Doppler charges $12 per user per month to store key-value pairs, so a five-person team pays about $2,160 over three years, forever, in Doppler's cloud. Secretbox does projects, environments, envelope-encrypted secrets, versioning with rollback, env diffs, scoped API tokens and a zero-dependency CLI on your own box. $39, once.
This is the full pricing breakdown: what Doppler Team actually costs over one, two and three years, what Secretbox gives you for $39 paid once, and the honest cases where the subscription is still the right call.
What Doppler Team actually costs you
Doppler Team prices per user — $12/user/mo — so the subscription grows with every user you add. The comparison below uses the catalog's annual figure of $144; the per-user table underneath shows how the bill scales either way.
| Secretbox | Doppler Team | |
|---|---|---|
| Sticker price | $39 once | $12/user/mo |
| Cost after 1 year | $39 | $144 |
| Cost after 2 years | $39 | $288 |
| Cost after 3 years | $39 | $432 |
Doppler Team bills per user, so the total scales with headcount:
| Doppler Team users | Per year | Over 3 years |
|---|---|---|
| 1 user | $144 | $432 |
| 5 users | $720 | $2,160 |
| 10 users | $1,440 | $4,320 |
Three years in, the gap is $393 — and every year after that adds another $144 to the subscription side of the ledger.
Secretbox vs Doppler Team, feature by feature
Price is only half the story — here's how the two line up on the things that decide day-to-day use:
| Secretbox | Doppler Team | |
|---|---|---|
| Price | $39 once | $12/user/mo |
| 5-person team, 3 years | $39 | ~$2,160 |
| Encrypted at rest | Yes, envelope AES-256-GCM | Yes |
| Your secrets on your server | Yes | No |
| Versioning + rollback | Yes | Yes |
| Env diff | Yes | Yes |
| CLI pull / run injection | Yes | Yes |
| Audit log | Yes | Higher tiers only |
What you get for $39, once
Projects, environments and versioned secrets with a CLI that pipes straight into your .env. The highlights:
- 🔐 Envelope encryption at rest — Every value gets its own random AES-256-GCM data key, wrapped by a master key that lives only in your .env and never in the database.
- 🗂️ Projects and environments — Organize projects into dev, staging, prod and custom environments, with secret versioning and one-click rollback.
- 👀 Audit-logged reveals — Every reveal, pull, edit and rollback is recorded with who, what and when.
- 🔀 Environment diff — See which keys are missing or different between dev and prod without exposing the values.
Under four months of Doppler for a five-person team already costs more than Secretbox, which then never charges per seat again.
Switching is 3 steps
- Buy once on Whop. One payment of $39 gets you the packaged 1-click installer, or clone the MIT source at github.com/bensblueprints/env-secrets-manager-mvp and run it yourself for free.
- Deploy on your own server. docker compose up on a $5 VPS behind HTTPS, or run the Electron desktop build, then set ADMIN_PASSWORD and back up your MASTER_KEY.
- Wire up your CLI. Point the zero-dependency CLI at your host with a scoped token and run secretbox pull or secretbox run to feed secrets straight into your deploys.
When paying Doppler Team is still the right call
Being straight about it: the subscription earns its keep in three situations. If your team is large enough that Doppler Team's collaboration features, permissions and admin controls are genuinely load-bearing; if your workflow is built on its integrations and leaving means rebuilding that plumbing; or if you have enterprise requirements — SSO, audit logs, SLAs, a vendor to call — that a pay-once app doesn't come with. Everyone else is paying $12/user/mo for a job that runs fine on hardware they already own.
If that's you, Secretbox is $39, once. For the deeper dive, read the Secretbox vs Doppler Team head-to-head.
Frequently asked questions
Is it really free on GitHub?
Yes. Secretbox is MIT-licensed at github.com/bensblueprints/env-secrets-manager-mvp and always will be. The $39 buys the packaged 1-click installer and setup; building from source is free.
Where do my secrets live?
In a SQLite database on your own server, envelope-encrypted per value. Nothing goes to us or any third-party cloud.
Is this zero-knowledge like Vaultly?
No, and honestly so: this is server-side encryption, because a secrets manager that feeds CI must hold the key to hand plaintext to your deploys. If you need client-side zero-knowledge crypto, that is our Vaultly product. Protect the box and protect the .env.
Is this a subscription in disguise?
No. $39 once, no renewal, no per-seat billing, no license server. Just back up your MASTER_KEY, because without it your secrets are unrecoverable.
More on Doppler Team pricing
Secretbox — product page, demo & full feature list · All OneTimeSuite pricing breakdowns
Try Secretbox — $39, once
Projects, environments and versioned secrets with a CLI that pipes straight into your .env.