fnox

🔐

Multiple Provider Support

Works with age, AWS KMS/SM, Azure, GCP, 1Password, Bitwarden, Bitwarden Secrets Manager, Infisical, password-store, HashiCorp Vault, and more.

📝

Secrets in Git (Encrypted)

Store encrypted secrets in version control with age, AWS KMS, Azure KMS, or GCP KMS.

☁️

Cloud Secret Storage

Reference secrets stored in AWS Secrets Manager, AWS Parameter Store, Azure Key Vault, GCP Secret Manager, or Vault.

🔄

Shell Integration

Automatically load secrets when you cd into a directory with a fnox.toml file.

⚡

Per-User Daemon

Optionally cache resolved secrets in memory for faster repeated reads.

🎯

Multi-Environment Support

Use profiles to manage different secrets for dev, staging, and production.

🛠️

Developer Friendly

Simple TOML config, easy CLI, and smooth integration with your existing workflow.

Quick Example

bash

# Initialize fnox in your project
fnox init

# Set a secret (stores it encrypted in fnox.toml)
fnox set DATABASE_URL "postgresql://localhost/mydb"

# Get a secret
fnox get DATABASE_URL

# Run commands with secrets loaded as env vars
fnox exec -- npm start

# Enable shell integration (auto-load secrets on cd)
eval "$(fnox activate bash)"  # or zsh, fish — see docs for Nushell

The Golden Path

The recommended setup: keep secrets in a vault like 1Password, commit only references to them in fnox.toml, and cache them locally with fnox sync under a personal age key — which can even live in hardware like a Secure Enclave, YubiKey, or TPM.

bash

fnox sync --provider sync-age --local-file

The vault stays the source of truth, but secrets load instantly and offline on every cd. See The Golden Path for details, or jump straight to the setup walkthrough.

How It Works

fnox uses a simple TOML config file (fnox.toml) that you check into git. Secrets are either:

Encrypted inline - The encrypted ciphertext lives in the config file

Remote references - The config contains a reference (like "my-db-password") that points to a secret in AWS/1Password/etc.

You configure providers (encryption methods or cloud services), then assign each secret to a provider. fnox handles the rest.

toml

# fnox.toml
[providers]
age = { type = "age", recipients = ["age1ql3z7hjy54pw3hyww5ayyfg7zqgvc7w3j2elw8zmrj2kg5sfn9aqmcac8p"] }

[secrets]
DATABASE_URL = { provider = "age", value = "YWdlLWVuY3J5cHRpb24uLi4=" }  # ← encrypted ciphertext, safe to commit
API_KEY = { default = "dev-key-12345" }  # ← plain default value for local dev

Supported Providers

fnox works with over 20 providers across four categories:

🔐 Encryption (secrets in git) — age (with SSH keys and hardware plugins), FIDO2, YubiKey, AWS/Azure/GCP KMS

☁️ Cloud secret storage — AWS Secrets Manager & Parameter Store, Azure Key Vault, GCP Secret Manager, HashiCorp Vault, Doppler, and more

🔑 Password managers — 1Password, Bitwarden, Proton Pass, Infisical

💻 Local storage — OS keychain, KeePass, password-store

See the Providers Overview for the full list and a comparison of trade-offs.

fnoxFort Knox for your secrets