MiniEnv vs
dotenvx
dotenvx encrypts the .env file itself so the ciphertext can be committed with your code, and it runs anywhere. MiniEnv keeps values out of the repository and gives every person their own key. The choice is really about one thing: whether taking somebody's access away should be a manual job.
| MiniEnv | dotenvx | |
|---|---|---|
| Price | Free to five people, then $29.99/mo flat | Free and open source; Armor add-on from $5/mo |
| Where the ciphertext lives | Our relay, which cannot decrypt it | In your git repository, by design |
| Keys | One key per person, in the macOS Keychain | One private key per environment, shared with whoever needs it |
| Runs on | App: macOS 12+, Apple Silicon. CLI: comes with the app, needs Node 20.19 | Anywhere Node runs, any language, any CI |
| When somebody leaves | Every value re-encrypted before the removal is accepted | Rotate the private key and redistribute it yourself |
| Secrets that are not KEY=value | A vault of up to 100 entries per project, alongside the env vars | Everything is a value in the .env file |
dotenvx figures are from its own pricing page. The tool is free; the paid tiers are the Armor add-on, which is an audit and key management service rather than the encryption itself.
What MiniEnv does not do. The app runs on macOS 12 or later, on Apple Silicon. There is a CLI, which does the same encryption with the same Keychain identity and covers projects, members, teams, devices and the vault, but it is macOS only as well and it needs Node 20.19. So: no Windows, no Linux, no iOS, no Android, on either. Nothing injects secrets into a running service and nothing fetches values at boot. If any of that is a requirement, stop reading here: the tool on the other side of this page is the right one.
Two different answers to "where does the ciphertext go"
dotenvx writes a DOTENV_PUBLIC_KEY into your .env,
encrypts each value to it, and the encrypted file is meant to be committed.
Decryption needs DOTENV_PRIVATE_KEY, which stays out of the
repository and is handed to teammates and to CI as an environment variable.
The encryption is AES-256 with ephemeral keys over the secp256k1 curve.
MiniEnv encrypts to the public key of every current member, and the result goes to our relay, which holds no private key and has no decrypt-capable dependency. Nothing goes in your repository at all.
Committing ciphertext is a genuinely good property and we do not have it. A dotenvx repo carries its own history of encrypted values; ours does not, and if our relay is unreachable you are waiting for us.
The day somebody leaves
This is the whole comparison, so it is worth being precise rather than persuasive.
With dotenvx, the private key is one key, and everybody who can decrypt has a copy of it. Taking one person's access away therefore means generating a new key, re-encrypting, and getting the new key to everyone else and to CI. The dotenvx README does not document a procedure for it. That does not mean it is hard; it means it is yours to do, correctly, by hand, at the exact moment everybody is busy.
Remove somebody from a project and every value in it is re-encrypted, on the machine of whoever removed them, before the change is accepted. There is no window in which the removed person can still read a new value.
What that does not do, and what no tool can do, is reach backwards. Anything they already pulled, they still have. Rotate it at the source.
If your team is one person, none of this is a difference. A single private key you never share is a fine design, and dotenvx is a better fit for a solo project than we are.
The secrets that are not KEY=value
A service-account JSON, an Apple .p8, a PEM, an SSH deploy key,
a page of recovery codes. Every team has a handful, and they are the ones that
actually get mailed around, because they do not fit on one line.
dotenvx encrypts your .env, so everything it holds is a value in
that file. MiniEnv keeps a vault beside the env vars: up to 100 entries
per project, each up to 65,536 bytes encrypted, with a free-text label instead
of a shouty variable name.
The part that is structural rather than cosmetic is that it is a
separate collection, not a flag on an env var. A pull cannot write a
vault entry into a .env, and a Vercel push cannot send one,
because both iterate the other collection. There is no filter to forget.
Creating an entry is a Pro feature. Existing entries stay readable, editable and deletable on Free, which is the same rule everything else here follows: a downgrade takes away what you may do next, never what you have.
And the thing dotenvx has that we cannot match
It runs everywhere. Any language, any CI runner, any operating system, in a container, on a server. It recorded 11,451,662 npm downloads in a single week and shipped v2.22.0 on 27 August 2026, so it is busy and maintained.
MiniEnv has a CLI too, with the same encryption and the same Keychain identity, but it does not close this gap: it is macOS only, and it does not yet know about environment tabs, so a project the app has organised into several named tabs is not fully visible to it.
There is no runtime story either: nothing in a deployment fetches a value from us at boot. If your problem is "my container needs this secret", dotenvx solves it and we do not.
