Xecret: Stop shipping secrets in .env files

.env files on disk
0
Forever plan
Free
Per member / month, billed yearly
$5
Self-hosted
Unlimited

Overview

What is Xecret?

Xecret is an open-source secret manager for developers and teams, made by Playxoft. It stores environment variables once, encrypted per environment. One command injects them into your app, so no .env file sits on disk. The server is AGPL-3.0, the CLI is MIT, and self-hosting is free.

  • One command, xecret run, injects secrets without a .env file on disk.
  • Each environment has its own key, and every read is audited.
  • Server AGPL-3.0, CLI MIT, self-hosting free with nothing held back.

The problem it solves

Teams pass .env files around in chat, and every copy goes untracked. Nobody can say who has one, whether it is current or what leaked.

Why Xecret

What makes Xecret different?

  1. Stored once, encrypted per environment

    Each environment gets its own data key, wrapped under an organization key and a root key. Staging ciphertext cannot be read with production's key.

  2. One command replaces the file

    xecret run fetches the environment and injects it into your process. Your code still reads process.env or os.Getenv.

  3. An honest trust model

    Xecret uses server-side envelope encryption, so the service can technically decrypt your secrets. If you need zero-knowledge, the docs tell you to choose another tool.

Features

What can Xecret do?

  • A Key Per Environment

    Development, staging and production each hold their own encryption key — a leak in one never reaches the others.

  • One Command, Any Stack

    `xecret run` injects secrets into Next.js, Node, Vite, Go, Docker and CI with zero code changes.

  • Append-Only Audit Log

    An immutable record of who read which secret and when — ready for a security review.

  • Instant Revocation

    Member and role-based access control where removing someone takes effect immediately, not at the next deploy.

  • Works Offline

    An encrypted local cache keeps your dev loop and your builds alive through network outages.

  • Self-Host It Free

    The AGPL-3.0 server runs on Cloudflare Workers with PostgreSQL (Neon recommended), with no feature held back.

Screens

Xecret in action

Real screens from xecret.playxoft.com. Pick a screen, or select it to see it full size.

How it works

How does Xecret work?

  1. 1

    Create a project

    Sign up with Google or email. Each project starts with development, staging and production, each with its own key.

  2. 2

    Import your .env

    Drag the file into the dashboard. It is parsed in your browser, with a dry-run preview before anything is sent.

  3. 3

    Install the CLI and sign in

    Run brew install playxoft/tap/xecret or npm install -g @playxoft/xecret. Then run xecret login and xecret init.

  4. 4

    Run your app

    Prefix your usual command: xecret run -- npm run dev. Delete the .env file and commit .xecret.yaml, which holds no secrets.

Who it's for

Who is Xecret for?

Built for

  • Solo developers

    Stop syncing .env.example and pasting secrets between machines.

  • Small teams

    Onboard with xecret login and xecret run instead of sending a file.

  • CI/CD pipelines

    Service tokens scoped to one environment, read-only by default, free on every plan.

  • Teams guarding production

    On the Team plan, developers get no production access until someone grants it.

  • 01

    Onboarding and offboarding

    A new developer runs xecret login and gets only what their role allows. Removing a member stops every device they own at once.

  • 02

    CI/CD pipelines

    Store a service token pinned to one environment as XECRET_TOKEN in your CI. Then wrap the build step in xecret run.

  • 03

    Docker images

    Copy the static binary from ghcr.io/playxoft/xecret and inject secrets at runtime. They never land in an image layer.

Pricing

How much does Xecret cost?

Prices as published on xecret.playxoft.com, checked November 3, 2026.

  • Free

    $0forever

    For one developer who has had enough of moving .env files around.

    • 1 organization, 5 projects
    • 3 environments per project
    • 3 members
    • 10 service tokens for CI
    • 7 days of audit history

  • Pro

    $5per member / month, billed yearly

    For a small team that has outgrown the free limits. $8 month to month.

    • 25 projects across 3 organizations
    • 10 environments per project
    • Unlimited members
    • 50 service tokens for CI
    • 30 days of audit history

  • Team

    $12per member / month, billed yearly

    For a team with somebody who must not see production. $19 month to month, from 3 members.

    • Everything in Pro
    • Roles and per-environment access
    • 100 projects, 5,000 secrets per environment
    • 250 service tokens for CI
    • 180 days of audit history

  • Enterprise

    Custominvoiced, with an SLA

    For organizations that need residency, their own root key and a contract. From 10 members.

    • Everything in Team
    • No ceiling on projects, environments, secrets or tokens
    • Custom audit retention
    • A commercial, non-AGPL self-hosting license
    • A contractual SLA and a named contact

  • Self-hosted

    Freealways

    For anyone who would rather hold their own root key and run their own server.

    • The whole server, under AGPL-3.0
    • No feature held back, no license key
    • Unlimited organizations, projects, members and environments
    • Audit history for as long as your database keeps it

Good to know

What to decide before you start

  • It is pre-alpha

    The encryption, audit log, CLI and self-hosting work, but there is no SLA yet. Paid features are on for everyone and no card is collected.

  • Server-side encryption, not zero-knowledge

    The hosted service can technically decrypt your secrets. If your policy forbids that, self-host or pick a zero-knowledge tool.

  • Self-hosting has real dependencies

    You need paid Cloudflare Workers, PostgreSQL, Secrets Store and a WorkOS account. Lose the root key and every secret is gone for good.

Under the hood

Designed, built and run by Playxoft

The same team builds web apps for clients. Need something like Xecret? We can scope it with you.

Book a call Web app development
Category
DevTools / Secret Management
Interface
CLI + Web dashboard
Compute
Cloudflare Workers
Database
Neon / Postgres
Encryption
AES-256-GCM envelope, key per environment
Status
Pre-alpha
License
AGPL-3.0 server, MIT CLI

Xecret FAQ

Straight answers, checked against the live product on November 3, 2026.

Xecret is an open-source secret manager from Playxoft. It stores environment variables once, encrypted per environment, and injects them into your app with xecret run.

Yes, the free tier is free forever for 1 organization, 5 projects and 3 members. Pro is $5 and Team is $12 per member per month, billed yearly. Self-hosting is free, and no card is collected during pre-alpha.

Yes. The server is AGPL-3.0 and the CLI is MIT. The MIT license lets the CLI ship inside your Docker images and CI pipelines without license friction.

Follow the self-hosting guide to deploy the server on Cloudflare Workers with PostgreSQL, Secrets Store and a WorkOS account. Generate the root key first with npm run keygen. Then point the CLI at your server with xecret login --api-url.

A .env file is a copy that nobody tracks. Xecret stores each value once, injects it when your process starts and logs every read. Your code still reads process.env, with no SDK to add.

Sign up, import your .env in the dashboard and install the CLI on macOS, Linux, Windows or Docker. Run xecret login, xecret init, then xecret run -- npm run dev.

Technically, yes. It uses server-side AES-256-GCM envelope encryption and audits every decryption. The root key lives outside the database, so a database breach alone yields only ciphertext.

Not yet: Xecret is pre-alpha and its API can still change. Use it for a side project or a new service, and do not store credentials you cannot afford to rotate.

Still have questions? Talk to our team

More from Playxoft

Other web apps we build

All products

Need A Custom Solution?

Tailored To Your Exact Needs

Get in touch