ensor is a fast, interactive CLI tool for detecting and redacting secrets from codebase. By default, ensor extracts discovered secrets into a .env file and substitutes them with customizable placeholders across your project, but also includes a versatile converter for .env, JSON, YAML, and TOML.

---

✨ Features

scan for detecting secrets redact secrets from codebase put secrets into a .env file convert between different secret formats

🎬 Demo

Watch ensor in action:

1793203918471040.mp4

📦 Installation

Homebrew

brew trust --cask pratyay360/tap/ensor
brew install pratyay360/tap/ensor

mise

mise use github:pratyay360/ensor@latest

curl (automated install script)

curl -sSL https://raw.githubusercontent.com/Pratyay360/ensor/main/install.sh | sh

goblin

curl -sf http://goblin.run/github.com/pratyay360/ensor | PREFIX=~/.local/bin sh 

Go Install

go install github.com/Pratyay360/ensor@latest

Scoop

scoop bucket add pratyay360 https://github.com/pratyay360/scoop-bucket
scoop install pratyay360/ensor

Winget (not yet available)

winget install pratyay360.ensor

Aqua registry

aqua install Pratyay360/ensor

Prebuilt Binaries & Packages

Download ready-to-run binaries or .deb, .rpm, and .apk packages from the Releases page for Linux, macOS, Windows, and FreeBSD.

---

🚀 Usage

1. Scan and Censor Secrets

Scan the current directory:

ensor

interactive mode feels slow and boring try.

ensor --yolo

for automatic redaction of secrets from the entire codebase.

That's it. ensor walks all the files and directories in codebase and detects + redacts the secrets from there.

By default, ensor skips scanning any file or directory that starts with a trailing dot, like .env, .env.json, or .git/* — so your actual secret files stay untouched.

Run ensor --help to see all available options.

Convert env files

ensor convert converts between any format of env files. Convert .env, YAML, TOML, JSON, and more — interchangeably.

Live demos

ensor in action

ensor convert

result ensor

---