Comparison to mozilla sops

[rburgstaller]

Hey there, I am considering varlock but it seems that mozilla sops serves a similar purpose. It would be cool to see a comparison with pros and cons for each solution. The elephant in the room obviously is that sops has been around for a long time.

[philmillman]

There is definitely crossover between the two. This will become blurrier when we add first party encryption (coming soon) and support for other similar encryption libraries (#345 for example).

That said, I don't think they're mutually exclusive, especially right now. You can certainly load values from sops and use them with varlock. A basic example would be something like:

# @sensitive
DATABASE_URL=exec('sops -d .env.encrypted | grep DATABASE_URL')

We could potentially add a sops plugin, but IIRC @theoephraim had some thoughts about whether or not that made sense.

Here's a basic comparison as it stands today. This will change when we add native encryption support.

	SOPS	Varlock
Primary use case	Store encrypted secrets in git	Manage env config with validation, types, and external providers
Where secrets live	Encrypted in version control	Secret managers (1Password, AWS, etc.) or gitignored local files
Schema & validation	None	Declarative schema with types, validation, various flags
Type safety	None	Generated types, IntelliSense
AI / agents	Encrypted content is opaque	Schema is readable; AI gets context without secret values
Secret sources	Encrypted files you decrypt	Plugins for popular providers
Integration	User's responsibility	Supports popular JS frameworks (Vite, Next, etc)
Environments	User's responsibility (mise is a popular combo)	First-class support

---

I'm not a sops user, so take this with a grain of salt. I think there's lots of opportunity here for some complementary uses or interop, especially now that we have plugins for a lot of the major cloud providers that sops supports for KMS.