A vault for your .env files that the server can’t open
Put the environment variables, cloud credentials and config files your team uses into projects and environments. Values are encrypted on your device before they’re saved, and each environment is sealed with its own key.
- A separate key for every environment
- The last 100 versions of each environment
- Export any time, including an offline copy
From a folder on your laptop to an environment
Drag files or whole folders such as .aws or .cloudflare onto the page, up to 300 files at once. Crunu guesses where each file lives from the folder, the name and the contents, and keeps values hidden while you add them.
- Env, INI, YAML and any textEnv files with or without
export, INI files with sections like~/.aws/credentials, flat YAML, and any other text kept as a whole. - Each file knows its path
~/.env,~/.aws/credentials,~/.aws/config: the agent and the install script put every file back where it belongs. - A personal project for everyoneEvery member also gets a personal project for their own keys, separate from the team’s.
Encrypted on the device, sealed for each reader
Your browser encrypts the environment with AES-256-GCM. The environment’s key is then sealed separately to each person and machine allowed to read it, so the server receives ciphertext and public keys, and nothing it could decrypt.
- One sealed record per versionVariable names, file paths and values all sit inside the ciphertext. The server knows the project and environment names, not what the files contain.
- Development doesn’t open productionEach environment has its own key. Someone with only development never receives the production key.
- Signed by the authorEvery saved version is signed, and the list of readers is signed by an admin, so the server can’t add itself as a reader or swap the data.
Every change shows before you save it
Edits appear in a bar first, so you can check them or discard them. Each save becomes a signed version, and the last 100 versions are kept, up to 64 MB per environment.
- Restore without losing anythingRestoring an old version creates a new one, so nothing in the history is overwritten.
- Compare two environmentsSee what exists in only one environment and what differs, then copy selected values across as a new version. Values stay hidden until you click Show.
- Two devices, one versionEdits from two devices are merged field by field. When both changed the same field, a person picks which one stays.
Small things you use every day
Values stay masked until you ask for one. Copying, searching and generating are built so a secret doesn’t end up somewhere it shouldn’t.
- Show one value at a timeValues stay masked until you click Show, one row at a time. A copied value is cleared from the clipboard after a minute if it’s still there.
- Search with ⌘KFind variables by name, service, path or action. Values are never searched and never appear in results.
- Generate instead of inventingCreate a random 40-character value. For 20 known services, such as AWS, GitHub, Stripe and OpenAI, there’s a link to where you issue a new key.
- Safe to loadFiles marked Load as environment variables go to
crunu run. Crunu first checks that no value would run as a shell command.
Room for every environment, and a way out
Limits are the same for everyone during early access. Export an environment whenever you like, or download an offline copy of everything you can read.
| Limit | Value |
|---|---|
| Contents of one environment | up to 1 MB |
| History of one environment | last 100 versions, up to 64 MB |
| Projects in an organization | up to 500 |
| Environments in a project | up to 50 |
| Entries in one access list | up to 5,000 |
The offline copy opens with your password and Secret Key, without the server. Network-restricted environments stay out of it.
Where the encryption stops
Encryption protects values and names. Some things the server still sees, and some risks no vault removes.
- The server sees metadataNames of organizations, projects, environments and machines, email addresses, the audit log, and the sizes and times of versions.
- Hidden isn’t uncopyableMasking is a choice of the app. Anyone who can decrypt a value can copy it.
- The web app is the main riskA server that’s been taken over could serve a modified page. Signed releases and blocked third-party scripts reduce that risk, and the limitations page covers the rest.
- No dynamic secretsNo database passwords issued on demand, which would need a key on the server, and no references between values.
Answers to common questions
Something else? Write to support@crunu.com
Can the people running the server read our values?
No. The server stores ciphertext and has no decryption key at any point. That holds for app.crunu.com and for a server you run yourself.
What happens if the database leaks?
A full copy of the database is useless for guessing your values. Your account key is derived from your password and your Secret Key, and the Secret Key never reaches the server.
Which file formats can I store?
Env files, INI files with sections, flat YAML, and any other text. Env, INI and YAML files are shown as a table of variables or fields; other text is edited as a whole.
How large can an environment get?
Up to 1 MB of contents, with the last 100 versions kept up to 64 MB.
Can I take my data with me?
Yes. Export a single environment as a .env, a password-protected file or Ansible Vault, or download an offline copy of everything you can read. The offline copy opens with your password and Secret Key, without the server.
Move your first .env out of the chat thread
Create an account, drop in a file and see what the server stores.