We make one of the tools listed here, so treat this as an informed comparison rather than a neutral review. The criteria come first so you can weigh them yourself, and every recommendation says who it's wrong for.
Verify current pricing and privacy policies before adopting anything — those change faster than articles get updated.
Pick by situation
| Your situation | Use |
|---|---|
| Solo dev, macOS only, want free and offline | PassStore or pass |
| Team sharing credentials, needs audit | 1Password or Bitwarden |
| Already paying for 1Password | 1Password CLI (op run) — don't add a tool |
| Want open source and self-hosting | Bitwarden / Vaultwarden, or pass |
| Terminal-only, scripting everything | pass or sops + age |
| Production secrets for a live service | None of these — use a cloud secret manager |
| Just need Wi-Fi passwords and certs | Keychain Access, already installed |
That last row before the end is the one people get wrong most often. An API key manager on your laptop is for your development credentials. Production secrets belong in infrastructure that can rotate and audit them — see local-first vs cloud secret managers.
1. What "good" means for API keys specifically
API keys are not passwords, and tools built for passwords fit them awkwardly. A password has a login form: URL, username, autofill. An API key has a project, an environment, a scope, and a rotation date.
| Criterion | Why it matters |
|---|---|
| Encrypted at rest, with a stated algorithm | "Bank-grade security" tells you nothing. AES-256-GCM tells you something |
| Auto-lock while you stay logged in | FileVault stops protecting you the moment you log in |
| Fast copy without a browser | A slow tool means keys stay in .env — friction decides behaviour |
| Clipboard auto-clear | The pasteboard is readable by any process running as you |
| Project / environment grouping | Forty keys across twelve repos need structure, not a flat list |
.env import and export | You have existing files; migration must be possible |
| Honest threat model docs | A tool that oversells is one you'll misuse |
| Rotation metadata | "When did I last change this?" should be answerable |
| Reuse / weak-secret audit | Finds the key you pasted into four projects |
| Export path out of the tool | Avoid lock-in; you should be able to leave |
That last one deserves emphasis. Any secret manager without a working export is a hostage situation. Test the export before you commit to a tool, not when you want to switch.
2. Class A — Developer-first native vaults
PassStore
macOS-native (Swift/SwiftUI, not Electron), local-first, free, MIT-licensed.
- AES-256-GCM vault encryption with Argon2id key derivation (Security)
- Touch ID / Secure Enclave unlock, or master password
- No cloud sync, no account server — there is no backend for data to reach
- Workspace grouping per project,
.envgroups, DB and SSH credential types - Vault health audit for reused and weak secrets
- Command palette and menu bar access; clipboard auto-clear; auto-lock
- Encrypted backup export and import
- Requires macOS 26.0 or later
Download · Source · API key manager guide
Best for: developers who live in Terminal and IDE, on macOS, who want structured local secrets without a subscription or an account.
Wrong for you if: you need to share credentials with teammates (no sharing by design), you're not on macOS, you need an audit trail, you want browser autofill for logins, or you can't run macOS 26. Also note: no account means no password recovery — take backups.
3. Class B — General password managers with developer tooling
1Password
The strongest all-rounder if you need sync and sharing. Its developer story is better than local-first advocates usually admit: secret references plus op run inject values at process start, so no plaintext lands on disk.
# .env holds op:// references, safe to commit
op run --env-file=.env -- npm run dev
Also: op read for scripts, an SSH agent with per-use Touch ID prompts, service accounts for CI, and shell plugins for aws and gh.
Best for: teams, anyone needing SSO or audit logs, cross-platform work, and people who want one tool for human logins and machine credentials.
Wrong for you if: you don't want a subscription or a vendor in the trust chain, or you want an offline-only tool with no account. Full comparison: 1Password vs a local secret manager.
Bitwarden
Open source and self-hostable, with a genuinely usable free tier. Note that Bitwarden splits products: the password manager is separate from Bitwarden Secrets Manager, which is the one aimed at machine credentials and CI. If you're evaluating Bitwarden for API keys, evaluate that one.
bw get covers CLI access for the password manager; Secrets Manager has its own CLI.
