Varlock
Shares rank 10 of 20 secrets managers by recommenders
Free, open-source toolkit that keeps secrets out of .env files, validates config against a schema, and pulls values from password managers; critics note you still need credentials to reach them.
Free, open-source toolkit that keeps secrets out of .env files, validates config against a schema, and pulls values from password managers; critics note you still need credentials to reach them.
11 people gave an opinion
- recommend it
- 8
- criticize it
- 3
- approval share
- 73%
Recommended in 9 of 13 months
- November 2025: not recommended
- December 2025: recommended
- January 2026: recommended
- February 2026: recommended
- March 2026: recommended
- April 2026: recommended
- May 2026: recommended
- June 2026: not recommended
- July 2026: recommended
- August 2026: recommended
- September 2026: not recommended
- October 2026: recommended
- November 2026: not recommended (month in progress)
Why it doesn’t carry the badge
- 8 people recommend itNeeds 10 or more, not met.
- 2.7 recommenders for every criticNeeds 2 to 1 or better, met.
- Recommended in 9 of 13 monthsNeeds 4 or more, met.
The same three rules apply to every product, and the badge can’t be bought. How the badge works
What people say about it
The reasons people give, with the number of comments that give each one. Open a reason to read what they said.
Why people recommend it
Each mark is one comment
Pulls secrets from many backends
“can pull secrets from many places, and has a credential broker (proxy) to inject placeholders”
Comment from 11 Aug 2026 in “What I learned by putting GitHub Copilot behind a MitM proxy” “it has a plugin system so you can follow this pattern but pull from many different backends”
Comment from 25 Mar 2026 in “Storing Claude Code API keys in KeePassXC instead of plaintext config” “There are plugins for many different secret storage solutions, including infisical”
Comment from 9 Apr 2026 in “Coding Agents Are Reading Your .env” - Comment from 19 May 2026 in “CISA Admin Leaked AWS GovCloud Keys on GitHub”
- Comment from 1 Oct 2026 in “TIL: Loading .env files into my terminal”
- Comment from 10 Apr 2026 in “Ask HN: How do you and your team manage secrets day to day?”
- Comment from 5 May 2026 in “Show HN: SecretEnv – Run any process with secrets from all your backends”
Schema adds validation and type safety
“It’s a whole toolkit for this - with built in validation, type safety, and extra protection for sensitive secrets.”
Comment from 28 Feb 2026 in “Stop Putting Secrets in .env Files” “The .env.schema approach is a great way to guarantee strict type safety and a single source of truth.”
Comment from 19 Feb 2026 in “Show HN: Env-rx – Catch missing .env variables before they break your CI” “Free and open source - works with tons of tools. Adds validation, type safety, lots of nice features.”
Comment from 15 Mar 2026 in “Show HN: GitAgent – An open standard that turns any Git repo into an AI agent” - Comment from 9 Dec 2025 in “CLI tool that scans your codebase for environment variable issues”
- Comment from 23 May 2026 in “Ask HN: How do small teams securely share env files?”
Keeps secrets out of plaintext files
“it helps get your keys out of plaintext, while giving your agents a schema and additional tools so it can interact with env vars safely”
Comment from 13 Apr 2026 in “Ask HN: Do you trust AI agents with API keys / private keys?” “Better than masking them in a file, get them out of the file entirely! Pull them declaratively instead”
Comment from 22 Jan 2026 in “Show HN: Dotenv Mask Editor: No more embarrassing screen leaks of your .env” “helps keep secrets out of plaintext by using plugins to pull from various backends”
Comment from 19 May 2026 in “CISA Admin Leaked AWS GovCloud Keys on GitHub” - Comment from 1 Apr 2026 in “The .env File Nobody Needs”
Free and open source
“Free and open source - works with tons of tools. Adds validation, type safety, lots of nice features.”
