🗝️ Secretbox
Self-hosted team secrets and env-var manager, no per-seat Doppler bill.
Secretbox at a glance
| Price | $39, once — no renewal |
| Replaces | Doppler Team at $12/user/mo — roughly $144 a year, every year |
| Type | Self-hosted web app |
| Platforms | Your own server (VPS / Docker), any browser |
| Category | Developer Tools |
Secretbox features
🔐 Envelope encryption at rest
Every value gets its own random AES-256-GCM data key, wrapped by a master key that lives only in your .env and never in the database.
🗂️ Projects and environments
Organize projects into dev, staging, prod and custom environments, with secret versioning and one-click rollback.
👀 Audit-logged reveals
Every reveal, pull, edit and rollback is recorded with who, what and when.
🔀 Environment diff
See which keys are missing or different between dev and prod without exposing the values.
🎫 Scoped API tokens
Per-project, read-only or read-write tokens, shown once and stored as SHA-256 hashes.
⌨️ Zero-dependency CLI
secretbox pull writes an env file, secretbox run injects env and writes nothing to disk, and secretbox push adds a key.
🖥️ Desktop mode or VPS
Run it as an Electron app, or docker compose up on a $5 VPS.
$39 once — that's the whole pricing page
Doppler Team charges $12/user/mo — roughly $144 a year, every year. Secretbox is a single payment, and it keeps working whether or not we ever sell another copy.
Or get Secretbox inside the full suite — every app in the catalog, currently $97 for the bundle. See the bundle →
Secretbox guides & pages
Honest answers
Is it really free on GitHub?
Yes. Secretbox is MIT-licensed at github.com/bensblueprints/env-secrets-manager-mvp and always will be. The $39 buys the packaged 1-click installer and setup; building from source is free.
Where do my secrets live?
In a SQLite database on your own server, envelope-encrypted per value. Nothing goes to us or any third-party cloud.
Is this zero-knowledge like Vaultly?
No, and honestly so: this is server-side encryption, because a secrets manager that feeds CI must hold the key to hand plaintext to your deploys. If you need client-side zero-knowledge crypto, that is our Vaultly product. Protect the box and protect the .env.