Your secrets, wherever they live
fnox reads secrets from encrypted files, password managers, and cloud secret stores, and hands them to your program as environment variables. One fnox.toml says where each one lives. The same command works on your laptop and in CI.
mise use -g fnoxOpen source · MIT licensed · Built in Rust
fnox.toml # Point at the vault you already use
[providers.op]
type = "1password"
vault = "Engineering"
[secrets.DATABASE_URL]
provider = "op"
value = "Database/url"$ fnox exec -- npm start Your app reads DATABASE_URL as usual.
Only the item reference is committed. Each person reads it with their own vault login.
Pick your starting point
Each secret names its own provider, so you can start one way and mix in another later.
No vault yet
Encrypt secrets into fnox.toml with age, a YubiKey, or a cloud KMS key. With age, share access by adding teammates' public keys.
A team vault
Commit references to 1Password, Bitwarden, AWS, or Vault items. Cache them locally with fnox sync for fast, offline reads.
CI and production
Give the runner one credential and run the same fnox exec. Use profiles to switch to production sources.
Built for daily work
Secrets load when you enter a project, stay fast when your vault is remote, and stay out of reach of tools that shouldn't have them.
How fnox worksShell integration
Load a project's secrets on cd and unload them when you leave. Bash, Zsh, Fish, Nushell, and PowerShell.
Offline cache
Keep an encrypted copy of vault secrets on your machine, optionally behind Touch ID or a YubiKey.
Short-lived credentials
Hand commands temporary AWS, GCP, Azure, GitHub, or Vault credentials instead of long-lived keys.
Safe for AI agents
Give an agent placeholders and inject real credentials only into the API requests you allow.
Encrypt your first secret
Five minutes, no account required.