PX Secrets
PX Secrets is a free, open-source secrets manager that keeps an encrypted vault on the user’s machine.
What PX Secrets is
PX Secrets is a free, open-source secrets manager that keeps an encrypted vault on the user’s machine. It encrypts the vault with SOPS and AGE; the project says the private AGE key is read directly by SOPS and never handled by PX Secrets. A dark web interface provides search and service grouping, with an optional native desktop window. The CLI lists services and retrieves named secrets for scripts. A local API supports runtime access for scripts and AI agents, and the application can run headlessly as a background service. Documentation covers Docker deployment, CI/CD pipelines, and Kubernetes integration. The project states that it makes no network calls and collects no telemetry, analytics, usage tracking, or crash reports. Clipboard copies clear after 30 seconds, while decrypted data stays in memory and temporary plaintext files are deleted after encryption. It supports self-hosting on Linux and macOS; Windows may work but is untested. The local API is unauthenticated by default, and losing the AGE private key prevents recovery.
Good
- Encrypted local vault using SOPS and AGE
- CLI and local API access
- No network calls or telemetry
- Clipboard secrets clear after 30 seconds
- CI/CD and Kubernetes integration documented
Watch out
- Local API is unauthenticated by default
- Lost AGE private key makes vault unrecoverable
- Windows support is untested
- Requires Python 3.9+, SOPS, and AGE
Who it suits
It suits developers, AI builders, homelabbers, and sysadmins needing a local vault and script-accessible secrets. Users must manage self-hosting and protect the AGE private key.
Verdict
PX Secrets combines an encrypted local vault with web, CLI, API, and headless use. It offers privacy-focused operation but requires careful API protection and key management.
Plans and prices
From PX Secrets's own pricing page, checked 9 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| PX Secrets | Free | Free and open-source · local secrets vault · AGPL-3.0 |
The facts
Each one read from PX Secrets's own pages, with the date it was checked.
What it does
- API security limit
- The local API is unauthenticated by default; the README warns against exposing port 9999 outside the local host or a trusted private network without authentication.checked 9 Oct 2026
- CLI
- The CLI can list services and retrieve secrets by name for scripts.checked 9 Oct 2026
- Clipboard
- Copied secrets are automatically cleared from the clipboard after 30 seconds.checked 9 Oct 2026
- Encryption
- It encrypts the vault on disk with SOPS and AGE, and the repository says the private AGE key is read directly by SOPS and never touched by PX Secrets.checked 9 Oct 2026
- Integrations
- The README documents SOPS and AGE dependencies, Docker deployment, and runtime use by scripts, AI agents, and CI/CD pipelines.checked 9 Oct 2026
- Intended users
- The README describes it as suited to developers, AI builders, homelabbers, and sysadmins.checked 9 Oct 2026
- Interface
- It provides a dark web UI with search and service grouping, plus an optional native desktop window using pywebview.checked 9 Oct 2026
- Key recovery limit
- The README states that losing the AGE private key means the encrypted vault cannot be recovered and that there is no reset or backdoor.checked 9 Oct 2026
- License and support
- PX Secrets is licensed under AGPL-3.0, with bug reports handled through GitHub Issues and questions and ideas through GitHub Discussions.checked 9 Oct 2026
- Local API
- A local API lets scripts and AI agents retrieve secrets at runtime, and the app can run headlessly as a background service.checked 9 Oct 2026
- Optional authentication
- Setting PX_SECRETS_AUTH_TOKEN requires a bearer token for API requests, and read-only mode can disable mutating endpoints.checked 9 Oct 2026
- Privacy
- The project states it makes no network calls and collects no telemetry, analytics, usage tracking, or crash reports.checked 9 Oct 2026
- Purpose
- PX Secrets is a free, open-source secrets manager that stores an encrypted vault on the user's machine.checked 9 Oct 2026
- Temporary data
- The README says decrypted data is held in memory and temporary plaintext files are deleted after encryption.checked 9 Oct 2026
Where it runs
- Requirements and platforms
- The stated requirements are Python 3.9+, SOPS, and AGE; macOS and Linux are listed as supported, while Windows may work but is untested.checked 9 Oct 2026
Alternatives to PX Secrets
- 1

Envshed
Free planWebAPILinuxmacOS7.6From $5 a month - 2

Keyway
Free planWebAPILinuxmacOS7.1From €9 a month - 3
Infisical
Free planWebAPILinuxSelf-hosted7.0From $2 a month - 4

Oracle Cloud Infrastructure Secret Management
Free planWebAPI7.0Free plan - 5

secr
Free planWebAPIExtensionLinux7.0From $6 a month - 6

SikkerKey
Free planWebAPILinuxmacOS7.0From $29 a month
