; the last releases date from March 2024. The code is MIT, though the README notes that Cloud and Business Self-Hosted included commercially licensed server-side extensions. **Crunu fits** former EnvKey users who want to keep encryption on their own devices. Values are encrypted before they leave the browser or the `crunu` agent, each environment has its own key, and the server cannot decrypt for people, for machines or for CI. You can use the Crunu cloud or, on the Enterprise plan, [host the server yourself](https://crunu.com/self-hosting) on Docker, Cloudflare Workers, Vercel or Google Cloud Run, and a self-hosted server moves between those platforms with one archive. ## Side by side | | EnvKey | Crunu | | ----------------- | ------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------- | | Status | EnvKey Cloud shut down on February 1, 2025; no new commits since August 1, 2024 | Active; free during early access | | Encryption | End-to-end encrypted with NaCl, per its README | Encrypted and decrypted only in the browser and the `crunu` agent; the server stores ciphertext | | Hosting | Cloud, now closed, and self-hosting options | The Crunu cloud; on the Enterprise plan, also your own server on Docker, Cloudflare Workers, Vercel or Google Cloud Run | | Source code | MIT; Cloud and Business Self-Hosted used commercial server-side extensions | Not published | | Running a program | `envkey-source -- ` runs a command with the latest variables | `crunu run --env / -- `, with optional restart when values change | | Language wrappers | Node.js, Python, Go, Ruby and PHP | None; applications run under `crunu run` or read files from `crunu pull` | | Structure | Apps, environments, branches, environment inheritance and re-usable blocks | Projects and environments, with a key per environment and roles per environment | | Audit | The README lists audit logs | Hash-chained organization log, 365 days by default, with a record of which versions each person received | | CI identity | Not documented in the repository | Service tokens bound by OIDC to a repository, branch and deployment environment | | Removing someone | Not documented in the repository | Removal rotates the keys of every environment they could read and lists the values to reissue | ## Keeping end-to-end encryption after EnvKey The hardest part of leaving EnvKey is not the move itself but what you might give up. Some secrets managers decrypt on their own servers. In the wind-down email that a customer posted to Hacker News, a secondary source, since the copy linked from EnvKey's README no longer loads, EnvKey named Infisical as a destination "similar in its spirit and goals to EnvKey". Infisical's current security documentation says its server "retrieves and decrypts requested data" before responding, with a root key that the operator provides. That may be fine for your team, but it is a different model from the one you chose with EnvKey. *Figure: Diagram of who can decrypt EnvKey values, split into your side and the provider side. On your side, your team’s devices, your machines, and CI runners can decrypt. On the provider side, the EnvKey service stores only ciphertext and holds no key.* Crunu keeps the model EnvKey users signed up for and applies it everywhere. People decrypt in the browser with keys derived from their password and a Secret Key that never leaves their devices. Servers decrypt in the `crunu` agent with their own machine keys, and pipelines with service tokens created in an administrator's browser. A stolen copy of the database holds only ciphertext and public keys. The server still sees metadata, such as project names, email addresses and timestamps, and the [limitations page](https://crunu.com/security/limitations) lists the rest. Crunu is not the only option that keeps this model. [Phase](https://crunu.com/alternatives/phase) and [Bitwarden Secrets Manager](https://crunu.com/alternatives/bitwarden-secrets-manager) also encrypt on the client by default. What Crunu adds is a key per environment sealed to each recipient, OIDC-bound tokens for GitHub Actions, GitLab CI and Bitbucket Pipelines, and a [member removal flow](https://crunu.com/features/offboarding) that rotates keys and shows what a departing person received. ## Where EnvKey was stronger - **Configuration structure.** EnvKey had branches, environment inheritance, re-usable blocks and local development environments. Crunu has projects and environments, but no inheritance and no references between values. - **Language wrappers.** EnvKey shipped wrappers for Node.js, Python, Go, Ruby and PHP. Crunu has no SDKs. - **Open-source code.** EnvKey's repository is MIT, so a team can still read and build it. Crunu's source code is not published. - **Platforms.