Sotto

Stop Slacking your `.env` files.

Sotto syncs secrets across your team with end-to-end encryption. Values are encrypted on your machine before they leave it and decrypted only on your teammates’ machines. The server stores ciphertext it cannot read.

curl -fsSL https://raw.githubusercontent.com/getsotto/sotto/main/install.sh | sh

Signed binaries for macOS and Linux. The installer verifies the checksum, and the Sigstore signature when cosign is installed. Prefer to read it first? Or grab a tarball from releases.

$ sotto init
  Save your Emergency Kit - these cannot be recovered:
    Secret Key:   SK1-9FKQ-XXXX-XXXX-XXXX
initialised `acme-api` (dev)

$ sotto set DATABASE_URL
Value:
set DATABASE_URL (acme-api/dev)

$ sotto run -- npm start
ready on http://localhost:3000

$ sotto push
pushed acme-api/dev - revision 1

$ sotto share DATABASE_URL
share link (acme-api/dev) - burns after 1 view(s):
https://getsotto.co.uk/s/00112233445566778899aabbccddeeff#AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8

$

How it works

Encrypt locally. Your vault key is derived on your machine from your master password and secret key. Neither is ever sent anywhere.
Sync ciphertext. The server stores and versions encrypted blobs. It never receives a plaintext value or a usable key, so there is nothing on it worth stealing.
Decrypt on your devices. One Rust crypto core runs everywhere: the CLI natively, the browser through WebAssembly, with golden vectors in CI proving both produce identical bytes.

Teams work the same way: sharing an environment grants its key to a member (an X25519 sealed box), so access is cryptographic, not a permission bit on the server. Removing a member rotates the keys.

Should you trust this?

Not blindly. Sotto is pre-1.0 and has not had a third-party cryptographic audit yet. You should know that before putting anything important in it. Here is what you can verify yourself, today:

A published threat model with explicit non-goals.
One shared crypto core: the CLI and the browser client run the same Rust code, held to byte-for-byte golden vectors in CI.
Sigstore-signed releases with a documented verification procedure.
Telemetry is four anonymous fields, opt-out, and pinned by a unit test so it cannot quietly grow.
Apache-2.0, and self-hostable from one docker-compose.

Honest guidance: use it for your team’s development and staging secrets today. Keep the production crown jewels where they are until the audit.

Pricing

Local and self-hosted

Free

Open-source Sotto, running on your devices or your own server
Keep control of hosting and operating costs
Share links remain free for recipients

Sotto Cloud

£2.99 / person / month

Or £29.99 per person / year
First 100 named paid seats: £1.99 monthly for 12 months, then £2.99; or £19.99 for the first year, then £29.99
No trial; hosted access starts after payment is confirmed

Cloud is operated by Sotto and has no SLA. The source is open and can be self-hosted. Prices and applicable taxes are confirmed at checkout. Free one-time links have a limit of three active links per account, one view each, with a seven-day expiry.

Or run it yourself: the server is self-hostable and Apache-2.0.

Open source

Apache-2.0. One repo, one crypto core. Star it if Sotto saved you from pasting a .env into Slack; pick a good first issue if you want to help.

Star on GitHub Good first issues Contributing

Get started

sotto init                   # create your identity; SAVE the Emergency Kit
sotto set DATABASE_URL       # hidden prompt; encrypted before it touches disk
sotto import .env            # optional: pull in an existing file, still encrypted locally
sotto run -- npm start       # inject secrets into any command
sotto login && sotto push    # optional: sync ciphertext via getsotto.co.uk
sotto share DATABASE_URL     # one-time link for a single secret

Sotto works fully offline until you sotto login. Sync is a feature, not a requirement. The web vault at this address decrypts in your browser, with keys that never leave your devices.

Stop Slacking your .env files.