Open source · Client-side encrypted · CLI, TUI & MCP
Manage, share, and inject environment variables, encrypted on your device. Sync to Vercel, Cloudflare, and more, run without plaintext .env files, and keep secrets safe from AI prompts.
curl -fsSL https://withrelic.com/install | bashEverything you need to manage .env secrets across local development, AI coding agents, team sharing, and production deploys.
Paste your .env file, import from Doppler, Infisical, or 1Password, and edit secrets directly in the TUI. Encrypted on your device before upload.
Stop sending .env files over Slack. Share projects with teammates by email, wrapped with each person's own encryption keys and instant revocation.
Inject secrets into GitHub Actions, GitLab CI, or any pipeline using service accounts and passwordless OIDC trust policies.
Let Cursor, Claude Code, Codex, and Zed run commands with secrets injected while values stay hidden and redacted from AI context.
Decrypt locally and push straight to Vercel, Cloudflare, GitHub Actions, Fly.io, and more with diff plans (+, ~, -).
Inject environment variables into any process or subshell via a native Rust runner, with no plaintext .env files needed on disk.
Block accidental secret or .env commits with pre-commit hooks, and catch missing keys in your code or IDE before deploy.
Simple pricing. No surprises.
$0/month
Recommended
$9/month
Need more?
Everything you need to know about Relic.
No. Every secret is encrypted on your device before it leaves your machine. Our servers only store ciphertext, and we cannot read or decrypt your values.
Yes. You can paste .env contents directly into the TUI editor (just like Vim/Nano) or run relic import to bring in .env, JSON, Doppler, Infisical, Vercel, or 1Password secrets in seconds. From there, your variables are backed up with end-to-end encryption and ready to inject anywhere.
When you inject secrets at runtime with relic run or our built-in MCP server (relic mcp), you don't need plaintext .env files sitting in your project folder where AI assistants can read or index them. Through MCP, AI agents can inspect key names and run tests or scripts with secrets injected while actual values are automatically redacted from output.
Plain .env files are easy to lose, risky to share over Slack, and readable by any local process or AI tool, while traditional cloud secret managers can decrypt your data on their servers. Relic gives you the familiar .env editing experience in the terminal, but encrypts everything on your device, injects secrets in memory via a Rust runner, and includes leak guard, platform sync, and an MCP server out of the box.
Yes. Run relic push to decrypt an environment locally and sync it straight to your deployment platform's API or CLI with a clear diff plan (+, ~, -). Plaintext values never pass through our servers.
Yes, project sharing is a Pro feature. Invite teammates by email and they get access to the project, with 5 collaborators per project included and $1/month per extra collaborator. Each person's access is wrapped with their own public key, so sharing stays end-to-end encrypted.
Yes, with Pro. Service accounts, OIDC trust policies, and API keys let you inject secrets in GitHub Actions, GitLab CI, or any pipeline without sharing personal credentials.
Yes. Encrypted secrets sync automatically across macOS, Linux, and Windows, and relic run works with any language or framework, including Node.js, Bun, Python, Go, Rust, and Docker.