MiniEnv vs
Infisical
Infisical is open source, self-hostable, and free for five identities, which sounds exactly like our free tier. It is not, and the difference is one word: identity. Infisical bills any principal that authenticates, human or machine, so a CI token takes a seat. We count people.
| MiniEnv | Infisical | |
|---|---|---|
| Five people | Free | Free, if nothing else authenticates |
| Ten identities | $29.99/mo, flat, for people | $200/mo billed annually, or $230 monthly |
| What takes a seat | A person on a project | Any human or machine that authenticates |
| Self-hosting | Not possible. Our relay is ours. | Yes, and the source is open |
| Runs on | App: macOS 12+, Apple Silicon. CLI: comes with the app, needs Node 20.19 | Anywhere, with SDKs and a CLI |
| Secrets that are not KEY=value | A vault of up to 100 entries per project, alongside the env vars | Secrets live in the same project as the env vars |
Infisical figures are from its own pricing page, which states the per-identity price both billed annually and billed monthly. The ten-identity maths is in the sources below.
What MiniEnv does not do. The app runs on macOS 12 or later, on Apple Silicon. There is a CLI, which does the same encryption with the same Keychain identity and covers projects, members, teams, devices and the vault, but it is macOS only as well and it needs Node 20.19. So: no Windows, no Linux, no iOS, no Android, on either. Nothing injects secrets into a running service and nothing fetches values at boot. If any of that is a requirement, stop reading here: the tool on the other side of this page is the right one.
The word doing the work is "identity"
Infisical Free is $0 for 5 identities, with unlimited projects, 3 environments and 10 secret syncs. Read quickly, that is our free tier plus self-hosting.
Infisical's pricing page defines an identity as "any human or machine that authenticates to Infisical". So the fifth seat can be taken by a GitHub Actions runner. A team of four with two CI pipelines is over the line, and Pro is $20 per identity per month billed annually, or $23 monthly.
This is not a trick and they publish it clearly. It is a consequence of the product being for machines as well as people. But it is the single most common surprise on the way from their free tier to their invoice, so it belongs at the top of this page rather than in a footnote.
The comparison flips where you have few machines and several people: we are free to five and then flat, and no CI token can consume one of those five because we have no concept of one.
The thing they have that we structurally cannot
Infisical is open source and self-hostable. You can read the code that holds your secrets, and you can run it on your own hardware, which makes the question of whether to trust the vendor mostly go away.
MiniEnv answers the same question a different way, and it is fair to weigh them against each other rather than to pretend ours is strictly better. Our relay is closed and hosted by us. What we offer instead is that it holds nothing it could give up: no private key, no decrypt-capable dependency, and a check in our own test suite that fails the build if one is ever added.
Self-hosting is a stronger guarantee if you are willing to run the server. Ours is a stronger guarantee if you are not.
Where we differ on removal
Remove somebody from a project and every value in it is re-encrypted, on the machine of whoever removed them, before the change is accepted. There is no window in which the removed person can still read a new value.
What that does not do, and what no tool can do, is reach backwards. Anything they already pulled, they still have. Rotate it at the source.
When to use Infisical instead
- You want to self-host, or you want to read the source of the thing holding your secrets.
- Machines need access. Their whole identity model is built for it; we have none.
- Anyone is not on a Mac.
- You need SSO, SCIM, approval workflows or PKI. Those are real tiers on their pricing page and imaginary on ours.
- You have five people and no CI, and you would rather be on an open source tool. Their free tier genuinely covers you.
Where these numbers came from
Every figure above, including ours. If one of them has gone stale, it is a bug on this page and worth telling us about.
- Infisical Free is $0 for 5 identities, with unlimited projects, 3 environments and 10 secret syncs.
https://infisical.com/pricing · read 30 August 2026 - Infisical Pro is $20 per identity per month billed annually, or $23 billed monthly.
https://infisical.com/pricing · read 30 August 2026 - Infisical Advanced is $40 per identity per month billed annually, or $46 billed monthly.
https://infisical.com/pricing · read 30 August 2026 - Infisical bills per identity, and its pricing page defines one as "any human or machine that authenticates to Infisical".
https://infisical.com/pricing · read 30 August 2026 - Worked out from the vendor price: Infisical at ten identities: $20 x 10 = $200 per month billed annually, or $23 x 10 = $230 billed monthly.
https://infisical.com/pricing · read 30 August 2026 - MiniEnv Free is $0 and covers five people, including the admin.
https://minienv.dev/ · read 30 August 2026 - MiniEnv Pro is $29.99 per month, flat, with no per-seat charge, and one subscription covers up to 3 teams you run.
https://minienv.dev/ · read 30 August 2026 - The MiniEnv app runs on macOS 12 or later, on Apple Silicon. There is no Windows, Linux, iOS or Android client.
https://minienv.dev/ · read 30 August 2026 - There is a MiniEnv CLI. It does the same encryption on your machine, with the same Keychain identity as the app, and covers projects, members, teams, devices and the vault. It ships inside the app and is installed from Settings in the app, so it is the same release as the app; it needs Node 20.19 or later, and is macOS only, because private keys live in the macOS Keychain.
https://minienv.dev/ · read 30 August 2026 - A MiniEnv project has a vault: a separate collection for secrets that are not KEY=value, such as a service-account JSON, an Apple .p8, a PEM or SSH deploy key, recovery codes or a note. A project holds up to 100 entries, each at most 65,536 bytes once encrypted.
https://minienv.dev/ · read 30 August 2026 - The vault is a different collection from a project's env vars, so a pull cannot write a vault entry into a .env file and a Vercel push cannot send one. Removing a member re-encrypts the vault and the env vars in the same write, and a client that submits one without the other is refused.
https://minienv.dev/ · read 30 August 2026
The other comparisons
They are already in the building, and Environments is included in the plan you pay for. The case for looking anyway is narrow, and it is about what happens when somebody leaves.
Encrypt the .env file and commit it, versus keep the values out of the repo. Both are defensible. They differ most on the day somebody leaves.
The real competitor. It costs nothing, needs no account, and works today. Here is what it actually costs you, and when it is still the right call.
Built for machines fetching secrets at runtime. We do not do that at all, which makes most of this comparison a question of which problem you have.
Encrypt it and commit it. Free, portable, and used heavily. The manual part is key management, and that is the part we automate.
If your workloads are in AWS, this is not really a competitor, and the free Parameter Store option is the one that deserves your attention first.