Secrets Manager

Secrets Manager is a self-hosted, open-source vault for storing application secrets, administering them in a browser, and injecting them into processes from a command line. It is aimed at developers who can run their own Docker stack, from a solo builder to a small team with defined environments. The feature set is useful and free, but the master-key incident and irreversible key loss demand unusually careful operational discipline.

Overview

Organizations, projects, and environments provide a sensible hierarchy for separating development, staging, and production values. The web interface imports .env files, lets authorized users edit or reveal values, preserves versions for rollback, and supports soft deletion. That is a solid maintenance workflow: rollback can recover from a bad change, while soft deletion is less abrupt than destroying a value. It does not, however, replace backups of the encryption key.

This is an open-source MVP whose first-run experience is designed around a single developer, while multi-user organizations, roles, and grants extend it to team use. Deployment is self-hosted rather than a managed subscription: Docker Compose starts PostgreSQL, Redis, the backend, and frontend, and local Kubernetes manifests are supplied for a kind cluster.

Key features

The secrets run command fetches an environment's secrets and passes them to a child process and its descendants without creating a .env file. Documented workflows cover Node.js, Python, npm, and Next.js. For CI or deployment, SECRETS_API_URL, SECRETS_TOKEN, and ENVIRONMENT_ID provide the connection settings. This keeps values out of working directories, though every pipeline still has to configure the CLI and credentials; Node 20 or later is required for the CLI setup.

Access may be granted to users and service accounts at project or environment scope, and revealing a value requires an explicit grant. The backend uses AES-256-GCM envelope encryption with a random data key for each secret, and plaintext values are not stored in the database. Audit events include reveals, with a safeguard that values are not returned when the required audit write fails. These controls make it more appropriate for teams than a shared environment file, provided permissions are designed deliberately.

A user-generated master encryption key must exist before startup. Losing it makes stored secrets unrecoverable. The maker also reports that a real master key appeared in repository history before 2026-07-26; any key obtained from the repository before that date must never be used, and affected encrypted secrets should be treated as disclosed and recovered according to the maker's guidance.

Pricing

The only published plan is Open-source self-hosted at free. It is an MVP focused on a single developer and requires Docker Compose, with Node 20 or later for the CLI. There is no free trial because the product is already free, and no hosted plan or paid tier is offered. That makes it a strong fit for readers who can supply infrastructure and accept maintenance; teams wanting vendor-operated hosting or a commercial support contract should look elsewhere.

Platforms

The service supports API, Linux, macOS, self-hosted, web, and Windows deployments. CLI instructions cover Windows PowerShell and Command Prompt as well as macOS and Linux. Kubernetes support is provided through local kind-cluster manifests, while the documented primary setup uses Docker Compose.

Who it's for

Choose Secrets Manager if you want MIT-licensed source, control of where secrets run, scoped grants for people and service accounts, audit events, and CI/CD injection without writing environment files. It suits a technically capable solo developer first, then a small team willing to operate PostgreSQL, Redis, application services, and key recovery procedures.

It is a poor fit if you need a hosted service, a polished enterprise procurement path, or a recovery model that tolerates losing the master key. The historical key exposure also raises the bar for assessing existing encrypted data before migration.

Pros and cons

Pros

• Free and open source: the MIT-licensed package has no subscription charge or trial deadline.
• Useful secret lifecycle: import, versioning, rollback, and soft deletion support routine changes.
• Safer process injection: the CLI supplies descendants without creating a .env file.
• Granular accountability: project or environment grants, explicit reveal permission, AES-256-GCM encryption, and reveal audit events reinforce control.

Cons

• Operational burden: users must run the Docker-based stack and manage its dependencies.
• Irrecoverable key loss: losing the user-generated master key permanently blocks access to stored secrets.
• Serious key-history warning: the maker says a real key was exposed before 2026-07-26, requiring recovery action for affected data.
• MVP positioning: the initial experience centers on one developer rather than a broad hosted-service feature set.

Alternatives

For a hosted-friendly free tier with up to two members, three projects, unlimited secrets, and CLI/API access, consider Envshed. Keyway is the alternative when freemium plans include unlimited environments and collaborators, with Pro at €9 a month. For an open-source Kubernetes management platform rather than a focused secret vault, choose Kubermatic Kubernetes Platform. Phase offers a free tier capped at five users or service accounts, three apps, and three environments. secr provides a free plan with three projects, 100 secrets, and seven-day audit retention. SikkerKey suits machine-oriented deployments with 10 machines and one month of audit retention on its developer plan. Choose dotenvx for an open-source CLI and SDK approach to encrypted secrets. Infisical is another freemium option, with five identities, unlimited projects, and more than 100 integrations on its free plan.

Verdict

Secrets Manager is a credible choice for a developer or small technical team that wants a no-cost, self-hosted secret store with versioning, scoped access, audit protections, and process-level injection. Choose it for deployment control and source availability; look elsewhere if you prefer managed hosting or cannot maintain and safeguard a master key, especially after the reported repository exposure.