MeowPass vs dotenvx: Which Secret Manager Should You Use in 2026?
A comparison of MeowPass and dotenvx across architecture, team sharing, AI integration, encryption, and pricing. Here is when each one fits.
If you manage secrets as a developer, you've probably run into dotenvx, the encrypted .env tool from the creator of dotenv. With 5 million weekly npm downloads, it is a common default.
MeowPass takes a different approach: a server-side encrypted vault with a CLI-first workflow, SSO-based team sharing via access grants, and MCP integration for AI agents. Both tools encrypt your secrets. They are built around different constraints, so the right choice depends on how your team works. This is a rundown of the differences and when each one fits.
Architecture: Files vs Vault
dotenvx encrypts your .env files in place and commits them to git. Your secrets travel with your code as encrypted blobs. Simple, familiar, no server needed.
MeowPass stores encrypted secrets in a remote vault (AWS Lambda + Neon Postgres). Your .env files are generated on demand with mp pull. Secrets are encrypted at rest with AES-256-GCM envelope encryption and TLS 1.3 in transit. On an authorized, audited request, the server decrypts on your behalf.
The tradeoff is straightforward. dotenvx needs no infrastructure, which suits solo projects where the code and its encrypted secrets can live together in one repo. MeowPass keeps a single central copy that many machines and people pull from, which matters once more than one person needs the same secrets.
Encryption
dotenvx uses ECIES with secp256k1 (Bitcoin's curve) + AES-256. Each .env file has a keypair. The public key is in the file; the private key is in .env.keys (gitignored).
MeowPass uses AES-256-GCM envelope encryption: each secret has its own data key (DEK) wrapped by a server-managed key-encryption key (KEK). Encrypted at rest, TLS 1.3 in transit. Access is via SSO (WorkOS).
Both are sound cryptographically. The difference that shows up in practice is access control rather than the cipher: dotenvx hands out a private key, while MeowPass gates access behind SSO with server-enforced roles and an audit trail.
Trust Model
dotenvx (free tier): Fully local, no server involved. Zero-knowledge by default because there is no server that can read your secrets.
dotenvx (Ops tier): Your private keys are stored "armored off-device" on dotenvx servers. They can technically decrypt your secrets.
MeowPass: Not zero-knowledge. Secrets are encrypted at rest with AES-256-GCM envelope encryption (per-secret DEK wrapped by a server-managed KEK) and served over TLS 1.3. On an authenticated, scoped, audited request the server decrypts on your behalf. If the database leaked, stored data is ciphertext, but the server itself can decrypt for authorized access.
These are two different trust positions. dotenvx's free tier is the stricter one: nobody but a key holder can read anything, ever. MeowPass trades that for a managed key, and in exchange you get SSO-gated, role-enforced, audited access without anyone passing keys around by hand. Which one you want depends on whether you would rather trust a server or trust everyone who holds a copy of the key.
Team Sharing
Team sharing is the area where the two tools work most differently.
dotenvx: Share the DOTENV_PRIVATE_KEY with teammates via Slack, 1Password, or another side channel. Everyone uses the same key. Revoking access means regenerating the key and re-sharing with everyone who should still have it.
MeowPass: Share a vault by granting a teammate (or a whole team, or an individual by email) Read or Read & Write access. Roles are enforced server-side and the owner can revoke access at any time. No raw key sharing.
With dotenvx the unit of sharing is a key, so revocation means rotating and redistributing that key. With MeowPass the unit is a per-person grant, so revoking one person does not disturb anyone else. If your team changes often, that difference adds up.
AI Integration
dotenvx: Has a blog post about MCP integration. Basic support.
MeowPass: Ships a 14-tool MCP server on npm (@meowlabs/meowpass-mcp). Tools include meowpass_diff (detect .env drift), meowpass_run_redacted (inject secrets without exposing values to the LLM), and meowpass_init (scan project for .env files). Works with Claude Code, Cursor, and Windsurf.
If you route secrets through AI coding agents, the redacted-mode tool is the reason to look at MeowPass here: it lets an agent run a command with real secrets injected while keeping the values out of the model's context.
Pricing
| dotenvx | MeowPass | |
|---|---|---|
| Free | Local .env.keys, unlimited | 3 vaults, 50 secrets |
| Solo/Pro | $2.99/mo (50 keys) | $5/mo (unlimited) |
| Team | $20/mo (3 members, 100 keys) | $8/user/mo (unlimited) |
| Enterprise | Custom | Coming soon |
When to Use Each
Use dotenvx if: You're a solo developer, want zero infrastructure, and love the simplicity of encrypted .env files in git.
Use MeowPass if: You work with a team, want a centralized vault with server-side envelope encryption, SSO, and enforced/audited access, need per-secret versioning with rollback, or use AI coding agents and need safe secret injection.
Both tools do the job they were built for. MeowPass is fully open source. To try it: brew install meowrithm/tap/meowpass && mp init.