Local-first security auditing for .env files, API keys, and developer secrets. Runs entirely on your machine. No cloud, no accounts, no telemetry.
Runs automatically on import and on manual rescan. Works in memory — never decrypts to audit.
Measures unpredictability per character. A string of all 'a's scores 0. A strong random token scores 3.8+. Below 2.5 bits/char is flagged high risk — the number tells you exactly how weak.
CryptographicPattern-matched against known credential prefixes — GitHub (ghp_), AWS (AKIA), Stripe (sk_live_), Google (AIza). A real live key in your file is flagged critical immediately.
Pattern MatchSet expiry on any secret — 30d, 60d, 90d, or a specific date. Dotward notifies you before keys go stale. Expired and expiring within 7 days tracked separately, clearly.
MonitoringEverything locked behind a master password. The derived key lives in memory only — close the app, it's gone. The file on disk is an encrypted blob. Useless without you.
EncryptionScan, audit, and export from your terminal and CI pipelines without opening the desktop app. Generate a CLI token in Settings and inject variables directly into your shell.
PipelineImport any .env file. Dotward parses, audits, encrypts, and stores in one pass. Export back to .env at any time — clean, decrypted, ready.
WorkflowEvery cryptographic decision has a reason. Here's exactly what happens to your secrets.
OWASP 2023 standard. Your master password is never stored. An attacker with your database file needs ~0.5s per guess. A 10-character password is economically infeasible to brute-force.
Every secret encrypted independently with a random 96-bit nonce. GCM provides confidentiality and authenticity — any tampering detected via a 16-byte auth tag.
The derived encryption key lives in session memory only. Close the app and it's gone. The SQLite file contains encrypted blobs — useless without the key.
Backup codes wrap your master key using AES-GCM. Recovery returns the original key with zero data loss. No email reset. No server call. Codes shown once, never stored.
# Key derived from master password — never stored on disk enc_key = PBKDF2(password, salt, length=32, iterations=600_000) session['enc_key'] = enc_key.hex() # memory only # Every variable encrypted independently nonce = os.urandom(12) # 96-bit, unique per value ciphertext, tag = AES_256_GCM.encrypt( key = enc_key, nonce = nonce, data = value.encode() ) stored_blob = base64( nonce + tag + ciphertext ) # this is what touches disk. useless without the key.
Security tools should be held to a higher standard. Here's exactly how Dotward handles your data.
Dotward is not a secret synchronization platform. It's a local-first auditing tool — focused on identifying risky credentials before they become incidents. Doppler syncs your secrets. dotenvx encrypts them. Dotward tells you when they're weak, stale, or dangerous.