⛴envferry
Move .env files between machines without pasting secrets into chat.
# on the machine that has the file $ npx envferry send .env --relay your-relay.example:8787 code: efr1_9k2… # share this code out-of-band # on the machine that needs it $ npx envferry get efr1_9k2… wrote: .env
Why
You need a .env on another machine — your other laptop, a server, a
teammate. The lazy options all leak: paste it into Slack, email it, drop it in a
shared doc. envferry moves it over an end-to-end encrypted channel instead, and
because it understands env files it lands them safely on the other side —
auto-named, path-traversal safe, never clobbering what's already there.
Three transports, one get
Relay efr1_…
The usual choice. Both peers dial out to a blind relay that
pipes ciphertext only — it holds no key and cannot read a byte. Works when both
machines are behind NAT. Self-host one with envferry relay.
Direct ef1_…
No relay involved: the receiver dials the sender directly. Use when the
sending machine is reachable (static IP, LAN, VPN) —
--host is that machine's own address.
Loopback local-…
Same machine, two shells — handy for moving a file between checkouts or users without cat-and-paste.
Send to the whole team
envferry send .env --relay --receivers 5 keeps one code redeemable
until five teammates have fetched it — one command, one code, everyone onboarded.
Install
npx (no install)
npx envferry --help
npm
npm install -g envferry
Homebrew
brew install MalikZu/tap/envferry
Security, honestly stated
- End-to-end encrypted with
ECDHE-PSK-CHACHA20-POLY1305— AEAD with forward secrecy. The transfer code carries a one-time key; a wrong code fails the handshake and learns nothing. - No plaintext on any server. Direct transfers are peer-to-peer; the relay is a blind byte pump that holds no key — even its operator can't read your secrets.
- No invented crypto. envferry wraps Node's built-in TLS (OpenSSL) and ships with zero runtime dependencies, keeping the supply-chain surface minimal.
- The code is the capability. Anyone holding it can receive the file — share it over a channel you trust, use it promptly. Read the full threat model.