- Home
- Secrets Management Tools
- PX Secrets
PX Secrets
What it is
PX Secrets is a free, open-source secrets manager that keeps an encrypted vault on the user's machine. SOPS and AGE encrypt the vault on disk; the project says SOPS reads the private AGE key directly, without PX Secrets handling it. A dark web interface supports searching and grouping secrets by service, and an optional desktop window uses pywebview. The command-line tool can list services and retrieve named secrets for scripts. A local API lets scripts and AI agents fetch secrets at runtime, and the app can run as a headless background service. The project documents Docker deployment and use in CI/CD pipelines. It states that the software makes no network calls and collects no telemetry, analytics, usage tracking, or crash reports. Copied secrets are removed from the clipboard after 30 seconds. Decrypted data stays in memory, and temporary plaintext files are deleted after encryption. The free, AGPL-3.0 software requires Python 3.9+, SOPS, and AGE. Its local API has no authentication by default, and losing the AGE private key makes the vault unrecoverable.
For and against
For
- Free and open source under AGPL-3.0
- Search and group secrets in a web UI
- CLI and local API support script access
- Clipboard copies clear after 30 seconds
- Supports CI/CD injection and Kubernetes integration
Against
- Requires Python 3.9+, SOPS, and AGE
- Windows may work but is untested
- Local API is unauthenticated by default
- Losing the AGE private key prevents recovery
The verdict
PX Secrets combines a local encrypted vault with web, CLI, and API access, and supports headless use. Secure the local API before exposing it beyond a trusted network, and protect the AGE private key because there is no recovery path.
Who it suits
PX Secrets is aimed at developers, AI builders, homelabbers, and sysadmins who want a self-hosted secrets vault. Its CLI and API also suit users who need scripts or AI agents to retrieve secrets at runtime.
Plans and prices
PX Secrets
Free and open-source · local secrets vault · AGPL-3.0
Read 9 Oct 2026 · github.com
On the record
- API security limit
- The local API is unauthenticated by default; the README warns against exposing port 9999 outside the local host or a trusted private network without authentication.github.com · read 9 Oct 2026
- CLI
- The CLI can list services and retrieve secrets by name for scripts.github.com · read 9 Oct 2026
- Clipboard
- Copied secrets are automatically cleared from the clipboard after 30 seconds.github.com · read 9 Oct 2026
- Encryption
- It encrypts the vault on disk with SOPS and AGE, and the repository says the private AGE key is read directly by SOPS and never touched by PX Secrets.github.com · read 9 Oct 2026
- Integrations
- The README documents SOPS and AGE dependencies, Docker deployment, and runtime use by scripts, AI agents, and CI/CD pipelines.github.com · read 9 Oct 2026
- Intended users
- The README describes it as suited to developers, AI builders, homelabbers, and sysadmins.github.com · read 9 Oct 2026
- Interface
- It provides a dark web UI with search and service grouping, plus an optional native desktop window using pywebview.github.com · read 9 Oct 2026
- Key recovery limit
- The README states that losing the AGE private key means the encrypted vault cannot be recovered and that there is no reset or backdoor.github.com · read 9 Oct 2026
- License and support
- PX Secrets is licensed under AGPL-3.0, with bug reports handled through GitHub Issues and questions and ideas through GitHub Discussions.github.com · read 9 Oct 2026
- Local API
- A local API lets scripts and AI agents retrieve secrets at runtime, and the app can run headlessly as a background service.github.com · read 9 Oct 2026
- Optional authentication
- Setting PX_SECRETS_AUTH_TOKEN requires a bearer token for API requests, and read-only mode can disable mutating endpoints.github.com · read 9 Oct 2026
- Privacy
- The project states it makes no network calls and collects no telemetry, analytics, usage tracking, or crash reports.github.com · read 9 Oct 2026
- Purpose
- PX Secrets is a free, open-source secrets manager that stores an encrypted vault on the user's machine.github.com · read 9 Oct 2026
- Requirements and platforms
- The stated requirements are Python 3.9+, SOPS, and AGE; macOS and Linux are listed as supported, while Windows may work but is untested.github.com · read 9 Oct 2026
- Temporary data
- The README says decrypted data is held in memory and temporary plaintext files are deleted after encryption.github.com · read 9 Oct 2026
