EnVault 0.7.0

Env files kept in sync, both ways (Pro)

A file linked with Keep in Sync with a Folder… now works in both directions:

• Edit the file in your editor: EnVault saves the change as a new revision about a second after you save. History keeps the previous version.
• Change it in EnVault (here, on another Mac, or from the CLI): the file is rewritten, as before.
• Changed in both places: changes to different keys are merged. If the same key changed in both places, the item shows "changed in both places: KEY" with Use EnVault's Version and Use the File's Version.
• Edits made while EnVault is locked are picked up when you unlock.

To keep the old behavior (EnVault asks before taking any edit from the file), turn off Save Edits Made in the File to EnVault in the link's ⋯ menu.

Updating from 0.6.x installs automatically. Coming from eVault? See 0.6.0 for how to move your vault over.

Signed and notarized by Apple. SHA-256 sums attached.

EnVault 0.6.2

Fixes

• Unlocking now opens on the empty "No Project" page. Before, a tool you had opened earlier stayed on screen after locking and unlocking, and otherwise the first project was opened for you.

Updating from 0.6.x installs automatically. Coming from eVault? See 0.6.0 for how to move your vault over.

Signed and notarized by Apple. SHA-256 sums attached.

EnVault 0.6.1

Fixes

• With no project selected, the window shows the sidebar and one wide pane instead of three columns, so "Import Projects from Folder…" and "New Empty Project" are no longer squeezed into a narrow middle column.

Updating from 0.6.0 installs automatically. Coming from eVault? See 0.6.0 for how to move your vault over.

Signed and notarized by Apple. SHA-256 sums attached.

EnVault 0.6.0

eVault is now EnVault

Same app, new name: EnVault, for .env files and a vault. It is a new app identity (bundle id dk.dinhkhanh.envault), so it installs next to eVault instead of replacing it.

Coming from eVault

1. Download EnVault-0.6.0.dmg below and drag EnVault to Applications.
2. On the first screen:
   • iCloud vault: click Used eVault? Move a vault from it… and pick your vault. EnVault copies the encrypted vault into its own iCloud storage. Unlock it with the same passphrase. The eVault copy is left as it was.
   • Folder vault: Open from a Folder… and pick the same folder.
3. Paste your license key again in Settings › License (same key, it still works).
4. The command is now envault, and the environment variables are ENVAULT_*. Reinstall the command from Settings › Command Line, then update anything that calls evault:
   • shell hook: eval "$(envault hook zsh)"
   • git hooks: run envault protect again in each repo
   • AI agents: claude mcp add envault -- envault mcp (remove the old evault server)
5. When everything is in EnVault, you can delete eVault.

eVault won't update itself to EnVault. It shows this release with a link to the download page.

Also

• Website: https://envault.app/
• Store and key recovery: https://store.envault.app/resend

Signed and notarized by Apple. SHA-256 sums attached.

eVault 0.5.1

Fixes for the command line and AI agents

• iCloud vaults now work from any terminal, editor or MCP host. The vault lives inside eVault's own folder, which macOS doesn't let other apps read, so evault and evault mcp failed with "you don't have permission to view vault.json". They now read the vault through the running eVault app (starting it if needed). Only encrypted files pass through, the key still needs your approval, and the app never replaces or deletes files for the command line.
• When eVault isn't running, evault starts it and uses the vault it opens, instead of an older vault left in iCloud Drive.

eVault 0.5.0

Secrets for AI agents, not their values

• Claude Code, Cursor, Codex and other coding agents can run your tests, migrations and scripts with an env file loaded, list variable names, and add or rotate keys, without seeing the values.
• Connect over MCP: claude mcp add evault -- evault mcp (Codex: codex mcp add evault -- evault mcp). Agents that only use the shell learn the commands from evault agent-guide (for AGENTS.md / CLAUDE.md) or evault agent-guide --skill.
• When an agent runs evault, secret values in command output show as [redacted:KEY], it never gets a passphrase prompt, and reading a value asks you with Touch ID, naming the agent and the file.
• Settings › AI Agents: turn agents off, choose whether they may see values (ask each time, never, no extra prompt) or change env files, how long one approval lasts, and see recent requests.

Command line

• evault keys lists an env file's variable names; evault set / unset change single variables (KEY=- reads stdin, --generate KEY stores a new random secret without printing it).
• evault run --redact hides secret values in a command's output, for anyone.
• --json output for ls, keys, status, history, links and scan, and stable exit codes (3 not found, 4 needs you, 5 refused).

These rules keep a well-meaning agent from pasting a key into a chat, a log or a commit. They are not a sandbox: an agent with a shell can do whatever your account can.

eVault 0.4.0

The command line, built in

• The evault command now ships inside the app. Settings › Command Line puts it on your PATH.
• No more passphrase in Terminal: when eVault is running, evault asks the app, and you approve with Touch ID.
• evault import takes .env, JSON (Doppler, 1Password items) and .env.vault; --doppler and --1password pull straight from those CLIs.
• evault protect installs a git pre-commit hook that blocks API keys, tokens and real .env files from being committed.

In the app

• Quick copy from anywhere: press ⌥⌘E (changeable in Settings), type, press Return. Searches keys, secrets and notes; recent items come first.
• Import Projects from Folder: point eVault at ~/Projects and it imports each project's .env files.
• Keep in Sync with a Folder (Pro): eVault keeps the file written in your project and never overwrites edits you made on disk without asking.
• Editor: line numbers, and warnings for duplicate keys, empty or placeholder values and broken lines.
• Each env file shows which keys differ from the project's other env files, and can add the missing ones in one step.

eVault 0.3.10

• Touch ID no longer pops up while you're in another app. If eVault auto-locks in the background, it offers Touch ID once, when you switch back to it.
• Locking manually doesn't prompt right away. You're asked when you next come back to eVault.
• On the lock screen, press Return in the empty passphrase field (or click Touch ID) to unlock with Touch ID at any time.

Signed with Developer ID and notarized. 0.3.6–0.3.9 update to this automatically. If you run 0.3.2–0.3.5, download and replace the app by hand (see 0.3.6).

eVault 0.3.9

• Fixed: Touch ID unlock didn't work in 0.3.7 and 0.3.8. After a relaunch the app never found the key it had saved, so there was no Touch ID prompt and "Remember on this Mac" showed up unchecked again. Touch ID is part of the free tier, no license needed.
• "Remember on this Mac and unlock with Touch ID" now stays checked once you've turned it on.

After updating, unlock once with your passphrase (keep "Remember" checked) if Touch ID doesn't prompt right away. From then on, Touch ID unlocks the vault.

Signed with Developer ID and notarized. 0.3.6–0.3.8 update to this automatically. If you run 0.3.2–0.3.5, download and replace the app by hand (see 0.3.6).

eVault 0.3.8

• Redesigned license key entry (Settings > License and the upgrade sheet): a clearly labelled box that shows the whole key, a Paste button, and a status line that tells you whether the key looks complete before you activate, and why it was rejected if it was.
• Keys that your mail client wrapped across several lines now activate as-is.

Signed with Developer ID and notarized. 0.3.6 and 0.3.7 update to this automatically. If you run 0.3.2–0.3.5, download and replace the app by hand (see 0.3.6).