PX Secrets vs Secrets Manager
PX Secrets
github.comSecrets Manager
github.comSide by side
| Figure | PX Secrets | Secrets Manager |
|---|---|---|
| Price from | Free | Free |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | — | — |
| Web | Yes | Yes |
| Windows | Yes | Yes |
| macOS | Yes | Yes |
| Linux | Yes | Yes |
| API | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 1 | 1 |
| Spec score · Secrets Management Tools | 7.8 (#17) | 8.3 (#7) |
| CLI | The CLI can list services and retrieve secrets by name for scripts. | The `secrets run` command fetches environment secrets and supplies them to a child process without creating a `.env` file. |
| Encryption | It encrypts the vault on disk with SOPS and AGE, and the repository says the private AGE key is read directly by SOPS and never touched by PX Secrets. | The backend uses AES-256-GCM envelope encryption with a random data key per secret value, and the documentation says plaintext secret values are never stored in the database. |
| Integrations | The README documents SOPS and AGE dependencies, Docker deployment, and runtime use by scripts, AI agents, and CI/CD pipelines. | The documented CLI workflow uses Node.js and shows app commands for Node.js, Python, npm, and Next.js; CI or deployment can use `SECRETS_API_URL`, `SECRETS_TOKEN`, and `ENVIRONMENT_ID`. |
| Purpose | PX Secrets is a free, open-source secrets manager that stores an encrypted vault on the user's machine. | Secrets Manager is a self-hosted system for storing application secrets encrypted, managing them in a web UI, and injecting them into processes through a CLI. |
Plans
In their own words
PX Secrets
PX Secrets is a free, open-source secrets manager that stores an encrypted vault on the user’s machine. SOPS and AGE encrypt the vault on disk, while the project says the private AGE key is read directly by SOPS rather than handled by PX Secrets. A dark web interface offers search and service grouping, with an optional native desktop window through pywebview. The CLI lists services and retrieves named secrets for scripts. A local API supports runtime retrieval by scripts and AI agents, and the application can run headlessly as a background service. Docker deployment and CI/CD use are documented. The project states that it makes no network calls and collects no telemetry, analytics, usage tracking, or crash reports. Clipboard copies clear after 30 seconds, and temporary plaintext files are deleted after encryption. Linux and macOS are supported; Windows may work but is untested. Requirements include Python 3.9+, SOPS, and AGE. The software is licensed under AGPL-3.0.
Secrets Manager
Secrets Manager is a free, open-source, self-hosted system for storing application secrets in encrypted form, managing them through a web interface, and injecting them into processes with a command-line tool. Users organize secrets by organization, project, and environment, import.env files, edit or reveal values, keep versions, roll back, and soft-delete entries. The `secrets run` command supplies environment secrets to a child process and its descendants without creating a.env file. Documented workflows cover Node.js, Python, npm, and Next.js; CI or deployment can use an API URL, token, and environment ID. User and service-account grants can be scoped to projects or environments, and revealing values requires explicit permission. AES-256-GCM envelope encryption uses a separate data key per value, while plaintext values are not stored in the database. Audit events include secret reveals, and values are withheld if audit writing fails. Docker Compose starts PostgreSQL, Redis, backend, and frontend; local Kubernetes manifests are also provided. A user-generated master key is mandatory and lost keys make secrets unrecoverable. The repository is MIT licensed.