E2E encrypted
secrets for
developers.
The secret vault your team and AI agents actually use. Argon2id + AES-256-GCM encryption. X25519 key exchange for sharing. One command to sync, run, or deploy.
Your secrets sync with your code. New teammate? mp pull — done in seconds.
One file connects your repo to its secrets
mp init creates a .meowpass.yaml file in your project root. Commit it to git. It contains no secrets — just a pointer to your vault.
- Safe to commit — no secrets, no keys
- CLI auto-detects vault per repo
- Teammates clone →
mp pull→ done - Supports multiple environments
Three steps to synced secrets
Set up once. Every teammate pulls automatically.
Import your .env
mp initScans .env files, encrypts each as a separate environment, writes .meowpass.yaml (safe to commit).
Share with team
git push.meowpass.yaml is committed to git. It contains only the vault ID — no secrets. Teammates see it on clone.
Pull on any machine
mp pullEvery developer runs mp pull. Right secrets, right environment. No Slack DMs, no copy-paste.
How MeowPass compares
Honest comparison. Pick what fits your workflow.
| MeowPass | dotenvx | AWS Secrets Manager | |
|---|---|---|---|
| Setup time | 2 min (install + init) | 1 min (encrypt) | 30+ min (IAM + SDK) |
| Architecture | Encrypted vault + API | Encrypted .env files in git | Cloud KMS service |
| Encryption | AES-256-GCM + Argon2id | ECIES + secp256k1 + AES-256 | AWS KMS (AES-256) |
| Zero-knowledge | Yes — server never sees plaintext | No — Ops stores your private keys | No — AWS holds keys |
| Team sharing | X25519 key exchange per member | Share raw DOTENV_PRIVATE_KEY | IAM policies |
| Secret versioning | Per-secret history + rollback | Git history (encrypted diffs) | Per-secret versions |
| Key rotation | One command, re-encrypts all | Per-file keypair rotation | Automatic rotation |
| AI integration | 14-tool MCP + redacted mode | Basic MCP (blog post) | None |
| Runtime injection | mp run (in-memory) | dotenvx run (in-memory) | SDK required in code |
| Drift detection | mp diff + git hooks | git diff on encrypted files | None |
| Offline support | Encrypted local cache | Fully offline (file-based) | Requires network |
| Web dashboard | app.meowpass.dev (read-only) | None (file-based) | AWS Console |
| CI/CD | GitHub Action + export-key | Commit .env + CI secret | AWS SDK in pipeline |
| Node.js SDK | @meowlabs/meowpass (E2E) | @dotenvx/dotenvx (drop-in) | aws-sdk |
| Secret TTL | Auto-expire (--ttl 24h) | None | None |
| Audit trail | Built-in per action | Git log only (free tier) | CloudTrail |
| Open source | Fully open source | Core open, Ops closed | Closed source |
| Account required | Yes (free) | No (free tier) | Yes (AWS account) |
| Pricing | Free (3 vaults) / $3/mo Pro | Free + $2.99-90/mo | $0.40/secret/mo |
TL;DR: Use dotenvx if you want zero-config local encryption with no account. Use MeowPass if you need zero-knowledge team sharing, per-secret versioning, AI agent integration, or audit trails.
Use MeowPass when:
- You have 2+ developers sharing secrets
- Your .env files drift between machines
- New devs ask "where's the .env?" on day one
- You sync secrets via Slack, Notion, or 1Password
- You have staging and production environments
- You use Claude Code or Cursor with secrets
dotenvx is enough when:
- You work solo on one project
- You only need one environment
- You want encrypted .env in git with zero account
- You don't need team sharing or versioning
Both tools are good. MeowPass adds team sync, multi-env, versioning, and AI integration on top.
One vault for your entire workflow
CLI, web dashboard, Chrome extension, AI agents, CI/CD — all E2E encrypted, all synced.
Secret Vault
Store API keys, tokens, certificates, and connection strings. Organized by project, environment, and team.
.env Sync
Pull secrets directly into your .env files. One command syncs staging, production, or any custom environment.
Team Sharing
Share vaults with your team. Role-based access, audit logs, and automatic key rotation for enterprise security.
Your engineering team's secrets, actually secure
Every secret is encrypted before it leaves your device. Zero-knowledge architecture means even we can't read your API keys. Built for teams that ship fast without compromising security.
- AES-256-GCM + Argon2id encryption (same as 1Password)
- X25519 key exchange for team vault sharing
- Full audit log of every secret access and mutation
- One-command key rotation (mp rotate)
- Secret TTL with auto-expiry for temporary credentials
Everything you need to ship securely
CLI, SDK, MCP, GitHub Action — secrets managed everywhere you code.
One-Command Setup
mp init imports all .env files, creates a vault, and writes .meowpass.yaml. Each file gets its own environment tag.
Team Sync
Commit .meowpass.yaml. Teammates clone → mp pull → right secrets in seconds. No Slack DMs.
Multi-Environment
.env, .env.local, .env.production — each pushed as a separate env. mp pull --env local writes .env.local.
Drift Detection
mp diff shows what's out of sync. Per environment. Use --exit-on-drift in CI to block deploys.
In-Memory Injection
mp run injects secrets into your process without writing .env to disk. Zero artifacts.
Version History
Every secret change is versioned. mp history shows the timeline. mp rollback restores any version.
AI-Native
14-tool MCP server. Your AI agent deploys with production secrets — without ever seeing the values.
Audit Trail
Every action is logged — who accessed what, when, from where. IP, user agent, timestamps. SOC 2 ready.
This is your codebase.
We both know it.
You have 47 API keys scattered across Slack DMs, sticky notes, and .env files you're terrified to touch. Your last "rotation" was copying a key from a coworker who left 6 months ago.
MeowPass replaces the chaos with a single encrypted vault. Every secret, every project, every teammate — one source of truth.
Fix this in 2 minutesWe literally cannot read your secrets
MeowPass is zero-knowledge by design. Your master password derives the encryption key on your device. We never receive it. Even if our database leaked, attackers get meaningless ciphertext.
Zero-Knowledge
Your master password is hashed with Argon2id (same as 1Password). The derived key never leaves your machine. We store only encrypted blobs.
Fully Open Source
Every encryption operation is auditable. CLI, API, SDK, MCP server — all open source. No black boxes. No trust-me-bro.
View sourceNo Vendor Lock-in
mp pull writes a standard .env file. Leave anytime with one command. Your secrets, your format, no proprietary encoding.
Simple, developer-friendly pricing
Start free. Scale when you're ready. No surprises.
Developer
Get started with no credit card required.
- 3 vaults
- 50 secrets
- CLI access
- Web app + Chrome extension
- MCP server access
- .env sync
- Community support
Pro
Less than a coffee. Unlimited everything.
- Unlimited vaults
- Unlimited secrets
- .env sync
- MCP server access
- API keys
- Priority support
Team
Shared vaults, audit logs, role-based access.
- Everything in Pro
- Shared team vaults
- Role-based access
- Audit logs
- SSO / SAML
- Secret rotation
- Admin console
Up and running in 2 minutes
Four commands. That's it.
Your secrets deserve
real encryption.
Zero-knowledge vault. X25519 team sharing. AI-native MCP server. One CLI for your entire team. Install in 60 seconds.