Best for: teams wanting open source, anyone who wants to self-host (directly or via the community Vaultwarden server), budget-conscious setups.
Wrong for you if: you want the smoothest native macOS experience, or you don't want to run a server. Details: Bitwarden for developers: is it enough?.
4. Class C — Keychain Access (already on your Mac)
Free, built in, hardware-backed. It's the right tool for Wi-Fi passwords, certificates, and one-off items.
It is not a developer secret manager, for reasons that are structural rather than fixable:
- No project grouping. Item names become a naming convention you'll forget.
- No rotation metadata. Nothing records when a value changed.
- The login keychain stays unlocked all session, so it can't give you auto-lock.
- Bulk UX is poor. Keychain Access.app is not built for forty developer secrets.
- Secrets in CLI arguments land in shell history and
psoutput:
# Convenient, and it leaks into history — prefer -w with no value to be prompted
security add-generic-password -a "$USER" -s STRIPE_KEY -w 'sk_test_...'
security find-generic-password -s STRIPE_KEY -w
Best for: ad-hoc items, certificates, and as the unlock mechanism underneath a better tool.
Wrong for you if: you have more than a handful of secrets. Detail: macOS Keychain for developers.
5. Class D — Terminal-native tools
pass (GPG-based)
The Unix answer: one GPG-encrypted file per secret, in a Git repo.
brew install pass
pass insert dev/stripe/secret-key
pass show dev/stripe/secret-key
STRIPE_SECRET_KEY="$(pass show dev/stripe/secret-key)" npm run dev
Best for: developers already comfortable with GPG who want full scriptability, plain files, and Git-based history and sync.
Wrong for you if: you don't want to manage GPG keys — the setup and key hygiene are the real cost. Also note that pass encrypts values but not the directory structure, so secret names are visible in the repo. That's fine for many, disqualifying for some.
sops + age
Encrypts structured files (YAML, JSON, .env) in place, with values encrypted and keys readable. Built for committing encrypted config to Git and decrypting in CI. age is a much simpler alternative to GPG for the key layer.
Best for: teams that want encrypted config in Git and per-environment files, especially with Kubernetes.
Wrong for you if: you want a GUI, or you're managing ad-hoc personal keys rather than versioned config files. See open source secret managers compared.
6. Not API key managers, despite being used as such
- Notes.app, Apple Notes, Obsidian — encryption is inconsistent or absent, and content gets synced and indexed. A locked note is not a vault.
- Spreadsheets in shared drives — plaintext, broadly readable, silently copied, and permanently in version history.
- Slack messages and snippets — retained indefinitely, searchable by everyone in the workspace, and included in export archives. Every leak post-mortem seems to find one.
- Browser-saved passwords for API keys — no project model, and sync scope is often wider than people assume.
- A
.envfile you keep meaning to clean up — the default state, and the most common source of real leaks: why your .env setup is probably leaking.
7. Migrating without a bad afternoon
- Inventory first. Find what you actually have:
# Every env file under your code directory fd -H -t f '^\.env' ~/Developer - Import per project, not all at once. One repo, verify it still runs, move on.
- Keep
.env.examplecommitted with blank values so onboarding still works. - Delete the real
.envonce the vault entry is verified — and remember Time Machine keeps snapshots, so rotate anything that was ever exposed rather than trusting deletion. - Test the export path from your new tool before you delete anything irreversibly.
- Downgrade production keys to test keys on the laptop while you're in there. Highest-value step, most often skipped.
What about free vs paid?
Free isn't the deciding factor for most teams, and shouldn't be. The real cost of a secret manager is the workflow friction it adds multiplied by every developer, every day — a tool people route around is more expensive than a subscription.
That said, the free options here are not compromises: PassStore is MIT-licensed, Bitwarden's free tier is genuinely usable, pass and sops are open source, and Keychain ships with the OS. Paid tiers buy sharing, audit, provisioning, and support — team problems, essentially. If you don't have team problems, you may not need to pay.