envsync Secrets stay secret
Your existing values always win. envsync never evaluates file contents or prints values in its diffs.
Open source · zero dependencies
Stop diffing .env
files by hand.
Keep local dotenv files aligned with their examples—without overwriting secrets, evaluating values, or losing local configuration.
Prebuilt releases · macOS, Linux & Windows · MIT licensed
❯ envsync --dry-run
scanning .
.env ← .env.example
+ LOG_LEVEL missing
~ OLD_OPTION disable
✓ DATABASE_URL kept
2 changes · 0 values exposed
❯ envsync
Existing values always winAtomic file replacementCI-ready exit codesStandard library only
THE CONTRACT
Predictable by design.
envsync treats your example as the shape and your local file as the source of truth for values.
Drift becomes obvious
Missing keys are added, stale keys are safely disabled, and your example file controls the structure.
Changes are reversible
When a removed key returns to the example, envsync restores the value you already had.
Built for automation
Use --check in CI, --dry-run before a change, and --backup when you want a recovery copy.
ONE COMMAND
Examples set the shape.
Secrets keep their place.
.env.example
# Database
DATABASE_URL=postgres://...
LOG_LEVEL=info envsync→
.env
# Database DATABASE_URL=postgres://secret LOG_LEVEL=info # envsync:disabled OLD_OPTION# OLD_OPTION=true
GET STARTED
One binary.
Nothing else.
The installer detects your platform, verifies the release checksum, and places envsync in ~/.local/bin.
macOS · Linux · FreeBSDNo Go required
$ curl -fsSL https://envsync.tabw.dev/install.sh | sh $ envsync --dry-runBrowse downloads for every platform →
LESS DOTENV DRIFT