23.1k stars · MPL-2.0, confirmed by opening the LICENSE file directly on 2026-09-18; no added conditions · v3.13.3 (2026-07-23), read from /releases/latest; the GitHub date carried no year and falls in the past, so it is this year · Track this in Scout
Encrypts the values inside a YAML, JSON, ENV or INI file while leaving the names readable, so the file can live in your code history.
▶Repo detailsthe review · specs · pros & cons · install
What it is
A command-line editor for settings files. It works on YAML, JSON, ENV and INI files, and it encrypts each value while leaving each name in plain text. The key can come from age, from PGP, or from a cloud key service such as Amazon KMS, Google KMS or Azure Key Vault. It began at Mozilla in 2015 and is now a project of the Cloud Native Computing Foundation.What it is good for. Anyone who has ever emailed a .env file to themselves, or kept the only copy of a production password on one laptop. The problem it removes is the gap between "the settings are in the repository" and "the secrets are somewhere else". A short line about Grasppy: its deploy needs a database password, an email key and a model key, and this lets all three live beside the code they belong to.
- Only the values are encrypted, so a change to the file still reads as a change to one setting instead of a wall of unreadable text.
- It works with age from Edition 20, so you can use a single small key file and no cloud account at all.
- MPL-2.0 licence, confirmed by reading the LICENSE file directly, with no added conditions.
- Lose the key and the file is gone for good. Keep a second copy of the key somewhere that is not the same machine.
- It adds a step before every deploy, and a deploy script that forgets to decrypt fails in a confusing way.
- It protects the file while it is stored. Once the program is running the values are in memory like any others, so this is not a secrets manager.
FiloSottile/agePublished in Edition 20, it locks one whole file with one key, which is simpler and hides the shape of the file as well.
Track this in Scout- AGWA/git-crypt
Encrypts whole files automatically as git stores them, which needs no extra command and makes every change unreadable in the history.
Track this in Scout - bitnami-labs/sealed-secrets
Solves the same problem specifically inside Kubernetes, so it is the right answer only if you already run Kubernetes.
Track this in Scout
```bash Download the binary for your machine from https://github.com/getsops/sops/releases/latest or on macOS: brew install sops age
