MiniEnv vs
AWS Secrets Manager
Start with the number nobody leads with: if you are on AWS and just need somewhere to put a secret, Parameter Store standard parameters carry no additional charge. Secrets Manager is $0.40 per secret per month and buys you rotation. Neither is built for handing a value to a colleague, which is all MiniEnv does.
| MiniEnv | AWS Secrets Manager | |
|---|---|---|
| Cost | Free to five people, then $29.99/mo flat | $0.40 per secret per month, plus $0.05 per 10,000 API calls |
| The cheaper AWS option | Not applicable | Parameter Store standard parameters: no additional charge |
| Who it is for | People sharing values on a Mac | Workloads, roles and services inside AWS |
| Access model | The people you invite to a project | IAM policies |
| Rotation | None. Rotate at the provider. | Built in, with Lambda rotation functions |
| Secrets that are not KEY=value | A vault of up to 100 entries per project, alongside the env vars | Secrets Manager stores JSON and binary secrets too |
AWS prices are from the Secrets Manager and Systems Manager pricing pages and can vary by region. Check yours before planning around them.
What MiniEnv does not do. The app runs on macOS 12 or later, on Apple Silicon. There is a CLI, which does the same encryption with the same Keychain identity and covers projects, members, teams, devices and the vault, but it is macOS only as well and it needs Node 20.19. So: no Windows, no Linux, no iOS, no Android, on either. Nothing injects secrets into a running service and nothing fetches values at boot. If any of that is a requirement, stop reading here: the tool on the other side of this page is the right one.
The honest number first
AWS Systems Manager Parameter Store standard parameters carry no additional charge. If what you need is a place to keep a value that your Lambda or your ECS task can read, that is the answer, and it costs nothing.
Secrets Manager is $0.40 per secret per month plus $0.05 per 10,000 API calls, and what the money buys is managed rotation, cross-account access and integrations that Parameter Store does not have. Ten secrets is $4.00 per month before API calls, which is not a number worth optimising for a small team, but it is worth knowing you are paying it for rotation rather than for storage.
Advanced parameters are $0.05 per parameter per month, and standard parameters at higher throughput are charged $0.05 per 10,000 interactions. So "free" has an edge to it, as it usually does on AWS.
Why this comparison is mostly a category error
Both AWS options are for things running inside AWS, reached through IAM. The consumer is a role. There is no concept of handing a value to a colleague, and no client on their laptop, because that is not what they are for.
MiniEnv is the opposite shape. The consumer is a person with a Mac, and there is no runtime, no IAM, and nothing that fetches a value at boot. The two overlap only in the sense that both hold secrets.
The real question is not which of these to buy. It is whether your problem is "my service needs this at runtime" or "my new developer needs this on their laptop". Those are different problems and the second one is the only one we solve.
Using both is a normal answer
Plenty of teams keep production secrets in Parameter Store or Secrets Manager, where the services read them, and separately need a way to get local development values onto a new laptop. Those are the same values surprisingly rarely.
Remove somebody from a project and every value in it is re-encrypted, on the machine of whoever removed them, before the change is accepted. There is no window in which the removed person can still read a new value.
What that does not do, and what no tool can do, is reach backwards. Anything they already pulled, they still have. Rotate it at the source.
When to use AWS instead
- Your workloads are in AWS. Use Parameter Store first, and only pay for Secrets Manager when you want its rotation.
- You need automated rotation. We have none, and rotation is the main thing the per-secret price buys.
- Access should be governed by IAM, alongside everything else you already govern that way.
- Anyone is not on a Mac.
- Machines are the consumer. Every time.
Where these numbers came from
Every figure above, including ours. If one of them has gone stale, it is a bug on this page and worth telling us about.
- AWS Secrets Manager is $0.40 per secret per month, plus $0.05 per 10,000 API calls.
https://aws.amazon.com/secrets-manager/pricing/ · read 30 August 2026 - AWS Systems Manager Parameter Store standard parameters carry no additional charge. Advanced parameters are $0.05 per parameter per month.
https://aws.amazon.com/systems-manager/pricing/ · read 30 August 2026 - Parameter Store charges $0.05 per 10,000 API interactions for advanced parameters, and for standard parameters at higher throughput.
https://aws.amazon.com/systems-manager/pricing/ · read 30 August 2026 - Worked out from the vendor price: AWS Secrets Manager holding ten secrets: $0.40 x 10 = $4.00 per month, before API calls.
https://aws.amazon.com/secrets-manager/pricing/ · read 30 August 2026 - MiniEnv Free is $0 and covers five people, including the admin.
https://minienv.dev/ · read 30 August 2026 - MiniEnv Pro is $29.99 per month, flat, with no per-seat charge, and one subscription covers up to 3 teams you run.
https://minienv.dev/ · read 30 August 2026 - The MiniEnv app runs on macOS 12 or later, on Apple Silicon. There is no Windows, Linux, iOS or Android client.
https://minienv.dev/ · read 30 August 2026 - There is a MiniEnv CLI. It does the same encryption on your machine, with the same Keychain identity as the app, and covers projects, members, teams, devices and the vault. It ships inside the app and is installed from Settings in the app, so it is the same release as the app; it needs Node 20.19 or later, and is macOS only, because private keys live in the macOS Keychain.
https://minienv.dev/ · read 30 August 2026 - A MiniEnv project has a vault: a separate collection for secrets that are not KEY=value, such as a service-account JSON, an Apple .p8, a PEM or SSH deploy key, recovery codes or a note. A project holds up to 100 entries, each at most 65,536 bytes once encrypted.
https://minienv.dev/ · read 30 August 2026 - The vault is a different collection from a project's env vars, so a pull cannot write a vault entry into a .env file and a Vercel push cannot send one. Removing a member re-encrypts the vault and the env vars in the same write, and a client that submits one without the other is refused.
https://minienv.dev/ · read 30 August 2026
The other comparisons
They are already in the building, and Environments is included in the plan you pay for. The case for looking anyway is narrow, and it is about what happens when somebody leaves.
Encrypt the .env file and commit it, versus keep the values out of the repo. Both are defensible. They differ most on the day somebody leaves.
The real competitor. It costs nothing, needs no account, and works today. Here is what it actually costs you, and when it is still the right call.
Built for machines fetching secrets at runtime. We do not do that at all, which makes most of this comparison a question of which problem you have.
Open source, self-hostable, and free for five identities. The catch is what an identity is, and it is worth understanding before you plan around the free tier.
Encrypt it and commit it. Free, portable, and used heavily. The manual part is key management, and that is the part we automate.