Are you SOC 2 certified?

Not yet. SecretStash is not currently SOC 2 certified. We use industry-standard encryption (AES-256-GCM, zero-knowledge architecture) and are evaluating formal compliance certifications as the team grows. If SOC 2 is a hard requirement for your organization, contact us at support@secretstash.cloud before signing up.

What features are still coming soon?

Enterprise SSO (via WorkOS) isn't available on any plan yet. We label it "Coming Soon" directly on the pricing table so you know exactly what you're getting.

.env files are free — why should I pay for this?

You're right that .env files themselves are free. What you're paying for is not sharing them in Slack, email, or Notion, not committing them to Git, and not manually re-sending them every time someone joins the team. If your current process works and nothing has leaked yet, SecretStash may not be worth it — but most teams get burned eventually.

What happens to my secrets if SecretStash shuts down?

Your secrets are never locked in. Anyone with CLI access can pull the current values for any environment into a local .env file at any time. That's the same command your team already uses day-to-day, not a special export feature you'd need to discover during a shutdown. If we ever discontinued the service, we'd give advance notice so every team could pull a final copy first.

Do you ever store my secrets unencrypted?

No. Secrets are encrypted client-side with AES-256-GCM before they're sent to our servers, and the encryption keys never leave your machine. We store ciphertext only — SecretStash's own infrastructure cannot read your raw secret values.

CLI-first•Zero-knowledge encryption•Built for developers

SecretStash: secrets management for dev teams

Stop sharing .env files in Slack, email, or Notion. SecretStash helps developers securely manage and share environment variables across teams, apps, and environments—without exposing secrets or slowing down your workflow.

Secrets are encrypted client-side before they ever leave your machine—SecretStash never sees your raw values.

Start Free View Docs

14-day free trial · No credit card required

99.9%

Uptime

256-bit

Encryption

Terminal

# pull the latest secrets for this environment
$ secretstash pull --env production
✔ Decrypting 12 variables locally…
✔ Wrote .env (12 variables)

# add a teammate's local change back to the vault
$ secretstash push --env production
✔ Encrypting 12 variables locally…
✔ Synced to production

The Problem

Managing environment variables shouldn't be this painful

.env files shared in Slack, email, or Notion

Secrets accidentally committed to Git

Onboarding new developers takes too long

Configs drift between local, staging, and production

SecretStash fixes this with a secure, developer-first workflow.

How It Works

A better way to manage and share secrets

Step 1

Store secrets centrally

Organize variables by application and environment in a clean dashboard.

Step 2

Sync with your workflow

Use the CLI to pull, push, and sync .env files directly from your local environment.

Step 3

Keep everything secure

All values are encrypted client-side—SecretStash never sees your raw secrets.

Features

Built for real development workflows

Keep secrets unreadable, even to us

Your secrets are encrypted locally before they ever leave your machine—ensuring true end-to-end security.

Pull and push secrets from your terminal

Pull and push environment variables directly from your terminal or CI/CD pipelines.

Keep dev, staging, and prod cleanly separated

Separate configs for local, staging, and production with isolated encryption keys.

When a new dev joins, pull all env vars in one command

Share secrets securely across your team without exposing sensitive values.

Import your .env files in minutes, not hours

Quickly onboard projects by importing existing .env files.

Sync staging and prod without copy-paste errors

Keep variables consistent across environments and team members automatically.

Use Cases

Designed for developers and teams like yours

For small dev teams

Stop passing secrets manually and onboard new developers instantly.

For Laravel / Node apps

Seamlessly integrate with your existing workflow using first-party CLI tools.

For CI/CD pipelines

Securely manage environment variables without exposing them in your pipeline configs.

For agencies/startups

Manage multiple apps and environments without losing control of credentials.

Why SecretStash

Why developers choose SecretStash

No browser extensions required

CLI-native (not UI-first tooling)

Zero-knowledge architecture (you own your secrets)

Simple setup (no heavy DevOps overhead)

256-bit

AES Encryption

Zero

Knowledge Architecture

CLI

First Workflow

Simple

No DevOps Overhead

Quick Start

Get started in under 2 minutes

Create your account

Install the CLI

Pull your secrets

You're up and running—no complex setup required. Read the getting started guide →

Stop risking your secrets

Start managing your environment variables the right way.

Start Free View Documentation

FAQ

Common questions before you sign up

Pricing

Simple, transparent pricing

One flat price per tier—not a per-API-call bill that grows with usage. Start free, upgrade when you need more.

$10/month flat for up to 20 users vs $420/month on Doppler for the same headcount—no per-seat math.

Billing term

Save 17% with annual billing

Personal

Perfect for solo developers

Free

Get Started

Up to 40 credentials

3 users

1 project

CLI & dashboard access

Email support

Team

For small teams

$100/year

Up to 20 users

Start Free Trial

Unlimited credentials

Up to 20 users

Unlimited projects

CLI & dashboard access

Priority support

Activity logs

Organization

For growing organizations

$400/year

Unlimited users

Start Free Trial

Unlimited credentials

Unlimited users

Unlimited projects

Priority support

Activity logs

Roles and permissions

Enterprise

For large teams with custom needs

Contact Sales

All Organization tier features

Unlimited users

Enterprise SSO (via WorkOS) Coming Soon

Additional integrations (e.g. AWS) Coming Soon

All plans include a 14-day free trial. No credit card required.

StripeApple PayGoogle Pay

Payments are processed securely by Stripe Checkout, which supports Apple Pay and Google Pay where enabled.

Feature	Personal	Team	Organization	Enterprise
Price	Free	$10/mo	$40/mo	Contact sales
Credentials	Up to 40	Unlimited	Unlimited	Unlimited
Users	3	Up to 20	Unlimited	Unlimited
Projects	1	Unlimited	Unlimited	Unlimited
CLI & dashboard access	✓	✓	✓	✓
Priority support	—	✓	✓	✓
Activity logs	—	✓	✓	✓
Roles and permissions	—	—	✓	✓
Enterprise SSO (via WorkOS)	—	—	—	Coming soon

Comparing SecretStash to Doppler, dotenv-vault, or HashiCorp Vault? See our head-to-head comparisons.

Works with Laravel, Node.js, and any modern development workflow.