AWS Secrets Manager vs PX Secrets
AWS Secrets Manager
aws.amazon.comPX Secrets
github.comSide by side
| Figure | AWS Secrets Manager | PX Secrets |
|---|---|---|
| Price from | $0.40/mo | Free |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | — | — |
| Web | Yes | Yes |
| Windows | — | Yes |
| macOS | — | Yes |
| Linux | — | Yes |
| API | Yes | Yes |
| Self-hosted | — | Yes |
| Plans published | 2 | 1 |
| Spec score · Secrets Management Tools | 8.5 (#3) | 7.8 (#17) |
| Encryption | Secrets Manager encrypts secrets at rest with AWS Key Management Service keys and transmits retrieved secrets over TLS. | It encrypts the vault on disk with SOPS and AGE, and the repository says the private AGE key is read directly by SOPS and never touched by PX Secrets. |
| Integrations | Listed AWS integrations include Amazon RDS, Amazon Redshift, Amazon DocumentDB, Amazon MSK, Amazon SageMaker, AWS CodeBuild, and AWS Transfer Family. | The README documents SOPS and AGE dependencies, Docker deployment, and runtime use by scripts, AI agents, and CI/CD pipelines. |
| Purpose | AWS Secrets Manager manages access to applications, services, IT resources, database credentials, API keys, and other secrets throughout their lifecycle. | PX Secrets is a free, open-source secrets manager that stores an encrypted vault on the user's machine. |
Plans
In their own words
AWS Secrets Manager
AWS Secrets Manager has no write-up on Specifiction yet; its figures are above.
PX Secrets
PX Secrets is a free, open-source secrets manager that stores an encrypted vault on the user’s machine. SOPS and AGE encrypt the vault on disk, while the project says the private AGE key is read directly by SOPS rather than handled by PX Secrets. A dark web interface offers search and service grouping, with an optional native desktop window through pywebview. The CLI lists services and retrieves named secrets for scripts. A local API supports runtime retrieval by scripts and AI agents, and the application can run headlessly as a background service. Docker deployment and CI/CD use are documented. The project states that it makes no network calls and collects no telemetry, analytics, usage tracking, or crash reports. Clipboard copies clear after 30 seconds, and temporary plaintext files are deleted after encryption. Linux and macOS are supported; Windows may work but is untested. Requirements include Python 3.9+, SOPS, and AGE. The software is licensed under AGPL-3.0.