Beakcrypt

The open-source standard for managing and sharing environment variables securely across your entire development workflow.

🌐 beakcrypt.com  ·  🐛 Report a Bug  ·  ✨ Request a Feature

---

Table of Contents

• What is Beakcrypt?
• Using Beakcrypt
• Project Structure
• Getting Started
• Contributing
• License

---

What is Beakcrypt?

Tired of pasting .env files into Slack? Sending secrets over email? Beakcrypt gives your team a shared, end-to-end encrypted vault for environment variables — managed with a CLI that fits into the workflow you already use.

• 🔒 End-to-end encrypted — secrets are encrypted on your machine before they ever leave it
• 🤝 Team vaults — invite teammates and manage access per project
• ⚡ CLI-first — push and pull .env files in seconds
• 🌍 Fully open-source — audit every line, self-host if you want, contribute freely

---

Using Beakcrypt

📹 Demo video coming soon.

# Log in with GitHub OAuth
$ beakcrypt login
✓ Logged in as jane@acme.com

# Link this directory to a project
$ beakcrypt link
✓ Linked to acme/api (development)

# Push your local secrets — encrypted before upload
$ beakcrypt push
→ Encrypting 12 variables...
✓ Synced to vault

# A teammate pulls the secrets on their machine
$ beakcrypt pull
→ Fetching from vault...
✓ Written to .env.local

# Inject secrets directly into any command
$ beakcrypt run -- npm run dev

No more .env files in Slack. No more "which version of the key is correct?". One vault. One source of truth.

---

Project Structure

This is a Turborepo monorepo managed with pnpm workspaces.

beakcrypt/
├── apps/
│   ├── web/              # Next.js app — beakcrypt.com
│   └── docs/             # Documentation site (Fumadocs)
├── packages/
│   ├── cli/              # CLI tool — published as `beakcrypt` on npm
│   ├── convex/           # Convex backend — schema, auth, API
│   ├── crypto/           # Shared E2EE primitives (RSA-4096, AES-256-GCM)
│   ├── shared/           # Shared types and utilities
│   ├── ui/               # Shared UI component library
│   ├── transactional/    # Transactional email templates
│   ├── eslint-config/    # Shared ESLint configuration
│   └── typescript-config/ # Shared TypeScript configuration
├── turbo.json
├── pnpm-workspace.yaml
└── tsconfig.json

---

Getting Started

Prerequisites

Tool	Version	Install
Node.js	v18 or later	nodejs.org
pnpm	v10 or later	corepack enable && corepack prepare pnpm@latest --activate
Git	latest	git-scm.com

Note: pnpm is the only tool you need globally. Convex CLI is run via npx (no global install needed). If you already have pnpm installed via npm i -g pnpm, that works too.

Verify your setup:

node --version    # v18+
pnpm --version    # v10+
git --version

Just want to run it locally? Clone directly. Want to contribute back? Fork first, then clone your fork — see Contributing.

1. Clone the repository

git clone https://github.com/prudentbird/beakcrypt.git
cd beakcrypt
git checkout dev

2. Install dependencies

pnpm install

3. Set up environment variables

cp apps/web/.env.example apps/web/.env.local

Open apps/web/.env.local and fill in the required values. Every variable is documented inside the file. The two services you must configure:

Convex — run npx convex dev from the repo root. It will walk you through creating a free deployment and automatically print your CONVEX_DEPLOYMENT, CONVEX_URL, and CONVEX_SITE_URL values.

GitHub OAuth — create a free OAuth App at github.com/settings/developers:

• Homepage URL: http://localhost:3000
• Callback URL: http://localhost:3000/api/auth/callback/github

Better Auth — generate a secret:

openssl rand -base64 32

4. Run in development

pnpm dev

The web app will be available at http://localhost:3000 and the docs at http://localhost:3000/docs.

Note: pnpm dev starts all apps using Turborepo with Vercel Microfrontends. If you only want to run the web app locally, use:

cd apps/web && npx next dev --port 3000 --turbopack

Tip: If you want to start the server before configuring Convex (e.g. to explore the codebase), set SKIP_ENV_VALIDATION=1:

SKIP_ENV_VALIDATION=1 pnpm dev

Other commands

pnpm build          # Build all apps and packages
pnpm lint           # Run ESLint across the monorepo
pnpm typecheck      # TypeScript type checking
pnpm format         # Format code with Prettier
pnpm dev:app        # Run only the web app + Convex backend

---

Contributing

Contributions are welcome — bug fixes, features, and docs all count. Please read CONTRIBUTING.md before opening a PR.

Quick contribution flow:

# 1. Fork the repo and clone your fork
git clone https://github.com/<your-username>/beakcrypt.git
cd beakcrypt
git remote add upstream https://github.com/prudentbird/beakcrypt.git

# 2. Create a feature branch off dev
git fetch upstream
git checkout -b feat/your-feature upstream/dev

# 3. Make your changes, then push
git push origin feat/your-feature

# 4. Open a Pull Request against the dev branch

Ready to jump in?

• 🐛 Open a bug report
• ✨ Request a feature
• 🔀 Submit a pull request — see our PR template
• 🏷️ good first issue — great for first-time contributors

---

License

Distributed under the MIT License — see LICENSE for details.

---

If you find Beakcrypt useful, please consider giving it a ⭐

Made with ❤️ by prudentbird and contributors