dotenvx vs KeyEnv

dotenvx encrypts secrets stored in.env files, then decrypts and injects them when an application runs. Its maker describes it as free and open source, with hosted and self-hosted deployment options. Public-key encryption uses a secp256k1 key pair, keeping the private decryption key separate from the encrypted file. For development, the private key can be stored in the operating system’s secret store, including macOS Keychain, Windows Credential Manager, or Linux Secret Service. Listed workflow tools include environment selection and composition, validation, pre-commit leak prevention, Docker image protection, key/value operations, and runtime log redaction. The maker says encrypted files can travel with code and be decrypted at runtime using a private key supplied in the deployment environment, without a secrets service in the application’s critical path. Installation options include CLI, npm, winget, Homebrew, GitHub releases, Docker, a Ruby gem, and Python pip. Guides cover developer tools, programming languages, and deployment services. The free User plan includes CLI, SDKs, encryption, and GitHub Issues support. Member is $5 a month; Business is $90 a month. The paid product has a 14-day free trial.

KeyEnv manages environment variables and secrets across development workflows. Its CLI lets teams run, inject, and manage secrets from the terminal, while separate development, staging, and production configurations allow environment-specific overrides. A scanner checks for hardcoded keys, tokens, and passwords across more than 149 patterns. KeyEnv can schedule PostgreSQL and MySQL credential rotation using a two-secret approach intended to avoid downtime. Integrations include SDKs, GitHub Actions, Bitbucket Pipelines, serverless tools, and frameworks such as Next.js, Django, Laravel, Spring Boot, and Rails. The maker says secrets are encrypted on the device with AES-256-GCM and that it cannot access encryption keys or plaintext secrets; data in transit uses TLS 1.3, with Argon2id for key derivation. Access controls include roles, environment isolation, revocable scoped tokens, and audit logs. KeyEnv runs on Linux, macOS, web, API, and self-hosted deployments. The Free plan includes up to three projects and 100 secrets per environment. Team is $3.33/user/mo (annual) or $4.00 per user/month; new accounts get a 14-day Team-feature trial without a credit card.