Privacy & security

The best secrets managers, according to hackers

20 secrets managers recommended in Hacker News comments over the past year, ranked by how many separate people recommend each one.

• Most recommendedOneCLI39 people recommend it
• Least regretdotenvx10 recommend, 1 criticize

All secrets managers

• OneCLIOpen-source gateway that keeps real API keys away from AI agents by swapping placeholders at the proxy. Critics warn it may give false security and that the proxy is trusted.39recommend
• SOPSEncrypts secret files such as .env so they can live in Git or be read only when needed; people praise its simplicity, especially with age. Common caveat: it doesn't solve team sharing.28recommend
• HashiCorp VaultRecommended for fine-grained secret access, audit logs and a long track record. Common caveat: it needs setup, maintenance and separate infrastructure.26recommend
• fnoxA command-line tool that gives one interface to secrets stored in OS keychains, age, and cloud or local vaults, keeping them out of environment files. Its main caveat is that the master password is awkward when set in an environment variable.20recommend
• Agent VaultKeeps credentials out of AI agents' context via an egress proxy, so agents never handle raw keys. Critics note it has no security audit and doesn't stop all exfiltration.20recommend
• InfisicalOpen source secrets manager with self-hosting, a CLI that works in CI, and a UI people find easy. Critics say paid features are priced for enterprise.17recommend
• KloakRecommended as a privacy-first, open-source secret manager that keeps secrets from apps without requiring any modification. It is early alpha, and critics question its trust and privacy claims.13recommend
• enveilEncrypts .env secrets and injects them at runtime, guarding against accidental leaks in logs and agent file reads. Critics say same-user processes can still read them.13recommend
• dotenvxEncrypts .env files so secrets can be committed to Git safely, with the private key supplied separately; critics say it does not help with team sharing.10recommend
• VarlockFree, open-source toolkit that keeps secrets out of .env files, validates config against a schema, and pulls values from password managers; critics note you still need credentials to reach them.8recommend
• AWS Secrets ManagerPeople recommend it for simple API access with granular permissions and audit logs, and it works well at scale. The most common caveat is per-secret pricing that adds up.8recommend
• git-cryptRecommended for transparent encryption of chosen files in a Git repo, decrypted automatically with a working key. Critics say it assumes a single identity and handles access control poorly.8recommend
• LockenvFree, simple password-protected vault for storing secrets in git, reasonable for small teams, though access cannot be revoked once its password is known.8recommend
• SecretSpecDevelopers recommend SecretSpec as a declarative way to define and load secrets across apps, made by the team behind devenv. One critic notes it lacks a clear plan for a key feature.7recommend
• systemd-credentialsStores secrets at rest and in non-swappable memory, optionally TPM-backed, and is integrated with most Linux systems. Critics note it passes long-lived credentials into long-lived processes.7recommend
• OpenBaoFree, open-source secrets manager people recommend as a Vault alternative, with namespaces and distributed reads praised as free features. Caveat: it needs its own server and infrastructure to manage.6recommend
• dotenvDevelopers recommend it for loading app settings from a .env file into environment variables, including in hosting and secrets setups. Critics say the operating system should handle this and that it only moves settings to another file.6recommend
• CapyDevelopers recommend Capy for cryptographically revoking locally stored secrets remotely, a flexible CLI, and fast token generation on suitable setups.6recommend
• DopplerHosted service for storing secrets and environment variables off the filesystem and sharing them across a team. Critics say it is priced for enterprise and holds credentials itself.5recommend
• 1Password EnvironmentsKeeps API keys out of plaintext .env files while tools that read .env files keep working. People report it works reliably in everyday use with no issues.5recommend