envs vs the alternatives
Three of these are a better choice than envs for some jobs. The last section on this page says which, and when.
At a glance
| envs | dotenv | dotenvx | Doppler / Infisical | |
|---|---|---|---|---|
| Shape | local store | a file | an encrypted file | a service |
| Account needed | no | no | no (paid tier optional) | yes |
| Which file gave this value | yes | no | no | per project/config |
| One secret under two names | flagged | no | no | no |
| Example file kept honest | flagged | n/a | generates only | n/a |
| Rollback | pointer move | git | git | yes |
| Survives losing the key | recovery codes | n/a | no | account recovery |
| Refuses a non-env file | yes | no | no | n/a |
| Licence | Elastic-2.0 | BSD-2 | BSD-3 | Apache-2.0 / MIT |
| OSI open source | no | yes | yes | yes |
dotenv
The baseline, and still the right answer for one file in one project. It
has no dependencies, no key to manage and nothing to back up. envs
mirrors its
config() options name for name so the move costs a line,
and matches its parsing exactly for
every input that is actually env format.
They differ on input that is not env format. dotenv guesses; envs refuses.
dotenvx
The closest comparison, and a good tool. It encrypts a
.env in place with a keypair, so the file stays the unit of
everything. That keeps it simple. It also means there is nothing to ask
which of two files won, and no pointer to move back.
The command surface here follows dotenvx: run -- cmd,
get, set, del, ls,
rotate, genexample, gitignore,
precommit. If you already use it, there is little new to
learn. Three differences are deliberate:
-
No
encrypt/decrypt. The store is the unit, so the round trip isloadthenexport. -
getwith no key does not print everything. dotenvx does; here names come fromls --keysand values fromexport, which has to be asked for explicitly. - dotenvx is open source and envs is not. See below.
Doppler and Infisical
These are services, and a service buys you things a local tool cannot: state shared across a team without anyone passing a key around, access control, an audit trail somebody else operates. If that is what you need, use one of them.
envs is a local tool. The catalog is a file in your project.
envs serve can hand that sealed catalog to a
teammate over HTTP, but the server holds no key and cannot decrypt
anything, so it moves the catalog without ever being able to read it.
A hosted catalog is the same trade at less setup: sync and team sharing for one subscription, with the server still unable to open what it stores. That is the line worth deciding on — a service that can read your values can also search them, and one that cannot, cannot.
The licence difference, plainly
dotenv, dotenvx, Doppler's CLI and Infisical are OSI open source. envs is source-available under the Elastic License 2.0: use it inside your company at any scale, embed it in a product you sell, fork it, modify it. The one prohibition is offering this software to third parties as a hosted or managed service.
If your organisation's policy blocks non-OSI licences, that is a real reason to choose dotenvx instead. More on what the licence permits.
When not to use envs
-
One
.env, one project. Use dotenv. There is nothing here you need. - You want a service with access control. Use Doppler or Infisical.
- Your policy requires OSI open source. Use dotenvx.
- Startup cost matters more than provenance. dotenv resolves 100 keys in about 0.2 ms; envs takes about 6.6 ms, because it decrypts and authenticates every value.