When to use dotenvx instead
- Anyone on the team is not on a Mac. dotenvx does not care what you run.
- CI or a container needs to decrypt. That is what a shared private key in an environment variable is for, and it is the normal way to do this.
- You want the encrypted values versioned with the code, so a checkout of an old commit brings the values that went with it.
- You are working alone. The revocation argument above is the only real advantage we hold, and it does not apply to a team of one.
- You want it to be free and open source. dotenvx is. MiniEnv is neither.
Where these numbers came from
Every figure above, including ours. If one of them has gone stale, it is a bug on this page and worth telling us about.
- The dotenvx tool itself is free and open source; the paid tiers are its Armor add-on.
https://dotenvx.com/pricing · read 30 August 2026 - dotenvx Armor Solo is $5 per month for 1 user, with 5 day audit retention and 25,000 audit events.
https://dotenvx.com/pricing · read 30 August 2026 - dotenvx Armor Team is $20 per month for 3 users, with 30 day audit retention and 250,000 audit events.
https://dotenvx.com/pricing · read 30 August 2026 - dotenvx Armor Business is $90 per month for 10 users, with 90 day audit retention and 1,000,000 audit events.
https://dotenvx.com/pricing · read 30 August 2026 - dotenvx puts a DOTENV_PUBLIC_KEY in the .env file, encrypts values to it, and the encrypted file is meant to be committed. Decryption needs DOTENV_PRIVATE_KEY, which is kept out of the repository and passed to teammates and CI as an environment variable.
https://github.com/dotenvx/dotenvx · read 30 August 2026 - dotenvx describes its encryption as AES-256 with ephemeral keys over the secp256k1 elliptic curve.
https://github.com/dotenvx/dotenvx · read 30 August 2026 - The dotenvx README does not document a key rotation or access revocation procedure.
https://github.com/dotenvx/dotenvx · read 30 August 2026 - The @dotenvx/dotenvx package recorded 11,451,662 npm downloads in the week of 23 to 29 August 2026.
https://api.npmjs.org/downloads/point/last-week/ · read 30 August 2026 - dotenvx released v2.22.0 on 27 August 2026.
https://api.github.com/repos/dotenvx/dotenvx · read 30 August 2026 - The MiniEnv CLI works with the same named tabs as the app: it lists, adds and renames them, and pushes, pulls, moves and renames values in any of them.
https://minienv.dev/ · read 30 August 2026 - Creating a vault entry is a Pro feature. Existing entries stay readable, editable and deletable on Free.
https://minienv.dev/ · read 30 August 2026 - MiniEnv Free is $0 and covers five people, including the admin.
https://minienv.dev/ · read 30 August 2026 - MiniEnv Pro is $29.99 per month, flat, with no per-seat charge, and one subscription covers up to 3 teams you run.
https://minienv.dev/ · read 30 August 2026 - The MiniEnv app runs on macOS 12 or later, on Apple Silicon. There is no Windows, Linux, iOS or Android client.
https://minienv.dev/ · read 30 August 2026 - There is a MiniEnv CLI. It does the same encryption on your machine, with the same Keychain identity as the app, and covers projects, members, teams, devices and the vault. It ships inside the app and is installed from Settings in the app, so it is the same release as the app; it needs Node 20.19 or later, and is macOS only, because private keys live in the macOS Keychain.
https://minienv.dev/ · read 30 August 2026 - A MiniEnv project has a vault: a separate collection for secrets that are not KEY=value, such as a service-account JSON, an Apple .p8, a PEM or SSH deploy key, recovery codes or a note. A project holds up to 100 entries, each at most 65,536 bytes once encrypted.
https://minienv.dev/ · read 30 August 2026 - The vault is a different collection from a project's env vars, so a pull cannot write a vault entry into a .env file and a Vercel push cannot send one. Removing a member re-encrypts the vault and the env vars in the same write, and a client that submits one without the other is refused.
https://minienv.dev/ · read 30 August 2026
The other comparisons
They are already in the building, and Environments is included in the plan you pay for. The case for looking anyway is narrow, and it is about what happens when somebody leaves.
The real competitor. It costs nothing, needs no account, and works today. Here is what it actually costs you, and when it is still the right call.
Built for machines fetching secrets at runtime. We do not do that at all, which makes most of this comparison a question of which problem you have.
Open source, self-hostable, and free for five identities. The catch is what an identity is, and it is worth understanding before you plan around the free tier.
Encrypt it and commit it. Free, portable, and used heavily. The manual part is key management, and that is the part we automate.
If your workloads are in AWS, this is not really a competitor, and the free Parameter Store option is the one that deserves your attention first.