dotenvx vs SikkerKey

dotenvx encrypts secrets stored in.env files, then decrypts and injects them when an application runs. Its maker describes it as free and open source, with hosted and self-hosted deployment options. Public-key encryption uses a secp256k1 key pair, keeping the private decryption key separate from the encrypted file. For development, the private key can be stored in the operating system’s secret store, including macOS Keychain, Windows Credential Manager, or Linux Secret Service. Listed workflow tools include environment selection and composition, validation, pre-commit leak prevention, Docker image protection, key/value operations, and runtime log redaction. The maker says encrypted files can travel with code and be decrypted at runtime using a private key supplied in the deployment environment, without a secrets service in the application’s critical path. Installation options include CLI, npm, winget, Homebrew, GitHub releases, Docker, a Ruby gem, and Python pip. Guides cover developer tools, programming languages, and deployment services. The free User plan includes CLI, SDKs, encryption, and GitHub Issues support. Member is $5 a month; Business is $90 a month. The paid product has a 14-day free trial.

SikkerKey is a secrets manager and vault for application and infrastructure credentials. It supports standard, structured, managed, leased, certificate, canary, and TTL secrets, as well as secret rotation and dynamic secrets. Machines authenticate by signing each request with an Ed25519 private key that stays on the host. Teams can connect it to CI/CD, containers, app platforms, serverless functions, servers, and on-premise systems through its CLI, SDKs, or signed HTTP. Official SDKs are available for Go, Python, Node.js,.NET, Kotlin, and PHP. Its CLI supports Linux x64 and ARM64, macOS Intel and Apple Silicon, and Windows x64. The service describes a three-layer encryption design; its MCP server gives AI agents a separate identity class that cannot retrieve plaintext secret values. SikkerKey says its vault, secrets, and audit trail stay in the EU and are operated from Denmark. The free Developer plan is free and includes 10 machines; paid plans start at $29/mo. Every plan includes direct in-dashboard support and unlimited secret, project, read-volume, and rotation counts.