vs password managers

Good password managers are already end-to-end encrypted, already derive keys from a password plus a secret, and already do out-of-band verification. Architecturally we are close cousins, and Cendarum’s key hierarchy is openly in that lineage.

The difference is not cryptography. It is what the tool is shaped around.

Shaped for reading, not for running

A password manager optimises the path from “I need this credential” to “it is in my clipboard”. Copy, paste, done. That is the right shape for logging into a website.

Cendarum optimises the path from “my app needs fourteen values” to “my app is running”:

cendarum run --env dev -- npm run dev

No copying, no pasting, nothing on disk, and no human in the loop per value. That single command is the entire product thesis. Doing the same thing through a password manager means fourteen copy-pastes into a file you then have to delete.

Environments as a first-class idea

dev, staging, and production are not three folders that happen to contain similar items. They are the same set of keys with different values, and the tool knows it:

• The unit of access is an environment, so you can grant dev and withhold production
• Production is marked amber everywhere it appears
• A key that exists in one environment and not another is visible as a gap
• Concurrent edits get a per-key 3-way merge rather than a “which version do you want” prompt about the whole vault

A folder structure can approximate the first. It cannot do the rest.

Built for the values, not the value

	Password manager	Cendarum
Optimised for	one credential, read by a human	a whole environment, read by a process
Egress	clipboard, autofill	process environment
Grouping	vaults and folders	project, then environment
Access unit	vault	environment
Sharing	items or vaults	environment grants, with rotation
Concurrent edits	item-level conflict	per-key 3-way merge
Audit	varies	includes every read of an environment
Browser extension	yes	no
Mobile	yes	no
Logins, cards, notes, TOTP	yes	no

When to use the password manager instead

Straightforwardly:

• Your logins. All of them. Cendarum does not do web credentials, autofill, TOTP, or passkeys and is not going to.
• You want mobile or browser access. We have neither.
• Your team already has one and the friction is acceptable. A tool everyone already has beats a better tool nobody has installed. That is a real argument and we are not going to talk you out of it.
• You need one shared credential, not a set of environment variables.

Use both

This is the expected arrangement, not a fallback. Your password manager holds your logins — including, sensibly, your Cendarum Recovery Kit. Cendarum holds the environment variables your applications run with.

They are different jobs. The overlap is narrower than it looks, and the reason developers end up using a password manager for .env values is usually that nothing else was shaped for it.