dotenvx vs Keyway

dotenvx encrypts secrets stored in.env files, then decrypts and injects them when an application runs. Its maker describes it as free and open source, with hosted and self-hosted deployment options. Public-key encryption uses a secp256k1 key pair, keeping the private decryption key separate from the encrypted file. For development, the private key can be stored in the operating system’s secret store, including macOS Keychain, Windows Credential Manager, or Linux Secret Service. Listed workflow tools include environment selection and composition, validation, pre-commit leak prevention, Docker image protection, key/value operations, and runtime log redaction. The maker says encrypted files can travel with code and be decrypted at runtime using a private key supplied in the deployment environment, without a secrets service in the application’s critical path. Installation options include CLI, npm, winget, Homebrew, GitHub releases, Docker, a Ruby gem, and Python pip. Guides cover developer tools, programming languages, and deployment services. The free User plan includes CLI, SDKs, encryption, and GitHub Issues support. Member is $5 a month; Business is $90 a month. The paid product has a 14-day free trial.

Keyway is an open-source secrets manager that injects environment variables into a running process instead of storing them in a project.env file. Its `keyway run` command makes secrets available while that process runs; they disappear when it stops. Keyway says AI agents reading files from disk cannot see secrets injected this way. Access follows GitHub repository permissions, so removing a person’s repository access also revokes their Keyway access.

Secrets use AES-256-GCM encryption with a unique random IV for each secret. An isolated crypto service holds the encryption key, which Keyway says does not touch its API server or database; connections among the CLI, API, crypto service, and database use TLS 1.3. An audit trail records who accessed which secrets, when, and from where. Documented provider workflows cover Vercel, Netlify, and Railway. CLI binaries are listed for macOS, Linux, and Windows, and the full stack can be self-hosted with Docker Compose. The Free plan includes unlimited public repositories, one private repository, three environments per repository, two provider integrations, and unlimited collaborators. Paid plans are Pro at €9 a month, Team at €19 a month, and Business at €39 a month.