dotenvx vs Teller

dotenvx encrypts secrets stored in.env files, then decrypts and injects them when an application runs. Its maker describes it as free and open source, with hosted and self-hosted deployment options. Public-key encryption uses a secp256k1 key pair, keeping the private decryption key separate from the encrypted file. For development, the private key can be stored in the operating system’s secret store, including macOS Keychain, Windows Credential Manager, or Linux Secret Service. Listed workflow tools include environment selection and composition, validation, pre-commit leak prevention, Docker image protection, key/value operations, and runtime log redaction. The maker says encrypted files can travel with code and be decrypted at runtime using a private key supplied in the deployment environment, without a secrets service in the application’s critical path. Installation options include CLI, npm, winget, Homebrew, GitHub releases, Docker, a Ruby gem, and Python pip. Guides cover developer tools, programming languages, and deployment services. The free User plan includes CLI, SDKs, encryption, and GitHub Issues support. Member is $5 a month; Business is $90 a month. The paid product has a 14-day free trial.

Teller is a free, Apache-2.0 open-source secret manager for developers working with secrets during development, testing, and app builds. It connects to vaults, key stores, and cloud services for personal environments or team workflows. Named integrations include HashiCorp Vault, AWS Secrets Manager, Google Secret Manager, HashiCorp Consul, AWS SSM, dotenv, etcd, and an in-memory store. The `teller run` command can start a subprocess with fetched variables, while `teller env` can provide a Docker `--env-file`. Teller can scan code for secrets and return exit code 1 in CI when run with `--error-if-found`. It can also redact secrets from process output, logs, live log tails, and files. Provider mappings can specify a root path, mapping ID, and key renames; configuration templates can use environment variables. The project offers release binaries and source installation with `cargo install --path .`. Write operations are available only through providers that support them.