fnox

Skip to content

fnoxFort Knox for your secrets<br>Manage secrets with encryption or cloud providers - or both!<br>Get Started<br>View on GitHub

🔐<br>Multiple Provider Support<br>Works with age, AWS KMS/SM, Azure, GCP, 1Password, Bitwarden, Bitwarden Secrets Manager, Infisical, password-store, HashiCorp Vault, and more.

📝<br>Secrets in Git (Encrypted)<br>Store encrypted secrets in version control with age, AWS KMS, Azure KMS, or GCP KMS.

☁️<br>Cloud Secret Storage<br>Reference secrets stored in AWS Secrets Manager, AWS Parameter Store, Azure Key Vault, GCP Secret Manager, or Vault.

🔄<br>Shell Integration<br>Automatically load secrets when you cd into a directory with a fnox.toml file.

Per-User Daemon<br>Optionally cache resolved secrets in memory for faster repeated reads.

🎯<br>Multi-Environment Support<br>Use profiles to manage different secrets for dev, staging, and production.

🛠️<br>Developer Friendly<br>Simple TOML config, easy CLI, and smooth integration with your existing workflow.

Quick Example ​<br>bash# Initialize fnox in your project<br>fnox init

# Set a secret (stores it encrypted in fnox.toml)<br>fnox set DATABASE_URL "postgresql://localhost/mydb"

# Get a secret<br>fnox get DATABASE_URL

# Run commands with secrets loaded as env vars<br>fnox exec -- npm start

# Enable shell integration (auto-load secrets on cd)<br>eval "$(fnox activate bash)" # or zsh, fish — see docs for Nushell<br>How It Works ​<br>fnox uses a simple TOML config file (fnox.toml) that you check into git. Secrets are either:<br>Encrypted inline - The encrypted ciphertext lives in the config file<br>Remote references - The config contains a reference (like "my-db-password") that points to a secret in AWS/1Password/etc.<br>You configure providers (encryption methods or cloud services), then assign each secret to a provider. fnox handles the rest.<br>toml# fnox.toml<br>[providers]<br>age = { type = "age", recipients = ["age1ql3z7hjy54pw3hyww5ayyfg7zqgvc7w3j2elw8zmrj2kg5sfn9aqmcac8p"] }

[secrets]<br>DATABASE_URL = { provider = "age", value = "YWdlLWVuY3J5cHRpb24uLi4=" } # ← encrypted ciphertext, safe to commit<br>API_KEY = { default = "dev-key-12345" } # ← plain default value for local dev<br>Supported Providers ​<br>🔐 Encryption (secrets in git, encrypted) ​<br>age - Modern encryption (works with SSH keys!)<br>aws-kms - AWS Key Management Service<br>azure-kms - Azure Key Vault encryption<br>gcp-kms - Google Cloud KMS<br>☁️ Cloud Secret Storage (remote, centralized) ​<br>aws-ps - AWS Parameter Store<br>aws-sm - AWS Secrets Manager<br>azure-sm - Azure Key Vault Secrets<br>gcp-sm - Google Cloud Secret Manager<br>bitwarden-sm - Bitwarden Secrets Manager<br>doppler - Doppler secrets manager<br>foks - FOKS (Federated Open Key Service)<br>vault - HashiCorp Vault<br>🔑 Password Managers & Secret Services ​<br>1password - 1Password CLI<br>bitwarden - Bitwarden/Vaultwarden<br>infisical - Infisical secrets management<br>💻 Local Storage ​<br>keychain - OS Keychain (macOS/Windows/Linux)<br>password-store - GPG-encrypted password store (Unix pass)<br>plain - Plain text (for defaults only!)