dotenvx vs PX Secrets

dotenvx encrypts secrets stored in.env files, then decrypts and injects them when an application runs. Its maker describes it as free and open source, with hosted and self-hosted deployment options. Public-key encryption uses a secp256k1 key pair, keeping the private decryption key separate from the encrypted file. For development, the private key can be stored in the operating system’s secret store, including macOS Keychain, Windows Credential Manager, or Linux Secret Service. Listed workflow tools include environment selection and composition, validation, pre-commit leak prevention, Docker image protection, key/value operations, and runtime log redaction. The maker says encrypted files can travel with code and be decrypted at runtime using a private key supplied in the deployment environment, without a secrets service in the application’s critical path. Installation options include CLI, npm, winget, Homebrew, GitHub releases, Docker, a Ruby gem, and Python pip. Guides cover developer tools, programming languages, and deployment services. The free User plan includes CLI, SDKs, encryption, and GitHub Issues support. Member is $5 a month; Business is $90 a month. The paid product has a 14-day free trial.

PX Secrets is a free, open-source secrets manager that stores an encrypted vault on the user’s machine. SOPS and AGE encrypt the vault on disk, while the project says the private AGE key is read directly by SOPS rather than handled by PX Secrets. A dark web interface offers search and service grouping, with an optional native desktop window through pywebview. The CLI lists services and retrieves named secrets for scripts. A local API supports runtime retrieval by scripts and AI agents, and the application can run headlessly as a background service. Docker deployment and CI/CD use are documented. The project states that it makes no network calls and collects no telemetry, analytics, usage tracking, or crash reports. Clipboard copies clear after 30 seconds, and temporary plaintext files are deleted after encryption. Linux and macOS are supported; Windows may work but is untested. Requirements include Python 3.9+, SOPS, and AGE. The software is licensed under AGPL-3.0.