An open-source entry in TopGit's GitHub warehouse: jdx/fnox, 2.0k stars, Rust. encrypted/remote secret manager
Snapshot summary built from the project's own GitHub metadata — there's no written TopGit review yet. The page will update automatically when a full review is published.
WHY NO REVIEW YET
TopGit writes full reviews for the most-starred, most-requested repositories. This page is a snapshot until then — see the READ ME tab for the original README in full.
Manage secrets with encryption or cloud providers—or both! fnox gives you a unified interface to work with secrets across development, CI, and production.
Sponsors
fnox is sponsored by entire.io and 37signals.
View all sponsors.
Quick Start
# Install via mise (recommended)
mise use -g fnox
# Initialize in your project
fnox init
# Set a secret (encrypted by default)
fnox set DATABASE_URL "postgresql://localhost/mydb"
# Get a secret
fnox get DATABASE_URL
# Run commands with secrets loaded
fnox exec -- npm start
# Enable shell integration (auto-load on cd)
eval "$(fnox activate bash)" # or zsh, fish — see docs for Nushell
What is fnox?
fnox lets you store secrets in two ways:
Encrypted in git - Using age, AWS KMS, Azure KMS, or GCP KMS
Remote in cloud - Using AWS Secrets Manager, AWS Parameter Store, Azure Key Vault, GCP Secret Manager, 1Password, Bitwarden, Bitwarden Secrets Manager, Infisical, or HashiCorp Vault
Your fnox.toml config file either contains encrypted secrets or references to remote secrets. Use fnox exec to run commands with secrets loaded, or enable shell integration to auto-load secrets when you cd into a directory.
Supported Providers
🔐 Encryption (secrets in git, encrypted)
age - Modern encryption (works with SSH keys!)
aws-kms - AWS Key Management Service
azure-kms - Azure Key Vault encryption
gcp-kms - Google Cloud KMS
☁️ Cloud Secret Storage (remote, centralized)
aws-ps - AWS Parameter Store
aws-sm - AWS Secrets Manager
azure-ac - Azure App Configuration
azure-sm - Azure Key Vault Secrets
gcp-sm - Google Cloud Secret Manager
bitwarden-sm - Bitwarden Secrets Manager
vault - HashiCorp Vault
doppler - Doppler
🔑 Password Managers & Secret Services
1password - 1Password CLI
bitwarden - Bitwarden/Vaultwarden
infisical - Infisical secrets management
proton-pass - Proton Pass CLI
💻 Local Storage
keychain - OS Keychain (macOS/Windows/Linux)
keepass - KeePass database files (.kdbx)
password-store - GPG-encrypted password store (Unix pass)
plain - Plain text (for defaults only!)
Documentation
📚 Complete Documentation
Quick Links
Installation
Quick Start Guide
How It Works
Shell Integration
Providers Overview
Real-World Example
Provider Guides
Age Encryption - Simple, free, works with SSH keys
AWS Parameter Store - Simple, cost-effective AWS secret storage
1Password - Integrate with 1Password CLI
Bitwarden - Open source password manager
View all providers →
Reference
CLI Reference
Environment Variables
Configuration File
Example
# fnox.toml
[providers]
age = { type = "age", recipients = ["age1ql3z7hjy54pw3hyww5ayyfg7zqgvc7w3j2elw8zmrj2kg5sfn9aqmcac8p"] }
[secrets]
# Development secrets (encrypted in git)
DATABASE_URL = { provider = "age", value = "YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNjcnlwdC..." } # ← encrypted, safe to commit
API_KEY = { default = "dev-key-12345" } # ← plain default for local dev
[profiles.production.providers]
aws = { type = "aws-sm", region = "us-east-1", prefix = "myapp/" }
[profiles.production.secrets]
DATABASE_URL = { provider = "aws", value = "database-url" } # ← reference to AWS secret
# Development (uses encrypted secrets)
fnox exec -- npm start
# Production (uses AWS Secrets Manager)
fnox exec --profile production -- ./deploy.sh
Why fnox?
Flexible - Mix and match encryption and cloud providers
Team-friendly - Encrypted secrets in git, everyone can decrypt
Multi-environment - Different providers for dev, staging, prod
Shell integration - Auto-load secrets on directory change
Developer-focused - Simple config, powerful features
No vendor lock-in - Switch providers anytime
Installation
Using mise (recommended)
mise use -g fnox
Using Cargo
cargo install fnox
From Source
git clone https://github.com/jdx/fnox
cd fnox
cargo install --path .
Development
See CLAUDE.md for development guidelines.
# Build
mise run build
# Run tests
mise run test
# Run specific tests
mise run test:cargo
mise run test:bats
# Lint
mise run lint
# Full CI check
mise run ci
The most recent commit recorded on jdx/fnox was 12 days ago, based on the GitHub push timestamp. The repository has 98 forks — one of the better signals of community interest.
How many stars does jdx/fnox have?
jdx/fnox has 2.0k GitHub stars — refresh the page for the live number, or check github.com/jdx/fnox. TopGit mirrors GitHub's count but does not claim minute-by-minute accuracy.
Is jdx/fnox open source?
Yes — jdx/fnox ships under the MIT license, which makes its source code freely readable (and, depending on license terms, forkable and reusable). Source: github.com/jdx/fnox.
What is jdx/fnox?
jdx/fnox (jdx/fnox) is a Rust project on GitHub. From the project's own README: encrypted/remote secret manager
Where do I read more about jdx/fnox?
This TopGit page is a snapshot — the READ ME tab shows the project's own README content (links stripped, images preserved). The GitHub repository at github.com/jdx/fnox is the definitive source.
Read full README in the tab above.
Still deciding about fnox?
One click hands the question to an AI along with this page — see what it says about fnox.
/fnox
