Keyorix vs Secrets Manager
Keyorix
keyorix.comSecrets Manager
github.comSide by side
| Figure | Keyorix | Secrets Manager |
|---|---|---|
| Price from | — | Free |
| Free plan | — | Yes |
| Free trial | — | — |
| Open source | — | — |
| Web | Yes | Yes |
| Windows | — | Yes |
| macOS | Yes | Yes |
| Linux | Yes | Yes |
| API | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 0 | 1 |
| Spec score · Secrets Management Tools | 7.7 (#20) | 8.3 (#7) |
| Audit | Keyorix says it logs who accessed what, when, and from where, and provides dashboard alerts for secrets nearing rotation deadlines. | The system records audit events including secret reveals, and documents that secret values are not returned if the required audit write fails. |
| Deployment | The project describes itself as on-premise, air-gap ready, and available as a single binary. | Docker Compose starts PostgreSQL, Redis, the backend, and frontend; local Kubernetes manifests are also provided for a kind cluster. |
| Encryption | The repository says secret values are encrypted with AES-256-GCM and that secrets are not logged or exposed in error messages. | The backend uses AES-256-GCM envelope encryption with a random data key per secret value, and the documentation says plaintext secret values are never stored in the database. |
| Integrations | The maker lists Go, Python, Node.js, and Java SDKs and an MCP server with read-only secret tools. | The documented CLI workflow uses Node.js and shows app commands for Node.js, Python, npm, and Next.js; CI or deployment can use `SECRETS_API_URL`, `SECRETS_TOKEN`, and `ENVIRONMENT_ID`. |
| Purpose | Keyorix is a secrets, keys, and certificates management platform designed for teams that cannot use SaaS. | Secrets Manager is a self-hosted system for storing application secrets encrypted, managing them in a web UI, and injecting them into processes through a CLI. |
| Secret management | The product supports creating, reading, updating, deleting, and versioning secrets, with development, staging, and production environments. | The UI supports importing .env files, editing and revealing secrets, keeping versions, rolling back, and soft-deleting secrets. |
| Support | The terms say paid services such as support are governed by a separate written agreement. | The repository directs vulnerability reports to a private GitHub security advisory and says not to disclose exploitable issues publicly. |
Plans
In their own words
Secrets Manager
Secrets Manager is a free, open-source, self-hosted system for storing application secrets in encrypted form, managing them through a web interface, and injecting them into processes with a command-line tool. Users organize secrets by organization, project, and environment, import.env files, edit or reveal values, keep versions, roll back, and soft-delete entries. The `secrets run` command supplies environment secrets to a child process and its descendants without creating a.env file. Documented workflows cover Node.js, Python, npm, and Next.js; CI or deployment can use an API URL, token, and environment ID. User and service-account grants can be scoped to projects or environments, and revealing values requires explicit permission. AES-256-GCM envelope encryption uses a separate data key per value, while plaintext values are not stored in the database. Audit events include secret reveals, and values are withheld if audit writing fails. Docker Compose starts PostgreSQL, Redis, backend, and frontend; local Kubernetes manifests are also provided. A user-generated master key is mandatory and lost keys make secrets unrecoverable. The repository is MIT licensed.