No. 28 of 40 ·Secrets Management Tools

PX Secrets

Web · Windows · Mac · Linux · Self-hosted · API

Freedom report

Two barsScore 5.3

Free tierA free tier is on its own pricing page
Open codeNo open-source code on record
Runs widely4 of 6 device platforms
DocumentedThinly documented

PX Secrets is ranked #28 of 40 in secrets management tools on Freedom251. It runs on API, Linux, macOS, Self-hosted, Web, Windows. There is a free plan.

PX Secrets plans and pricing

All plans

PX Secrets Free Free and open-source · local secrets vault · AGPL-3.0 github.com · 9 Oct 2026

Compared on secrets management tools

Free plan: Yes
Secret rotation: No
CI/CD injection: Yes
Kubernetes integration: Yes
Deployment model: self_hosted

Best PX Secrets alternatives

See all 20

Two bars Envshed Free tier No. 1$5/mo6.6 Two bars Keyway Free tier No. 2€9/mo6.6 Two bars Kubermatic Kubernetes Platform Free tier No. 3Free6.6 Two bars Phase Free tier No. 4$10/mo6.6 Two bars SikkerKey Free tier No. 5$29/mo6.6 Two bars dotenvx Free tier No. 6$5/mo6.5

The record

Purpose: PX Secrets is a free, open-source secrets manager that stores an encrypted vault on the user's machine.
Encryption: It encrypts the vault on disk with SOPS and AGE, and the repository says the private AGE key is read directly by SOPS and never touched by PX Secrets.
Interface: It provides a dark web UI with search and service grouping, plus an optional native desktop window using pywebview.
CLI: The CLI can list services and retrieve secrets by name for scripts.
Local API: A local API lets scripts and AI agents retrieve secrets at runtime, and the app can run headlessly as a background service.
Integrations: The README documents SOPS and AGE dependencies, Docker deployment, and runtime use by scripts, AI agents, and CI/CD pipelines.
Privacy: The project states it makes no network calls and collects no telemetry, analytics, usage tracking, or crash reports.
Clipboard: Copied secrets are automatically cleared from the clipboard after 30 seconds.
Temporary data: The README says decrypted data is held in memory and temporary plaintext files are deleted after encryption.
API security limit: The local API is unauthenticated by default; the README warns against exposing port 9999 outside the local host or a trusted private network without authentication.
Optional authentication: Setting PX_SECRETS_AUTH_TOKEN requires a bearer token for API requests, and read-only mode can disable mutating endpoints.
Key recovery limit: The README states that losing the AGE private key means the encrypted vault cannot be recovered and that there is no reset or backdoor.
Requirements and platforms: The stated requirements are Python 3.9+, SOPS, and AGE; macOS and Linux are listed as supported, while Windows may work but is untested.
License and support: PX Secrets is licensed under AGPL-3.0, with bug reports handled through GitHub Issues and questions and ideas through GitHub Discussions.
Price from: Free

Where it ranks on Freedom251

Best Secrets Management Tools in 2026#28 of 40

Is PX Secrets yours?

Claim it for free: prove the domain, then correct facts, plans and screenshots. An editor reviews every change.

Claim it free Promote PX Secrets

Sources

github.com/pxinnovative/px-secrets· checked 9 Oct 2026