Fort Knox for your secrets
Your secrets.
Where you need them.
From your vault to your terminal. Load secrets from encrypted files, password managers, and cloud services with one command.
mise use -g fnoxOpen source · MIT licensed · Built in Rust
fnox.toml # Connect the vault you already use
[providers.op]
type = "1password"
vault = "Engineering"
[secrets.DATABASE_URL]
provider = "op"
value = "Database/url"$ fnox exec -- npm startDATABASE_URL is available to your app.
The reference goes in git. The value stays in your vault.
ONE INTERFACE. YOUR INFRASTRUCTURE.
Keep your workflow.
Give secrets a home.
Choose how to store each value. Your application keeps reading the same environment variables.
A config you can commit.
Encrypt with age, a hardware key, or cloud KMS. Review configuration alongside your code and share access through public recipients or provider permissions.
Start with ageYour vault, in your terminal.
Reference the secrets your team already manages. Add a personal encrypted cache with fnox sync for local, offline access using age.
Connect a vaultLocal today. CI tomorrow.
Use profiles for development, staging, and production. Change the secret source without changing the way you launch your application.
Work with profilesLESS SECRET SHUFFLING
Ready for the
daily routine.
From a single project to a monorepo, keep secret handling close to the tools you use.
See how fnox worksEnter a directory. Load its secrets.
Shell hooks load and unload values as you move between projects.
Make repeated reads faster.
An opt-in daemon keeps resolved values in memory during your session.
Give credentials an expiry.
Create temporary credentials with AWS STS, GitHub Apps, Vault, and more.
Scope credentials to requests.
Pass placeholders to an agent and inject real values into matching HTTPS requests.
Start with one secret.
Install fnox, configure a provider, and run your first command.