- Home
- Secrets Management Tools
- Secrets Manager
Secrets Manager
What it is
Secrets Manager is an open-source, self-hosted system for storing application secrets in encrypted form, managing them through a web interface and injecting them into processes with a command-line tool. Users can organize secrets by organization, project and environment; import `.env` files; edit or reveal values; retain versions; roll back changes; and soft-delete secrets. The `secrets run` command supplies environment secrets to a child process and its descendants without creating a `.env` file. Documented workflows cover Node.js, Python, npm and Next.js, while CI or deployment can use an API URL, token and environment ID. Access grants apply to users and service accounts at project or environment scope, and revealing values requires an explicit grant. AES-256-GCM envelope encryption is used, with plaintext values not stored in the database. A user-generated master key is required before startup, and losing it makes secrets unrecoverable. Docker Compose, PostgreSQL, Redis and local Kubernetes manifests are documented.
For and against
For
- Free MIT-licensed open source
- Encrypted secret storage
- Version rollback and soft deletion
- CLI injection without `.env` files
- Audit events and access grants
Against
- Self-hosted deployment required
- Master-key loss makes secrets unrecoverable
- Docker Compose required
- Repository key exposure requires recovery steps
The verdict
Secrets Manager provides a free, self-hosted workflow for encrypted secrets, versioning, permissions and process injection. Its deployment requirements and master-key responsibility are significant, and the documented repository key incident requires careful recovery handling.
Who it suits
It suits developers and teams wanting free, self-hosted secret storage with CLI injection, access controls and audit records. Users must be comfortable managing Docker Compose, the required master key and deployment environment.
Plans and prices
Open-source self-hosted
MVP focused on a single developer; requires Docker Compose and Node 20+ for the CLI
Read 11 Oct 2026 · github.com
On the record
- Access controls
- Access can be granted to users and service accounts at project or environment scope, and revealing secret values requires an explicit grant.github.com · read 11 Oct 2026
- Audit
- The system records audit events including secret reveals, and documents that secret values are not returned if the required audit write fails.github.com · read 11 Oct 2026
- CLI
- The `secrets run` command fetches environment secrets and supplies them to a child process without creating a `.env` file.github.com · read 11 Oct 2026
- CLI injection
- The `secrets run` CLI command injects an environment’s secrets into a child process and its children without creating a .env file.github.com · read 11 Oct 2026
- Deployment
- Docker Compose starts PostgreSQL, Redis, the backend, and frontend; local Kubernetes manifests are also provided for a kind cluster.github.com · read 11 Oct 2026
- Deployment requirements
- The quickstart requires Docker and Docker Compose, plus Node 20 or later for the CLI step.github.com · read 11 Oct 2026
- Encryption
- The backend uses AES-256-GCM envelope encryption with a random data key per secret value, and the documentation says plaintext secret values are never stored in the database.github.com · read 11 Oct 2026
- Important security notice
- The maker says a real master key was published in the repository before 2026-07-26 and advises treating secrets encrypted with it as disclosed and following its recovery steps.github.com · read 11 Oct 2026
- Integrations
- The documented CLI workflow uses Node.js and shows app commands for Node.js, Python, npm, and Next.js; CI or deployment can use `SECRETS_API_URL`, `SECRETS_TOKEN`, and `ENVIRONMENT_ID`.github.com · read 11 Oct 2026
- Key requirement
- A user-generated master key is required before startup; losing it makes stored secrets unrecoverable.github.com · read 11 Oct 2026
- License
- The repository identifies its license as MIT.github.com · read 11 Oct 2026
- Master key requirement
- A user-generated master encryption key is required before startup, and the maker warns that losing it makes stored secrets unrecoverable.github.com · read 11 Oct 2026
- MVP audience
- The project describes itself as an open-source MVP focused on a clean first-run experience for a single developer, with multi-user organizations, roles, and grants also available.github.com · read 11 Oct 2026
- Organization
- Users can create organizations, projects, and environments to organize secrets for team projects.github.com · read 11 Oct 2026
- Platform support
- The maker documents CLI support for Windows PowerShell and Command Prompt, and gives macOS/Linux command examples.github.com · read 11 Oct 2026
- Product status
- The project’s README documents self-hosted Docker Compose deployment and does not list hosted plans or prices.github.com · read 11 Oct 2026
- Purpose
- Secrets Manager is a self-hosted system for storing application secrets encrypted, managing them in a web UI, and injecting them into processes through a CLI.github.com · read 11 Oct 2026
- Secret history
- Secrets have versions that can be rolled back to earlier versions.github.com · read 11 Oct 2026
