Comparison
UnENVerse is for people who run their own software: developers, homelab owners and small teams. This page compares kinds of tool, not named products, and only on things this project can verify about itself.
| Plain .env files | A password manager | A hosted secrets service | UnENVerse | |
|---|---|---|---|---|
| Where the secrets live | Files, often copied around | The vendor's or your own vault | The provider's cloud | One encrypted vault on your own machine or server |
| Encryption at rest | None | Yes | Yes | SQLCipher, key from Argon2id |
| Feeds a config file or a running process | Is the file | Usually copy and paste | Through its agent or SDK | Renders env files, compose, nginx and more from references; unv exec injects into a process |
| Can a script or AI agent use a secret without seeing it | No | Rarely | Sometimes | Yes: redacted by default, values only into the file or process you name |
| People and permissions | None | Sharing | Policies | Users, classes and permission expressions on unv-server |
| Needs an account or a subscription | No | Often | Yes | No. Free and open source |
| Works offline | Yes | Varies | No | Yes, local first |
| Audit trail | None | Varies | Yes | Hash-chained log checked by unv doctor |
What UnENVerse is not
- Not a hosted service: nobody runs it for you, and there is no account to recover a lost master password with.
- Not a replacement for a team-scale identity platform. Permissions exist, but a single maintainer wrote them and no outside audit has certified them. See the security page for what has and has not been reviewed.
- Not on macOS releases yet. See Install.
Questions this page does not answer are in the FAQ.