nexvault 1.2.0

An encrypted environment variable manager for developers.

NexVault

NexVault is a secure command-line tool for storing, managing, importing, exporting, and injecting environment variables using password-based encryption.

Instead of storing secrets in plaintext .env files, NexVault keeps them inside an encrypted vault protected by your password. Export them only when needed or inject them directly into your application at runtime.

Features

• Password-protected encrypted vault
• Securely store and retrieve environment variables
• Store multiple key-value pairs in a single command
• List all stored keys
• Run applications with injected environment variables
• Export secrets to a .env file
• Import existing .env files into the vault
• Export and import portable .nexvault backup files
• Copy secret values or .env content directly to the clipboard
• Built with modern cryptography

Installation

pip install nexvault

Quick Start

Initialize a vault

nexvault init

Check files for hardcoded secrets

nexvault check

Store a secret

nexvault set API_KEY your-secret

Store multiple secrets

nexvault setmul \
  API_KEY=your-secret \
  DATABASE_URL=postgres://localhost/db \
  DEBUG=true

Retrieve a secret

nexvault get API_KEY

Copy a secret to the clipboard

nexvault get API_KEY --copy

List all stored keys

nexvault list

Run an application with injected environment variables

nexvault run python main.py

You can run any executable or command through NexVault, and all stored environment variables will be securely injected into the child process.

Examples:

nexvault run node app.js

nexvault run npm start

nexvault run cargo run

Export to a .env file

nexvault toenv

Copy .env content to the clipboard

nexvault toenv --copy

Import an existing .env file

nexvault fromenv

Export the encrypted vault

nexvault export

This creates a portable .nexvault backup that can be shared or archived.

Import a .nexvault backup

nexvault importfile backup.nexvault

Security

NexVault derives encryption keys from your password and uses authenticated encryption to protect all stored secrets.

Environment variables remain encrypted at rest and are only decrypted when explicitly requested or temporarily injected into a child process with the run command.

License

Licensed under the Apache License 2.0.