Comment from 15 Mar 2026 in “Show HN: GitAgent – An open standard that turns any Git repo into an AI agent” “it's free and open source, and we have really modernized and adapted the familiar syntax”
Comment from 28 Aug 2026 in “The Twelve-Factor App (2025)” “Free, open source, and very flexible toolkit to use however you like.”
Comment from 4 Aug 2026 in “Where .env Went Wrong” - Comment from 17 Mar 2026 in “Show HN: Touchenv – store ENV master keys in macOS keychain”
Other secrets managers people recommend
The four most recommended other secrets managers, with the same counts for each, so you can compare like for like. The tick on each bar marks the 2 to 1 line the badge needs.
| Product | Recommend | Criticize | Approval | Months | Owned | Badge |
|---|---|---|---|---|---|---|
| OneCLI | 39 | 8 | 83% | 6 | — | Approved |
| SOPS | 28 | 5 | 85% | 10 | — | Approved |
| HashiCorp Vault | 26 | 10 | 72% | 10 | — | Approved |
| fnox | 20 | 4 | 83% | 9 | — | Approved |
| VarlockThis page | 8 | 3 | 73% | 9 | — | — |
What people said
40 of the 45 comments that mention it, newest first. Each links to the original comment.
“Adds validation and has plugins to pull from anywhere (1pass, aws, keepass, etc)”
“you still get a schema and familiar interface for how it all works”
“it's free and open source, and we have really modernized and adapted the familiar syntax”
“It fixes some of the rough edges of using 1pass for dev purposes.”
“Varlock solves many of these problems, and a lot more.”
“can pull secrets from many places, and has a credential broker (proxy) to inject placeholders”
“Free, open source, and very flexible toolkit to use however you like.”
“Never written to disk and supports caching behind Secure Enclave.”
“is also good for this and more mature. I use it on some work projects”
“a complete config+secrets toolkit that helps manage secrets”
“Varlock is clever. Sub string types for .envs pretty cool, why not”
“It's extremely flexible, and can even do credential brokering for untrusted workloads.”
“for making integrating this feature securely very simple”
“It has built in validation, extra protection for your secrets”
“Varlock is a great and flexible way to do this.”
“helps keep secrets out of plaintext by using plugins to pull from various backends”
“It's also incredibly flexible since functions can be written to make things idiomatic for that backend.”
“varlock's solid, but it's solving different problem.”
“it uses functions and a plugin system to pull from different backends”
“it helps get your keys out of plaintext, while giving your agents a schema and additional tools so it can interact with env vars safely”
“It works with all the secret and password managers everyone is already using”
“There are plugins for many different secret storage solutions, including infisical”
“makes .env files useful and safer!”
“it has a plugin system so you can follow this pattern but pull from many different backends”
“You'll probably like https://varlock.dev (free and open source)”
“Free and open source - works with tons of tools. Adds validation, type safety, lots of nice features.”
“varlock adds a lot of additional last mile tooling to get secrets/config integrated into projects”
“Varlock's approach of bridging 1Password into dotenv workflows is clever though.”
“Easiest way to use it for dev purposes is varlock”
“It’s a whole toolkit for this - with built in validation, type safety, and extra protection for sensitive secrets.”
“a unified way of managing both sensitive and non-sensitive values”
“patching console and http in JS to auto-redact sensitive data based on the schema is genuinely brilliant”
“But you can get the most benefit by integrating it fully.”
“The .env.schema approach is a great way to guarantee strict type safety and a single source of truth.”
“the schema file is part of the loading process, so it can never be out of sync”
“Better than masking them in a file, get them out of the file entirely! Pull them declaratively instead”
“can help with the secure injection, log redaction, and provide a ton more tooling”
“that is much more ergonomic IMO”
“This lets you have shared config at the root, or just to break things up however you need.”
“The schema becomes the single source of truth, and is used to generate types as well.”
Counts come from 1,795,640 Hacker News comments, November 2025 to November 2026. How we count. Report a mistake.