Doppler charges $12 per user per month to store key-value pairs, so a five-person team pays about $2,160 over three years, forever, in Doppler’s cloud. Secretbox does projects, environments, envelope-encrypted secrets, versioning with rollback, env diffs, scoped API tokens and a zero-dependency CLI on your own box. $39, once.

• Envelope encryption at rest — Every value gets its own random AES-256-GCM data key, wrapped by a master key that lives only in your .env and never in the database.
• Projects and environments — Organize projects into dev, staging, prod and custom environments, with secret versioning and one-click rollback.
• Audit-logged reveals — Every reveal, pull, edit and rollback is recorded with who, what and when.
• Environment diff — See which keys are missing or different between dev and prod without exposing the values.
• Scoped API tokens — Per-project, read-only or read-write tokens, shown once and stored as SHA-256 hashes.
• Zero-dependency CLI — secretbox pull writes an env file, secretbox run injects env and writes nothing to disk, and secretbox push adds a key.
• Desktop mode or VPS — Run it as an Electron app, or docker compose up on a $5 VPS.

Runs as a Windows desktop app or on any $5 VPS (Docker included).

What’s included:

• Full source code (MIT): https://github.com/bensblueprints/env-secrets-manager
• Lifetime v1 updates
• Setup guide (README quick start)