All Plans

Secrets encrypted, always

Environment variables encrypted with AES-256-GCM at rest. Build-time and runtime separation. Bulk operations. Two editor modes. Your secrets never touch disk in plaintext.

Get Started Free Security

Built for security-first teams

Encrypted storage, role-based access, and two editor modes for every workflow.

AES-256-GCM encryption
Master key derived via PBKDF2 with 100k iterations. Per-file random nonce.
Build-time vs runtime
Mark variables as available during build, runtime, or both. Fine-grained control.
Two editor modes
Key-value list editor for structured editing, raw .env editor for bulk paste.
Auto-generated URLs
Database connection strings generated automatically (postgres://user:pass@host:port/db).
RBAC-enforced access
Viewer cannot see values. Developer can reveal. Admin can edit. Role-based control.
Bulk operations
Upsert multiple variables in a single PUT request. Import entire .env files at once.

How it works

01

Add variables

Key-value pairs, paste .env file content, or let sh0 auto-generate connection strings from your databases.

02

Mark scope

Choose whether each variable is available at build-time, runtime, or both. Build-time vars are injected during docker build.

03

Encrypted at rest

AES-256-GCM with per-file random nonce. Your secrets never touch disk in plaintext. Decryption happens only at injection time.

04

Injected on deploy

Variables are decrypted and injected into the container environment at runtime. No .env files inside containers.

The encryption pipeline

Variable Added
PBKDF2 Key Derivation
AES-256-GCM Encrypt
Stored Encrypted
Decrypted at Deploy

Plaintext exists only in memory during injection -- never written to disk unencrypted

Everything you need

AES-256-GCM encryption

Industry-standard authenticated encryption. Master key derived with PBKDF2 (100k iterations). Per-file random nonce with per-chunk derivation.

Masked by default

Variable values are hidden in the dashboard. Revealing requires developer role or above. No accidental exposure in screen shares.

Build & runtime separation

Build-time variables are available during docker build. Runtime variables are injected into the running container. Or use both.

Two editor modes

Key-value editor for structured management. Raw .env editor for pasting entire files. Switch between them freely.

Auto-generated connection strings

Deploy a PostgreSQL, MySQL, or MongoDB database and sh0 generates the connection URL automatically. One click to add it to your app.

RBAC access control

Viewer sees variable names only. Developer can reveal values. Admin can create, edit, and delete. Fine-grained team control.

The old way

  • x .env files sitting on the server in plaintext
  • x Copy-paste between environments manually
  • x No encryption -- anyone with SSH access can read
  • x No audit trail of who changed what
  • x Accidentally committed to version control
  • x Database URLs assembled by hand

The sh0 way

  • AES-256-GCM encrypted at rest
  • Bulk import and per-app scoping
  • RBAC-controlled: viewer, developer, admin
  • Masked by default, reveal requires permission
  • Never committed -- managed in dashboard or API
  • Auto-generated database connection URLs

Questions & answers

What encryption algorithm is used? +
AES-256-GCM (Galois/Counter Mode) with a master key derived using PBKDF2 with 100,000 iterations. Each file gets a unique random nonce. This is the same standard used by major cloud providers.
Who can see variable values? +
It depends on your role. Viewers can see variable names but not values. Developers can reveal values. Admins have full control including create, edit, and delete. All access is enforced server-side.
How do I migrate existing .env files? +
Open the raw .env editor in the dashboard and paste your existing .env content. sh0 parses it and creates encrypted variables for each entry. You can also use the API with a PUT request for bulk upsert.
Is there a limit on the number of variables? +
No hard limit. Each app has its own isolated set of environment variables. Practically, most apps use 10-50 variables, but sh0 handles hundreds without issue.

Your secrets deserve better than plaintext.

AES-256-GCM encryption, role-based access, bulk operations, and auto-generated database URLs. Included on every plan.

Get Started Free Security