Doppler charges $12 per user per month to store key-value pairs, so a five-person team pays about $2,160 over three years, forever, in Doppler's cloud. Secretbox does projects, environments, envelope-encrypted secrets, versioning with rollback, env diffs, scoped API tokens and a zero-dependency CLI on your own box. $39, once.
If you've searched for a Doppler Team alternative, Secretbox is the pay-once option worth putting at the top of the list: Secretbox is $39, one time, and covers the same core job Doppler Team charges $12/user/mo for.
What makes Secretbox the pick for 2026
- Envelope encryption at rest — Every value gets its own random AES-256-GCM data key, wrapped by a master key that lives only in your .env and never in the database.
- Projects and environments — Organize projects into dev, staging, prod and custom environments, with secret versioning and one-click rollback.
- Audit-logged reveals — Every reveal, pull, edit and rollback is recorded with who, what and when.
- Environment diff — See which keys are missing or different between dev and prod without exposing the values.
- Scoped API tokens — Per-project, read-only or read-write tokens, shown once and stored as SHA-256 hashes.
Secretbox vs Doppler Team, at a glance
| Secretbox | Doppler Team | |
|---|---|---|
| Price | $39 once | $12/user/mo |
| 5-person team, 3 years | $39 | ~$2,160 |
| Encrypted at rest | Yes, envelope AES-256-GCM | Yes |
| Your secrets on your server | Yes | No |
| Versioning + rollback | Yes | Yes |
| Env diff | Yes | Yes |
| CLI pull / run injection | Yes | Yes |
| Audit log | Yes | Higher tiers only |
Under four months of Doppler for a five-person team already costs more than Secretbox, which then never charges per seat again.
Common questions
Is it really free on GitHub?
Yes. Secretbox is MIT-licensed at github.com/bensblueprints/env-secrets-manager-mvp and always will be. The $39 buys the packaged 1-click installer and setup; building from source is free.
Where do my secrets live?
In a SQLite database on your own server, envelope-encrypted per value. Nothing goes to us or any third-party cloud.
Is this zero-knowledge like Vaultly?
No, and honestly so: this is server-side encryption, because a secrets manager that feeds CI must hold the key to hand plaintext to your deploys. If you need client-side zero-knowledge crypto, that is our Vaultly product. Protect the box and protect the .env.
The bottom line
Secretbox won't out-feature Doppler Team on every axis — no subscription tool with a bigger team and a bigger roadmap loses on everything. But for the core job, $39 once against $12/user/mo forever is a trade most people should at least look at. Secretbox is part of OneTimeSuite, a catalog of pay-once apps that replace subscription SaaS.
Try Secretbox — $39, once
Projects, environments and versioned secrets with a CLI that pipes straight into your .env.