enparse (.env-parser) is an open-source, encrypted, decentralized secret-sharing platform for small teams, enabling local deployments without exposing secrets.
No central server to compromise. Secrets are encrypted client-side with NaCl box before leaving your machine and stored as ciphertext on Ethereum. Each team member gets their own encrypted copy so that the chain never sees plaintext.
Jump to: Installation · Owner setup · Member setup
Owner Teammate
│ │
enparse init enparse init
enparse register enparse register
│ │
enparse project create myapp │
enparse project add myapp 0x<teammate> │
enparse set myapp DB_URL=postgres://... │
│ (encrypts per-member, writes on-chain) │
│ │
│ enparse run myapp -- go run .
│ (fetches + decrypts → env vars → exec)
Contracts (Sepolia):
| Contract | Purpose |
|---|---|
IdentityRegistry |
Maps each Ethereum address to a NaCl public key |
ProjectVault |
Stores per-member encrypted blobs keyed by project + secret name + address |
One deployment per team. Multiple projects live inside the same vault.
Pick your platform and run one command:
# YOLO
# macOS (Apple Silicon)
curl -L https://github.com/bradeu/enparse/releases/latest/download/enparse-darwin-arm64 -o enparse
chmod +x enparse && sudo mv enparse /usr/local/bin/
# macOS (Intel)
curl -L https://github.com/bradeu/enparse/releases/latest/download/enparse-darwin-amd64 -o enparse
chmod +x enparse && sudo mv enparse /usr/local/bin/
# Linux
curl -L https://github.com/bradeu/enparse/releases/latest/download/enparse-linux-amd64 -o enparse
chmod +x enparse && sudo mv enparse /usr/local/bin/Build from source
Requires Go 1.22+.
cd cli
GOTOOLCHAIN=local go build -o enparse .
mv enparse /usr/local/bin/Do this once for the whole team. Share your wallet address and the two contract addresses with teammates when done.
enparse initCreates ~/.enparse/identity.json with your Ethereum address and NaCl keypair.
enparse statusCopy your 0x... address — you need it in the next step.
- Go to the Google Web3 Faucet
- Sign in with a Google account
- Paste your
0x...address - Click Send 0.05 ETH
Funds arrive in under a minute. Verify at sepolia.etherscan.io by searching your address.
enparse config set rpc_url https://ethereum-sepolia-rpc.publicnode.comenparse deployDeploys IdentityRegistry and ProjectVault to Sepolia and saves both addresses to ~/.enparse/config.json automatically.
Run enparse config show to see the addresses — share them with your teammates.
enparse registerenparse project create myapp
# Add teammates by their Ethereum address (after they complete their setup)
enparse project add myapp 0x<teammate address>
# Store secrets — encrypted per member, written on-chain
enparse set myapp DB_URL=postgres://user:pass@host/db
enparse set myapp API_KEY=sk-...Ask your owner for their two contract addresses before starting.
enparse initCreates ~/.enparse/identity.json with your Ethereum address and NaCl keypair.
enparse statusCopy your 0x... address — share it with the owner so they can add you to projects.
- Go to the Google Web3 Faucet
- Sign in with a Google account
- Paste your
0x...address - Click Send 0.05 ETH
Funds arrive in under a minute. Verify at sepolia.etherscan.io by searching your address.
enparse config set rpc_url https://ethereum-sepolia-rpc.publicnode.com
enparse config set identity_registry_addr 0x<address from owner>
enparse config set project_vault_addr 0x<address from owner>enparse registerOnce the owner has added you to a project:
# Inject all secrets as env vars and run your command
enparse run myapp -- go run .
enparse run myapp -- npm start
# Or pull all secrets to a local .env cache
enparse pull myapp # writes ~/.enparse/cache/myapp.env
# Or read a single value
enparse get myapp DB_URLConfig lives at ~/.enparse/config.json. Set values with enparse config set or via environment variables.
| Key | Env var | Description |
|---|---|---|
rpc_url |
ENPARSE_RPC_URL |
Sepolia RPC endpoint |
identity_registry_addr |
ENPARSE_REGISTRY_ADDR |
Deployed IdentityRegistry address |
project_vault_addr |
ENPARSE_VAULT_ADDR |
Deployed ProjectVault address |
enparse config show # print current values| Command | Description |
|---|---|
enparse init [--force] |
Generate identity (NaCl + Ethereum keypair) |
enparse deploy |
Deploy IdentityRegistry + ProjectVault on-chain (owner only, once) |
enparse register |
Register NaCl public key on-chain (you pay gas) |
enparse status |
Show identity, config, and chain registration status |
enparse config set <key> <value> |
Set a config value |
enparse config show |
Print current config |
enparse project create <name> |
Create project (caller becomes owner) |
enparse project add <project> <address> |
Add registered member; auto-re-encrypts existing secrets |
enparse project list |
List projects you belong to |
enparse set <project> KEY=value |
Encrypt and store secret for all members (owner only) |
enparse get <project> KEY |
Fetch and decrypt a single secret |
enparse pull <project> |
Fetch all secrets → ~/.enparse/cache/<project>.env |
enparse run <project> -- <cmd> |
Inject secrets as env vars and exec command |
- Client-side encryption. Secrets are encrypted with NaCl box (Curve25519 + XSalsa20 + Poly1305) before leaving your machine. The chain stores only ciphertext.
- Per-member copies. Each member gets their own encrypted blob. Decryption requires their private NaCl key, which never leaves
~/.enparse/identity.json. - Append-only chain. Old secret versions persist in transaction history. Rotate secrets after removing a member.
- No process persistence.
enparse runusessyscall.Exec— secrets live only in the child process environment and are never written to disk.
MIT • LICENSE
