Skip to content
SPECIFICTION
Get listed

PX Secrets

github.com

Free plan WebWindowsmacOSLinuxAPISelf-hosted
Visit github.com
Spec score 7.8 #17 of 46 in Secrets Management Tools

What it is

PX Secrets is a free, open-source secrets manager that stores an encrypted vault on the user’s machine. SOPS and AGE encrypt the vault on disk, while the project says the private AGE key is read directly by SOPS rather than handled by PX Secrets. A dark web interface offers search and service grouping, with an optional native desktop window through pywebview. The CLI lists services and retrieves named secrets for scripts. A local API supports runtime retrieval by scripts and AI agents, and the application can run headlessly as a background service. Docker deployment and CI/CD use are documented. The project states that it makes no network calls and collects no telemetry, analytics, usage tracking, or crash reports. Clipboard copies clear after 30 seconds, and temporary plaintext files are deleted after encryption. Linux and macOS are supported; Windows may work but is untested. Requirements include Python 3.9+, SOPS, and AGE. The software is licensed under AGPL-3.0.

Spec sheet

Purpose
PX Secrets is a free, open-source secrets manager that stores an encrypted vault on the user's machine.Read 9 Oct 2026 · github.com
Intended users
The README describes it as suited to developers, AI builders, homelabbers, and sysadmins.Read 9 Oct 2026 · github.com
Integrations
The README documents SOPS and AGE dependencies, Docker deployment, and runtime use by scripts, AI agents, and CI/CD pipelines.Read 9 Oct 2026 · github.com
Privacy
The project states it makes no network calls and collects no telemetry, analytics, usage tracking, or crash reports.Read 9 Oct 2026 · github.com
API security limit
The local API is unauthenticated by default; the README warns against exposing port 9999 outside the local host or a trusted private network without authentication.Read 9 Oct 2026 · github.com
CLI
The CLI can list services and retrieve secrets by name for scripts.Read 9 Oct 2026 · github.com
Clipboard
Copied secrets are automatically cleared from the clipboard after 30 seconds.Read 9 Oct 2026 · github.com
Encryption
It encrypts the vault on disk with SOPS and AGE, and the repository says the private AGE key is read directly by SOPS and never touched by PX Secrets.Read 9 Oct 2026 · github.com
Interface
It provides a dark web UI with search and service grouping, plus an optional native desktop window using pywebview.Read 9 Oct 2026 · github.com
Key recovery limit
The README states that losing the AGE private key means the encrypted vault cannot be recovered and that there is no reset or backdoor.Read 9 Oct 2026 · github.com
License and support
PX Secrets is licensed under AGPL-3.0, with bug reports handled through GitHub Issues and questions and ideas through GitHub Discussions.Read 9 Oct 2026 · github.com
Local API
A local API lets scripts and AI agents retrieve secrets at runtime, and the app can run headlessly as a background service.Read 9 Oct 2026 · github.com
Optional authentication
Setting PX_SECRETS_AUTH_TOKEN requires a bearer token for API requests, and read-only mode can disable mutating endpoints.Read 9 Oct 2026 · github.com
Requirements and platforms
The stated requirements are Python 3.9+, SOPS, and AGE; macOS and Linux are listed as supported, while Windows may work but is untested.Read 9 Oct 2026 · github.com
Temporary data
The README says decrypted data is held in memory and temporary plaintext files are deleted after encryption.Read 9 Oct 2026 · github.com

Plans and prices

PX Secrets Free Free and open-source · local secrets vault · AGPL-3.0 Read 9 Oct 2026 · github.com

Every PX Secrets plan and price →

Strong points and limits

Strong points

  • Free and open-source under AGPL-3.0
  • Encrypted local vault with SOPS and AGE
  • CLI and local API access
  • No network calls or telemetry
  • CI/CD injection and Kubernetes integration

Limits

  • API is unauthenticated by default
  • Losing the AGE key prevents recovery
  • Windows support is untested
  • No secret rotation

Who it suits

PX Secrets suits developers, AI builders, homelabbers, and sysadmins who want a self-hosted local vault with CLI, API, or web access. It also fits CI/CD and headless service workflows.

Verdict

PX Secrets provides local encrypted storage with web, CLI, API, and headless access while stating that it collects no telemetry. Users must protect the AGE key and secure the API before exposing it beyond a trusted local network.

Where Specifiction places it

Alternatives to PX SecretsAll alternatives →