** The README described EnvKey as cross-platform, with a desktop app and CLI. The Crunu agent runs on Linux and macOS only, with no Windows build. ## Moving from EnvKey to Crunu > **Note:** Crunu has no importer for EnvKey. You move values as `.env` files: export them from a self-hosted EnvKey if you still run one, or start from the files you exported during the wind-down. 1. [Create an account](https://crunu.com/signup) and save your Emergency Kit before anything else. 2. Create a project for each EnvKey app and an environment for each environment you used, such as `development`, `staging` and `production`. 3. If you still run EnvKey, export each environment on a trusted computer with the CLI's `envs export` command and `--format env`, for example `envkey envs export my-app production production.env --format env`. 4. Drag the `.env` files into the matching environments and invite the team, giving each person a role per environment. 5. Replace `envkey-source -- ` with `crunu run --env / -- `, enroll servers as machines and give pipelines service tokens with OIDC binding. 6. Delete the exported files, then shut down the old EnvKey servers once nothing reads from them. Branches, inheritance and blocks do not carry over. Flatten each environment into the values it actually uses before you drag it in. If your exports sat in shared folders or chats during the wind-down, reissue those values at their providers. > **Warning:** Exported files hold plaintext secrets. Keep them out of Git and synced folders, and delete them as soon as the import is done. ## Other EnvKey alternatives If keeping encryption on your devices matters most, look at [Phase](https://crunu.com/alternatives/phase), which is open source and can be self-hosted, and [Bitwarden Secrets Manager](https://crunu.com/alternatives/bitwarden-secrets-manager), which decrypts on the client and has a free plan for two users. [dotenvx](https://crunu.com/alternatives/dotenvx) takes a different route, with encrypted `.env` files committed next to your code. If server-side decryption is acceptable in exchange for syncs and dynamic secrets, [Infisical](https://crunu.com/alternatives/infisical) and [Doppler](https://crunu.com/alternatives/doppler) are two options to compare; [Doppler vs Infisical](https://crunu.com/compare/doppler-vs-infisical) compares them. The [who can decrypt guide](https://crunu.com/guides/who-can-decrypt-your-secrets) sorts the whole field by who holds the keys. ## FAQ ### Is EnvKey still available? EnvKey Cloud is not. Its README says the cloud began a six month wind down on August 1, 2024, disabled new registrations, and shut down on February 1, 2025. The open-source code is still on GitHub, but it has had no new commits since the wind-down notice. ### Is Crunu an alternative to EnvKey? Yes. Like EnvKey, Crunu encrypts values on your devices, so the server stores only ciphertext. It adds a key per environment, OIDC-bound tokens for CI and key rotation when someone leaves. It does not have EnvKey's branches, inheritance or language wrappers. ### How do I move from EnvKey to Crunu? If you still run EnvKey, export each environment as a `.env` file with the CLI's `envs export` command, then drag the files into Crunu environments and switch `envkey-source` to `crunu run`. There is no importer. Delete the exported files afterwards. ### Did EnvKey recommend Infisical? A wind-down email that a customer posted on Hacker News, a secondary source, named Infisical as similar in spirit and said it was working on migration tools. Infisical's current documentation describes server-side decryption with a root key held by the operator, which differs from EnvKey's end-to-end model. ### Can I self-host Crunu like I self-hosted EnvKey? Yes, on the Enterprise plan, under a signed agreement. A self-hosted Crunu server runs on Docker, Cloudflare Workers, Vercel or Google Cloud Run, and moves between them with one archive that holds no plaintext values. If you would rather not run anything, use the Crunu cloud. ## Sources - [EnvKey README, wind-down notice](https://github.com/envkey/envkey) (accessed 2026-10-30) - [EnvKey commit history](https://github.com/envkey/envkey/commits/main) (accessed 2026-10-30) - [EnvKey releases](https://github.com/envkey/envkey/releases) (accessed 2026-10-30) - [EnvKey CLI source: envs export](https://github.com/envkey/envkey/blob/main/public/app/client/cli/src/commands/envs_cmd/export.ts) (accessed 2026-10-30) - [Hacker News: EnvKey winding down (customer email, secondary source)](https://news.ycombinator.com/item?id=41134184) (accessed 2026-10-30) - [Infisical security internals](https://infisical.com/docs/internals/security) (accessed 2026-10-30)