MeowPass vs dotenvx: Which Secret Manager Should You Use in 2026?

If you manage secrets as a developer, you've probably heard of dotenvx — the encrypted .env tool from the creator of dotenv. With 5 million weekly npm downloads, it's the default choice for many teams.

MeowPass takes a different approach: a zero-knowledge vault with CLI-first workflow, team sharing via key exchange, and AI-native integration. Both tools encrypt your secrets. But they solve different problems.

Architecture: Files vs Vault

dotenvx encrypts your .env files in place and commits them to git. Your secrets travel with your code as encrypted blobs. Simple, familiar, no server needed.

MeowPass stores encrypted secrets in a remote vault (AWS Lambda + Neon Postgres). Your .env files are generated on demand with mp pull. The server never sees plaintext — encryption happens on your device.

Winner: dotenvx for solo projects (zero infrastructure). MeowPass for teams (centralized source of truth).

Encryption

dotenvx uses ECIES with secp256k1 (Bitcoin's curve) + AES-256. Each .env file has a keypair. The public key is in the file; the private key is in .env.keys (gitignored).

MeowPass uses Argon2id (password → master key) + AES-256-GCM (secrets) + X25519 (team sharing). Three layers: password derivation, vault key encryption, and secret encryption.

Winner: Both are strong. MeowPass has the edge for team scenarios (per-member key exchange vs sharing a raw private key).

Zero-Knowledge

dotenvx (free tier): Fully local — no server involved. Zero-knowledge by default because there's no server.

dotenvx (Ops tier): Your private keys are stored "armored off-device" on dotenvx servers. They can technically decrypt your secrets.

MeowPass: Zero-knowledge at every tier. The server stores only encrypted blobs. Your master password derives the key on your device. Even if the MeowPass database leaked, attackers get meaningless ciphertext.

Winner: MeowPass for paid tiers. Tie for free (both are local-only or zero-knowledge).

Team Sharing

This is where the products diverge most:

dotenvx: Share the DOTENV_PRIVATE_KEY with teammates via Slack, 1Password, or another side channel. Everyone uses the same key. Revoking access means regenerating the key and re-sharing with everyone who should still have it.

MeowPass: When you share a vault, the vault key is re-encrypted for each team member using X25519 key exchange. Each person has their own encrypted copy. Revoking access = removing their encrypted key. No raw key sharing ever.

Winner: MeowPass — proper cryptographic key exchange vs DM-ing a private key.

AI Integration

dotenvx: Has a blog post about MCP integration. Basic support.

MeowPass: Ships a 14-tool MCP server on npm (@meowlabs/meowpass-mcp). Tools include meowpass_diff (detect .env drift), meowpass_run_redacted (inject secrets without exposing values to the LLM), and meowpass_init (scan project for .env files). Works with Claude Code, Cursor, and Windsurf.

Winner: MeowPass — purpose-built AI integration with redacted mode for security.

Pricing

	dotenvx	MeowPass
Free	Local .env.keys, unlimited	All features (early access)
Solo/Pro	$2.99/mo (50 keys)	$3/mo (unlimited)
Team	$20/mo (3 members, 100 keys)	$6/user/mo (unlimited)
Enterprise	Custom	Coming soon

When to Use Each

Use dotenvx if: You're a solo developer, want zero infrastructure, and love the simplicity of encrypted .env files in git.

Use MeowPass if: You work with a team, need zero-knowledge encryption at every tier, want per-secret versioning with rollback, or use AI coding agents and need safe secret injection.

Both tools are good. MeowPass is fully open source — try it in 2 minutes: brew install meowrithm/tap/meowpass && mp init.