MiniEnv vs
SOPS and git-crypt
Both encrypt files inside your repository, so ciphertext is versioned with the code. Both are free, run anywhere, and are good at what they do. Both also ask you to run a key backend and to re-encrypt by hand when somebody leaves. That last part is the only thing MiniEnv is really offering to take over.
| MiniEnv | SOPS and git-crypt | |
|---|---|---|
| Cost | Free to five people, then $29.99/mo flat | Free, both of them |
| Where ciphertext lives | Our relay, which cannot decrypt it | In your repository, versioned with the code |
| Keys | One per person, in the macOS Keychain | SOPS: KMS, age or PGP. git-crypt: GPG keys or a shared symmetric key. |
| When somebody leaves | Every value re-encrypted before the removal is accepted | You re-encrypt, by hand, and rotate what they saw |
| Runs on | App: macOS 12+, Apple Silicon. CLI: comes with the app, needs Node 20.19 | Anywhere, including CI |
| Secrets that are not KEY=value | A vault of up to 100 entries per project, alongside the env vars | Both encrypt whole files, so a .p8 or a PEM is native to them |
Install counts are Homebrew's own analytics and cover macOS only, so they undercount both tools considerably. They are here as evidence that these are in real use, not as a market share claim.
What MiniEnv does not do. The app runs on macOS 12 or later, on Apple Silicon. There is a CLI, which does the same encryption with the same Keychain identity and covers projects, members, teams, devices and the vault, but it is macOS only as well and it needs Node 20.19. So: no Windows, no Linux, no iOS, no Android, on either. Nothing injects secrets into a running service and nothing fetches values at boot. If any of that is a requirement, stop reading here: the tool on the other side of this page is the right one.
Where both projects actually stand
SOPS released v3.13.3 on 23 July 2026 and has 22,966 GitHub stars. Its Homebrew formula recorded 139,812 installs in 365 days. It is busy and it is maintained.
git-crypt released 0.8.0 on 24 September 2025, and GitHub reports the last push to the repository on that same date. It has 9,884 stars and 47,090 Homebrew installs in 365 days.
Those dates are stated rather than interpreted. A tool that does one well-defined job can be finished rather than abandoned, and plenty of people would rather depend on something that has stopped changing. It is your call, and you should make it with the date in front of you.
What we agree about
More than the rest of this section of the site. SOPS with age recipients is close to the model MiniEnv uses: values encrypted to the public keys of the people who should read them, no server able to decrypt, no vendor in the trust path. We encrypt with age too. It shipped v1.3.2 on 29 August 2026 and its Homebrew formula recorded 48,041 installs in 365 days.
So this is not an argument about cryptography. It is an argument about who does the key management.
The manual step
With SOPS or git-crypt, taking somebody's access away means editing the recipient list, re-encrypting every affected file, committing, and making sure nothing was missed. It is entirely doable and people do it. It is also a job that arrives unscheduled, is done under pressure, and fails silently when a file is skipped, because a file encrypted to the old recipient set looks exactly like one that is not.
Remove somebody from a project and every value in it is re-encrypted, on the machine of whoever removed them, before the change is accepted. There is no window in which the removed person can still read a new value.
What that does not do, and what no tool can do, is reach backwards. Anything they already pulled, they still have. Rotate it at the source.
And a genuine advantage in the other direction: your history. A repo using SOPS carries its encrypted values through every commit, so checking out last quarter's tag gives you last quarter's config. We do not offer that.
When to use SOPS or git-crypt instead
- CI has to decrypt. Both are built for it. We are not.
- Anyone is not on a Mac.
- You want ciphertext versioned with the code, so old commits carry the config that went with them.
- You already run KMS, GCP KMS or Vault. SOPS plugs straight into them, and your key management problem is already solved.
- You encrypt more than env vars. SOPS handles YAML, JSON and INI structurally; git-crypt handles any file in the repo.
- Free matters more than convenient. Both are, and honestly, for a two person team that already knows GPG, that is a good trade.
Where these numbers came from
Every figure above, including ours. If one of them has gone stale, it is a bug on this page and worth telling us about.
- The sops Homebrew formula recorded 139,812 installs in 365 days.
https://formulae.brew.sh/api/ · read 30 August 2026 - sops released v3.13.3 on 23 July 2026 and has 22,966 GitHub stars.
https://api.github.com/repos/getsops/sops · read 30 August 2026 - The git-crypt Homebrew formula recorded 47,090 installs in 365 days.
https://formulae.brew.sh/api/ · read 30 August 2026 - git-crypt released 0.8.0 on 24 September 2025, and GitHub reports the last push to the repository on the same date. It has 9,884 stars.
https://api.github.com/repos/AGWA/git-crypt · read 30 August 2026 - age released v1.3.2 on 29 August 2026, has 23,362 GitHub stars, and its Homebrew formula recorded 48,041 installs in 365 days.
https://api.github.com/repos/FiloSottile/age · read 30 August 2026 - MiniEnv Free is $0 and covers five people, including the admin.
https://minienv.dev/ · read 30 August 2026 - MiniEnv Pro is $29.99 per month, flat, with no per-seat charge, and one subscription covers up to 3 teams you run.
https://minienv.dev/ · read 30 August 2026 - The MiniEnv app runs on macOS 12 or later, on Apple Silicon. There is no Windows, Linux, iOS or Android client.
https://minienv.dev/ · read 30 August 2026 - There is a MiniEnv CLI. It does the same encryption on your machine, with the same Keychain identity as the app, and covers projects, members, teams, devices and the vault. It ships inside the app and is installed from Settings in the app, so it is the same release as the app; it needs Node 20.19 or later, and is macOS only, because private keys live in the macOS Keychain.
https://minienv.dev/ · read 30 August 2026 - A MiniEnv project has a vault: a separate collection for secrets that are not KEY=value, such as a service-account JSON, an Apple .p8, a PEM or SSH deploy key, recovery codes or a note. A project holds up to 100 entries, each at most 65,536 bytes once encrypted.
https://minienv.dev/ · read 30 August 2026 - The vault is a different collection from a project's env vars, so a pull cannot write a vault entry into a .env file and a Vercel push cannot send one. Removing a member re-encrypts the vault and the env vars in the same write, and a client that submits one without the other is refused.
https://minienv.dev/ · read 30 August 2026
The other comparisons
They are already in the building, and Environments is included in the plan you pay for. The case for looking anyway is narrow, and it is about what happens when somebody leaves.
Encrypt the .env file and commit it, versus keep the values out of the repo. Both are defensible. They differ most on the day somebody leaves.
The real competitor. It costs nothing, needs no account, and works today. Here is what it actually costs you, and when it is still the right call.
Built for machines fetching secrets at runtime. We do not do that at all, which makes most of this comparison a question of which problem you have.
Open source, self-hostable, and free for five identities. The catch is what an identity is, and it is worth understanding before you plan around the free tier.
If your workloads are in AWS, this is not really a competitor, and the free Parameter Store option is the one that deserves your attention first.