NoxKey vs dotenv

dotenv made environment variables easy. It also left every secret on your machine in plaintext with zero authentication. Here's what's different.

Feature	NoxKey	dotenv
Storage	macOS Keychain (hardware encrypted)	Plaintext .env file on disk
Encryption	AES-256 (Secure Enclave)	None
Authentication	Touch ID on every access	None — any process can read
Git safety	Not a file — can't be committed	Relies on .gitignore (frequently fails)
AI agent exposure	Encrypted handoff — value never in context	Fully readable by any agent
Shell history	Never appears	Visible if echoed or logged
Rotation support	Guided rotation	Manual find-and-replace
Peek without exposing	First 8 chars only	View exposes entire value
Price	Free (MIT open source)	Free
Setup	brew install no-box-dev/noxkey/noxkey	npm install dotenv

How NoxKey replaces dotenv in your workflow

The old way:

1. Create .env file → 2. Add to .gitignore (hope it works) → 3. Load with require('dotenv').config() → 4. Access via process.env.KEY

The NoxKey way:

1. noxkey set myorg/KEY --clipboard → 2. Touch ID → Done. Access with eval "$(noxkey get myorg/KEY)"

When to keep using dotenv

• Non-sensitive config — feature flags, port numbers, and other non-secret values are fine in .env
• Cross-platform teams — if your team uses Linux and Windows, NoxKey won't work (macOS only)
• CI/CD environments — use your CI provider's secret management; NoxKey is for local development