# Varlock

8 Hacker News commenters recommended Varlock and 3 criticized it, November 2025 to November 2026. It was recommended in 9 of 13 months.

**Verdict:** Free, open-source toolkit that keeps secrets out of .env files, validates config against a schema, and pulls values from password managers; critics note you still need credentials to reach them.

## Why people recommend it

- Pulls secrets from many backends (7 comments): "can pull secrets from many places, and has a credential broker (proxy) to inject placeholders" ([source](https://news.ycombinator.com/item?id=49265535)) "it has a plugin system so you can follow this pattern but pull from many different backends" ([source](https://news.ycombinator.com/item?id=47522124)) "There are plugins for many different secret storage solutions, including infisical" ([source](https://news.ycombinator.com/item?id=47707784))
- Schema adds validation and type safety (5 comments): "It’s a whole toolkit for this - with built in validation, type safety, and extra protection for sensitive secrets." ([source](https://news.ycombinator.com/item?id=47190519)) "The .env.schema approach is a great way to guarantee strict type safety and a single source of truth." ([source](https://news.ycombinator.com/item?id=47070962)) "Free and open source - works with tons of tools. Adds validation, type safety, lots of nice features." ([source](https://news.ycombinator.com/item?id=47384511))
- Keeps secrets out of plaintext files (4 comments): "it helps get your keys out of plaintext, while giving your agents a schema and additional tools so it can interact with env vars safely" ([source](https://news.ycombinator.com/item?id=47753362)) "Better than masking them in a file, get them out of the file entirely! Pull them declaratively instead" ([source](https://news.ycombinator.com/item?id=46713708)) "helps keep secrets out of plaintext by using plugins to pull from various backends" ([source](https://news.ycombinator.com/item?id=48195303))
- Free and open source (4 comments): "Free and open source - works with tons of tools. Adds validation, type safety, lots of nice features." ([source](https://news.ycombinator.com/item?id=47384511)) "it's free and open source, and we have really modernized and adapted the familiar syntax" ([source](https://news.ycombinator.com/item?id=49480756)) "Free, open source, and very flexible toolkit to use however you like." ([source](https://news.ycombinator.com/item?id=49173591))

## Alternatives hackers recommend

- [fnox](https://hackerapproved.com/p/fnox.md): 20 recommend
- [Infisical](https://hackerapproved.com/p/infisical.md): 17 recommend
- [enveil](https://hackerapproved.com/p/enveil.md): 13 recommend
- [dotenvx](https://hackerapproved.com/p/dotenvx.md): 10 recommend
- [git-crypt](https://hackerapproved.com/p/git-crypt.md): 8 recommend

## Cite as

Hacker Approved, "Varlock", https://hackerapproved.com/p/varlock/ (counts from 1,795,640 Hacker News comments, November 2025 to November 2026).