Introduction

Enver is a zero-knowledge secrets management platform built for developer teams.

What is Enver?

Enver is a security-first platform for managing environment variables and secrets across development teams. It uses Shamir’s Secret Sharing and AES-256-GCM encryption to ensure that no single server — not even ours — ever has access to your plaintext secrets.

Quickstart

Be up and running in under 5 minutes with the Enver CLI.

CLI Reference

Full reference for the ev command-line tool.

API Reference

Integrate Enver directly into your own tooling via the REST API.

Security Model

Understand how zero-knowledge encryption protects your secrets.

Why Enver?

Most secrets managers store a master key on their server. If they get breached, your secrets are at risk. Enver is different:

• 🔐 Client-side encryption — your secrets are encrypted before they leave your machine
• 🔑 Shamir’s Secret Sharing — encryption keys are split into shares; no single share decrypts anything
• 🛡️ IP-bound tokens — stolen API tokens can’t be used from a different machine
• 📋 Full audit trail — every operation is logged

How it works

Your .env file
     │
     ▼
  ev push
     │
  AES-256-GCM encrypt (client-side)
  Split key → 5 Shamir shares
     │
     ▼
  Server stores ciphertext + shares
  (Server cannot decrypt — no lock key)
     │
     ▼
  ev pull (on another machine)
  Reconstructs key from shares
  Decrypts locally → .env

Components

Component	Description
CLI (ev)	Terminal tool for login, push, pull, and init
Web Dashboard	Browser-based secrets and token management
REST API	Programmatic access for CI/CD and custom tooling
VS Code Extension	IDE integration with real-time leak detection