Phase: Open Source Secrets Management

What is Phase?

Phase is an open-source secrets management platform, written in TypeScript, that lets fast-moving engineering teams secure, deploy, and manage application secrets and environment variables from development through to production.

What it is

Phase is an open-source platform for managing application secrets and environment variables across environments, from development to production. It ships as a set of components: the Phase Console dashboard at console.phase.dev for creating, managing, and rotating secrets; the Phase CLI for importing, injecting, and exporting secrets; SDKs for Node, Python, and Golang; a REST API; a Helm Chart and Kubernetes Operator; and a Terraform Provider. Secret values are stored with end-to-end encryption, and access is governed by role-based and cryptographic access control on a per-application, per-environment basis.

The concrete thing it replaces is the spread of .env files, copied credentials, and per-platform secret stores that teams accumulate as they move from local development to CI and production. The CLI imports existing secrets from .env files, then injects them at runtime or into a sub-shell with phase shell, and secret sync pushes each value onward to GitHub, Cloudflare Pages, Vercel, GitLab CI, Railway, and AWS Secrets Manager, as well as into Kubernetes clusters. Instead of every environment holding its own drifting copy of a credential, one record is versioned in Phase.

Key capabilities

Phase CLI commands for the full secret lifecycle: phase auth, phase init, phase run, phase shell, and phase secrets list, get, create, update, delete, import, and export.
Import of existing secrets from .env files and export in dotenv format, so existing dotenv workflows keep working.
Secret management across environments with secret diffs, version history, and one-click restore of prior secret values.
Role-based, cryptographic access control, configurable per application and per environment.
Secret sync to third-party platforms including GitHub, Cloudflare Pages, Vercel, GitLab CI, Railway, and AWS Secrets Manager.
A Kubernetes integration that syncs secrets into a cluster and reloads deployments through the Phase Secrets Operator.
Secret referencing and overrides, which let an individual create personal secrets without affecting the rest of the team, and reference values across apps and environments.
A REST API for reading and managing secrets programmatically, plus audit logs covering changes and access events.

Who uses it and how

Engineering teams that keep separate secret sets for development, staging, and production, and need diffs and version history when a value changes.
DevOps groups that sync one source of truth into CI runners and hosting providers such as GitHub, GitLab CI, Vercel, Railway, and Cloudflare Pages.
Platform teams running Kubernetes, which use the Helm Chart and Secrets Operator to inject secrets and trigger deployment reloads.
Infrastructure teams managing secrets inside HashiCorp Terraform workflows through the Terraform Provider.
Developers and AI coding agents: the project's topics include claude, claude-code, codex, codex-cli, and opencode, and the repository describes itself as secrets management for teams and AI agents.

Getting started

The quickest documented path is Phase Cloud, following the Quickstart guide at docs.phase.dev/quickstart. The CLI is the main entry point for local work: authenticate with phase auth, link the project to a Phase app with phase init, then run the application with phase run.

How it compares

No list of paid products that Phase replaces is provided in the available facts, and no directly comparable secrets manager is named alongside it. On the facts available, Phase stands alone in this registry.

When to use it — and when not to

Self-hosting is offered, but the project's own documentation does not state in the supplied material which database, storage, or mail services a self-hoster must operate, so that cost should be confirmed before committing. The licence is listed as NOASSERTION, which means the terms are unclear from the registry metadata and should be checked directly before adoption in a commercial setting. Teams that only need a single .env file in one deployment, or that cannot accept an unclear licence, are better served elsewhere.

project readme (upstream, from github) — read inline

Repos

Open source platform for fast-moving engineering teams to secure and deploy application secrets — from development to production.

Phase Console Demo

	Features
📈	Phase Console: Dashboard for seamlessly creating, managing, rotating secrets, and environment variables
⌨️	CLI: Import existing secrets from `.env` files, and securely inject them in your application at runtime or create virtual shells with secrets
🤫	Secret management: Manage secrets across environments, view secret diffs, track version history, and restore secret values with a single click
🙋	Role-based Access Control: Fine-grained, role-based, and cryptographic access control, per application, per environment.
🔁	Secret sync: Automatically sync secrets to GitHub, Cloudflare Pages, Vercel, GitLab CI, Railway, AWS Secrets Manager, etc.
	Kubernetes: Automatically sync secrets to your Kubernetes Cluster and reload deployments via the Phase Secrets Operator
	Terraform: Manage secrets in your HashiCorp Terraform Iac workflows.
⛓️	Secret referencing & overrides: Create personal secrets without affecting others on the team. Reference secret values across apps and environments
🌐	REST API: Access and manage secrets programmatically with any http client
📦	SDKs: SDKs for integrating Phase with various programming languages and frameworks
🥡	Self Hosting: Run Phase on your own infrastructure
🔍	Audit Logs: Complete visibility into every change and access event

Explore Phase Console

CLI

λ phase --help
Securely manage application secrets and environment variables with Phase.

           /$$
          | $$
  /$$$$$$ | $$$$$$$   /$$$$$$   /$$$$$$$  /$$$$$$
 /$$__  $$| $$__  $$ |____  $$ /$$_____/ /$$__  $$
| $$  \ $$| $$  \ $$  /$$$$$$$|  $$$$$$ | $$$$$$$$
| $$  | $$| $$  | $$ /$$__  $$ \____  $$| $$_____/
| $$$$$$$/| $$  | $$|  $$$$$$$ /$$$$$$$/|  $$$$$$$
| $$____/ |__/  |__/ \_______/|_______/  \_______/
| $$
|__/

options:
  -h, --help   show this help message and exit
  --version, -v
               show program's version number and exit
Commands:

    auth             💻 Authenticate with Phase
    init             🔗 Link your project with your Phase app
    run              🚀 Run and inject secrets to your app
    shell            🐚 Launch a sub-shell with secrets as environment variables (BETA)
    secrets          🗝️ Manage your secrets
    secrets list     📇 List all the secrets
    secrets get      🔍 Get a specific secret by key
    secrets create   💳 Create a new secret
    secrets update   📝 Update an existing secret
    secrets delete   🗑️ Delete a secret
    secrets import   📩 Import secrets from a .env file
    secrets export   🥡 Export secrets in a dotenv format
    users            👥 Manage users and accounts
    users whoami     🙋 See details of the current user
    users switch     🪄 Switch between Phase users, orgs and hosts
    users logout     🏃 Logout from phase-cli
    users keyring    🔐 Display information about the Phase keyring
    docs             📖 Open the Phase CLI Docs in your browser
    console          🖥️ Open the Phase Console in your browser
    update           🆙 Update the Phase CLI to the latest version

Explore Phase CLI

Getting started

Check out the Quickstart Guides

Use Phase Cloud

The quickest and most reliable way to get started is by signing up on the Phase Console.

Self-host Phase

Frequently asked questions

Is Phase free to use?

Phase is open source. There is no licence fee and no seat count — you can self-host it or, where the project offers one, pay a vendor for a managed version instead.

What does Phase do?

Secure, deploy, and manage application secrets effortlessly

What is Phase written in?

Phase is primarily written in TypeScript. Its source is publicly available at https://github.com/phasehq/console, and it has 923 GitHub stars.