PX Secrets

Free plan APILinuxMacSelf-hostedWebWindows

What PX Secrets is

PX Secrets is a free, open-source secrets manager that stores an encrypted vault on the user's machine. It encrypts the vault on disk with SOPS and AGE; the project says the private AGE key is read by SOPS and is never handled by PX Secrets. A dark web interface provides search and service grouping, and an optional desktop window uses pywebview. The command-line tool can list services and retrieve secrets by name for scripts. A local API supports runtime access by scripts and AI agents, and the app can run as a headless background service. The README documents Docker deployment and use by CI/CD pipelines. The project states that the app makes no network calls and collects no telemetry, analytics, usage tracking, or crash reports. Copied secrets are cleared from the clipboard after 30 seconds. PX Secrets is licensed under AGPL-3.0 and requires Python 3.9+, SOPS, and AGE. macOS and Linux are listed as supported; Windows may work but is untested. The local API is unauthenticated by default, though a bearer token can be required, and read-only mode can disable changes. Losing the AGE private key makes the vault unrecoverable.

Who it suits

PX Secrets is described as suited to developers, AI builders, homelabbers, and sysadmins who want a local encrypted vault. Its CLI and local API support script and runtime access, including use in CI/CD pipelines.

What it does well

Free and open-source under AGPL-3.0
No network calls or telemetry, according to the project
CLI and local API support script access
Copied secrets clear after 30 seconds

What to know first

Local API is unauthenticated by default
Lost AGE private key means unrecoverable vault
Windows support is untested
Requires Python 3.9+, SOPS, and AGE

Limits

The free plan is the free and open-source PX Secrets product. The local API is unauthenticated by default, and loss of the AGE private key prevents vault recovery.

Plans

Plan	Billed and limits	Price
PX Secrets	Free and open-source · local secrets vault · AGPL-3.0	Free

As github.com lists them, read 9 Oct 2026. The maker's own page has the final word.

Getting started

Visit the PX Secrets project website.
Install Python 3.9 or later, SOPS, and AGE.
Deploy the self-hosted app, with Docker documented as an option.
Use the web interface or optional native desktop window to manage secrets.
Use the CLI or local API for runtime access from scripts and agents.
Set PX_SECRETS_AUTH_TOKEN to require a bearer token for API requests, if needed.

Verdict

PX Secrets provides a local encrypted vault with web, CLI, and API access for self-hosted use. The default API and key recovery limits matter when deciding how to deploy and safeguard it.

Questions

How much does PX Secrets cost?

PX Secrets is free and open-source. Its listed plan is free.

Which platforms does it support?

Linux and macOS are listed as supported, alongside web, API, and self-hosted use. Windows may work but is untested.

What does PX Secrets require?

It requires Python 3.9 or later, SOPS, and AGE.

Is PX Secrets open source?

Yes. It is licensed under AGPL-3.0.

Can scripts and AI agents access secrets?

Yes. The CLI can retrieve secrets by name, and a local API supports runtime retrieval by scripts and AI agents.

Does the local API require authentication?

It is unauthenticated by default. Setting PX_SECRETS_AUTH_TOKEN requires a bearer token for API requests.

Facts from PX Secrets's own pages

API security limit: The local API is unauthenticated by default; the README warns against exposing port 9999 outside the local host or a trusted private network without authentication. · github.com, 9 Oct 2026
CLI: The CLI can list services and retrieve secrets by name for scripts. · github.com, 9 Oct 2026
Clipboard: Copied secrets are automatically cleared from the clipboard after 30 seconds. · github.com, 9 Oct 2026
Encryption: It encrypts the vault on disk with SOPS and AGE, and the repository says the private AGE key is read directly by SOPS and never touched by PX Secrets. · github.com, 9 Oct 2026
Integrations: The README documents SOPS and AGE dependencies, Docker deployment, and runtime use by scripts, AI agents, and CI/CD pipelines. · github.com, 9 Oct 2026
Intended users: The README describes it as suited to developers, AI builders, homelabbers, and sysadmins. · github.com, 9 Oct 2026
Interface: It provides a dark web UI with search and service grouping, plus an optional native desktop window using pywebview. · github.com, 9 Oct 2026
Key recovery limit: The README states that losing the AGE private key means the encrypted vault cannot be recovered and that there is no reset or backdoor. · github.com, 9 Oct 2026
License and support: PX Secrets is licensed under AGPL-3.0, with bug reports handled through GitHub Issues and questions and ideas through GitHub Discussions. · github.com, 9 Oct 2026
Local API: A local API lets scripts and AI agents retrieve secrets at runtime, and the app can run headlessly as a background service. · github.com, 9 Oct 2026
Optional authentication: Setting PX_SECRETS_AUTH_TOKEN requires a bearer token for API requests, and read-only mode can disable mutating endpoints. · github.com, 9 Oct 2026
Privacy: The project states it makes no network calls and collects no telemetry, analytics, usage tracking, or crash reports. · github.com, 9 Oct 2026
Purpose: PX Secrets is a free, open-source secrets manager that stores an encrypted vault on the user's machine. · github.com, 9 Oct 2026
Requirements and platforms: The stated requirements are Python 3.9+, SOPS, and AGE; macOS and Linux are listed as supported, while Windows may work but is untested. · github.com, 9 Oct 2026
Temporary data: The README says decrypted data is held in memory and temporary plaintext files are deleted after encryption. · github.com, 9 Oct 2026

Where PX Secrets stands on Freedom251

Secrets Management Tools#13 of 46