Launched January 6, 2026
dotsecrets
Simple and easy secrets in git, perfect for small teams.
FreeOpen SourceCLICI271 impressions#1339 of its week
* A small, readable, self-contained file for managing and storing secrets.
* Easy to use in both development and CI environments.
* Less than 50 lines of code, and only two dependencies - bash and openssl.
* Supports encryption of env vars and config files.
dotsecrets is a tiny Bash tool for encrypting and storing secrets in a single file within a Git repo.
- for
- Small teams needing simple secret management in code repositories.
- pricing
- open source
- license
- MIT
works withBashOpenSSLGitHub ActionsCI environments
Key features
6 features of dotsecrets
- Single-file secret store — Keeps all encrypted secrets in one readable, self-contained file.
- Minimal dependencies — Runs with only Bash and OpenSSL, no extra runtime.
- Env var encryption — Encrypts individual environment variable values via a simple command.
- File encryption — Encrypts whole configuration files and stores them in the same file.
- CI/CD friendly — Decrypts secrets in CI jobs by exporting the output of the script.
- GitHub Actions support — Uses a SECRET_KEY secret to decrypt values during workflow runs.
Use cases
- Encrypt and store API keys in a repo for a small web service
- Decrypt secrets in a CI pipeline before running tests
- Version-control configuration files with encrypted values
- Rotate a secret by removing the old line and adding a new encrypted entry
dotsecrets vs alternatives
 dotsecrets |  Doppler | |
|---|---|---|
| Best for | Lightweight git-based secret storage | Hosted secrets management for larger teams |
| Pricing | Open source | Subscription |
| DevHunt upvotes | 0 | 0 |
| Launched | Jan 2026 | — |
- dotsecrets vs Doppler: Doppler provides a hosted secrets platform with UI and team management, while dotsecrets is a local Bash script.
dotsecrets FAQ
How do I install dotsecrets?+
Download the script with curl and add the .secrets file to your repository.
What environment variable is required?+
Set SECRET_KEY to the shared encryption key before using the tool.
How do I encrypt an environment variable?+
Run `bash .secrets VAR_NAME "VALUE" >> .secrets` to add the encrypted entry.
How can I decrypt secrets in a job?+
Execute `export `bash .secrets`` to load decrypted values into the environment.
Can I remove or update a secret?+
Edit the .secrets file to delete the line or replace it with a new encrypted value.
Summarized by DevHunt from github.com · Oct 5, 2026. Details may change; check the official site.
.png?width=64){kind=icon}
