Free for one. $8 a seat for a team.
One number, no feature matrix to decode, and nothing about your safety behind a paywall.
Solo
Free
One person. Forever, not a trial.
- Unlimited projects and environments
- Unlimited secrets — we can't count them anyway
- The full CLI and desktop app
- Audit log, rotation, both recovery paths
- Sync across all your own devices
The CLI is the point of the product. It should not have a price on it.
Team
$8/ user / month
Two people or more. Every seat, including yours. USD, billed monthly.
- Everything in Solo
- Invite teammates, with the key ceremony
- Per-environment grants: no access, read, write
- Atomic revoke-and-rotate
- Roster, roles, and the project audit log
Solo is free. From two people up, every seat is $8 — so a four-person team is $32 a month, not $24. Add a contractor for a fortnight and remove them again; it should never be a budget conversation.
the rule
We never put a security feature behind a paywall.
The obvious way to build a Team tier is to charge for the audit log, or rotation, or the key ceremony. That would mean selling a less safe product to whoever pays less — and this whole site argues that safety is structural rather than optional. So the price is on people, and on nothing else.
The full audit log
All 33 recorded actions, including every read of an environment.
Rotation
Revoking re-keys the environment, atomically. Not an upgrade.
The fingerprint ceremony
Out-of-band key verification before any key is wrapped.
Both recovery paths
Personal Recovery Key, and admin-assisted for teams.
The whole CLI
run, import, export. No feature-gated flags.
Unlimited everything else
Projects, environments, secrets. We do not count them.
One nuance, stated rather than hidden: if audit retention ever becomes tiered, that's a storage cost rather than a safety feature. The log itself will exist in every tier, always.
how this compares
The row that matters isn't the price.
Everything in this category says "encrypted". The question worth asking is who holds the key that undoes it.
| Provider can decrypt | Price | Free tier | |
|---|---|---|---|
| Cendarum this one | No Keys derive from your master password and a Secret Key generated on your device. The server never receives either, and does not link the code that could decrypt. | $8 / user / month | 1 user, every feature |
| a .env file | No There is no provider. This is the honest baseline, and for one person on one machine it is often the right answer. | free | all of it |
| dotenvx CLI | No Public-key encryption with the keypair generated on your machine. Runs locally and in CI with no account, so there is no provider in the loop at all. | free, BSD-3 licensed | all of it |
| dotenvx Armor | Holds your keys The hosted service, and their own description of it: "Armor keeps your private decryption keys armored off device. Your encrypted environment files stay in code. Your private keys stay under guard." Holding the private key is a different posture from ours, where the key material never leaves your device. | $36/yr (1 member) · $20/mo (3) · $90/mo (10) | none |
| Dotenv Vault | Yes Their description: secrets "go through a ten-step process to split their parts, encrypt those parts, and tokenize them into your project's vault." The encryption happens on their service. | $5 / user (max 2 teammates) · $8 / user | none |
| Doppler | Yes A platform product: CI injection, dynamic secrets, 100+ integrations. All of that requires a service that can read your values. | $21 / user / month (Team) | 3 users, 10 projects, 4 environments |
| Infisical | Yes Same category as Doppler. Self-hosting is available as a paid add-on on top of the per-identity price. | $20–40 / identity / month | 5 identities, 3 projects |
| 1Password | No End-to-end encrypted, and a genuinely good product. A different shape: optimised for a human reading one credential, not for handing a whole environment to a process. | $24.95 / month for 10 (Teams) · $8.99 / user (Business) | none |
Figures read from each product's own pricing page — not its landing page — on 24 July 2026, and they will drift — follow the links for the current ones. Where a security model is described, those are their words, not our characterisation. We compare published prices and stated architecture because those are checkable; we don't make claims about how anyone else's product behaves, for the reasons in how to read our comparisons.
the other half
What $8 doesn't buy.
Doppler and Infisical charge two to five times more, and for some teams they are worth it. Here's what you give up.
Not included, by design
- CI and headless secret injection. A build runner has nobody to type a master password. Supporting it needs a machine identity, which is a different branch of the key hierarchy
- Dynamic or short-lived cloud credentials. Minting those requires holding credentials to your cloud, and being able to use them
- Server-side anything. No search over values, no templating, no policy engine that inspects a secret
- Browser or mobile clients. Decryption needs your keys, and your keys are on your desktop
Not included, not yet
- SSO and SCIM. Nothing built
- No SOC 2, no third-party audit. On the roadmap
- Self-hosting. Not planned — see below
- A support SLA. You get a person who replies, which at this size is better and won't scale
On self-hosting, since it's the usual objection
Infisical sells self-hosting as a paid add-on on top of the per-identity price. People self-host mainly to stop a vendor reading their data — and zero-knowledge reaches that outcome without you running infrastructure, because the provider already can't. That makes "no self-hosting" a consequence of the design rather than a gap in it.
If your policy is "no third-party storage at all", that's a real requirement and we don't meet it. When not to use Cendarum is the honest version of that conversation.
Why we don't price per secret.
Some products in this category do. We can't, and we'd rather not be able to.
Free on your own. Eight dollars a seat together.
Nothing to pay today — early access is free while we find out whether the model holds up for real teams.