Desktop .env manager for developers

The idea

A small cross-platform desktop app that gives you a GUI for managing .env files across all your projects. You point it at a root directory, it discovers every .env, .env.local, .env.production, and similar file underneath it, and presents the variables in a table. You can view, add, edit, and copy values without opening a terminal or accidentally miscounting the characters in a long API key.

The typical workflow is: click a project from the sidebar, see all its env files as tabs (.env, .env.production, .env.staging), click a value to edit it in place. A diff view shows which variables exist in one environment file but not another.

Why build this

.env files are everywhere and universally painful to manage in a text editor. Long secret strings are easy to misselect. Comparing what is in .env versus .env.production requires opening two terminal splits and running diff or scrolling manually. Adding a new required variable to multiple environments means editing three files by hand and hoping you remember all of them.

Commercial secret managers like Doppler and 1Password Secrets Automation solve this at the organizational level with sync, access control, and CI injection — but at $15/seat/month or more. A solo developer or small team running local projects does not need cloud sync. They need a utility that opens fast, shows the file, and gets out of the way.

Tauri makes a cross-platform desktop app viable at solo-developer effort: the backend is a small Rust binary that reads from disk, and the frontend is a standard web stack. The resulting app ships as a native installer under 10 MB with no Electron overhead.

Stack sketch

• Framework: Tauri 2 — Rust backend for disk access and file watching; SvelteKit frontend for the UI
• File discovery: Rust's walkdir crate scanning configured root directories; live file watching via notify so the sidebar updates when a .env file is added or deleted outside the app
• Parsing: a dotenv-style line parser in Rust that preserves comments and blank lines so round-trip edits do not reformat the file
• Diff view: client-side comparison of two selected env files rendered as a two-column table; keys absent in either file highlighted in amber
• Secret masking: values hidden by default, revealed on click; a global toggle for those who want everything visible while working
• Storage: no database — all state is derived from the filesystem; the recent-projects list is a JSON sidecar in the OS app-config directory
• Packaging: Tauri's built-in bundler produces .dmg, .msi, and AppImage from one GitHub Actions workflow

Scope for v1

• Sidebar listing configured root directories with discovered .env files grouped by project folder
• Tab bar per project showing each detected env file variant (.env, .env.local, .env.production, .env.staging, and any *.env pattern)
• Variable table with name and masked value; one-click copy for either field
• Inline edit: click a value to edit in place; save writes back to the file, preserving comments and line order
• Add and delete variables; adding a variable prompts whether to propagate the key (blank-valued) to all other env files in the same project
• Diff view between any two env files in a project: which keys appear in only one file, which values differ
• Global search across all loaded env files by key name
• Secret masking on by default with per-value reveal on click
• Deliberately out of scope for v1: cloud sync, remote secrets injection, CI integration, encrypted storage, shared team access

Where it could go

The most natural extension is a missing-variables checker. You define a .env.example listing required keys — a pattern most repos already follow — and the app flags any env file that is missing a key from the example. That check, surfaced as a red badge on the affected tab, prevents the most common class of deploy failure: shipping to production without setting a required secret.

A second direction is env-file templates. You save a set of variable names (without values) as a named template — "Next.js + Supabase" or "n8n worker" — and creating a new environment from that template generates the skeleton file with all required keys present and blank. Combined with the missing-variables checker, new-environment setup becomes mechanical rather than error-prone.

Watch out for

The app reads files from disk and displays secrets in plaintext when revealed — it is a convenience tool, not a vault. The threat model for v1 is a developer on their own machine. Any feature that transmits secret values over the network changes that threat model entirely, so keep sync and export features out of scope until the security surface is deliberately designed for them.