Tene is a local-first, encrypted secret management CLI. It stores your API keys, tokens, and credentials in an encrypted SQLite vault on your device. No server, no signup, no cloud dependency.

How does Claude Code auto-detection work?

When you run tene init, it generates a CLAUDE.md file in your project root. Claude Code reads this file automatically and learns how to use tene to retrieve secrets.

Yes, Tene is 100% free and open source under the MIT license. All local features — encryption, runtime injection, multi-environment, AI editor rules — are free forever with no limits.

Will there be team features?

Team sync and collaboration features are being designed. The goal is encrypted team sync without a central server. Join the waitlist at tene.sh to get notified when it launches.

How are my secrets encrypted?

Tene uses XChaCha20-Poly1305 encryption with 256-bit keys derived from your master password via Argon2id. Each secret gets a unique 192-bit nonce.

Does Tene work offline?

Tene is 100% offline. It makes zero network calls. Your secrets are encrypted and stored locally in a SQLite database.

Can I self-host tene's team sync?

The CLI's team sync goes through app.tene.sh by default, with client-side encryption so the server never sees plaintext. Self-hosting the sync server is on the roadmap. In the meantime, you can use tene locally and Infisical server-side — they don't conflict.

Is tene open source like Infisical?

Yes, the entire CLI is MIT licensed at github.com/tomo-kay/tene. Infisical's core is MIT as well, but some enterprise features use the Infisical License. Both are auditable.

tene doesn't have RBAC (there's nothing to authorize on a local-only tool). If you need RBAC, use Infisical server-side and tene only for developer-machine runtime safety.

How does tene handle dynamic secrets (DB credentials with short TTL)?

tene is optimized for long-lived developer secrets (API keys, OpenAI tokens, webhook keys). For short-TTL dynamic secrets, Infisical or HashiCorp Vault are the right tools.

Comparison

tene vs Infisical

Infisical needs a server (self-hosted or SaaS). tene runs on your machine. Same encryption guarantees, completely different ops surface.

Star on GitHub

Infisical is a solid open-source secret manager — but it is a server-side product. You either run their hosted SaaS or self-host the PostgreSQL-backed service. Either way, there's infrastructure to manage, a web dashboard to secure, and a user database to worry about.

tene takes a different approach: the secret manager is the CLI. There is no server. There is no database. The vault is a SQLite file on your machine encrypted with XChaCha20-Poly1305. You get the same encryption-at-rest guarantee as Infisical, without the ops overhead or the signup.

Where Infisical shines

Infisical's workspaces, approval flows, and dashboard are excellent for teams that want governance over secrets. Their integrations (k8s, Vercel, Terraform) and SDK are first-class. For a company of 20+ engineers with compliance requirements, Infisical is a better fit than tene.

Side-by-side

Feature-by-feature comparison. Every row is sourced from the official docs of each product — if you find something stale, open an issue.

Dimension	tene	Infisical
Architecture	CLI + local SQLite vault (no server)	Server + PostgreSQL + web dashboard (self-hosted or SaaS)
Deployment	Single Go binary	Docker Compose / Kubernetes / managed SaaS
AI-editor integration	Auto-generates rules for Claude, Cursor, Windsurf, Gemini, Codex	None
Encryption at rest	XChaCha20-Poly1305 + Argon2id KDF	AES-256 (server-side, with KMS on hosted)
Signup required	No (CLI is fully local)	Yes (for hosted); not for self-hosted
Runtime injection	`tene run -- <cmd>`	`infisical run -- <cmd>` (similar)
Open source license	MIT	MIT (core) + Infisical License (enterprise features)
Team sync	Optional E2E sync (Pro at app.tene.sh)	Built-in (workspaces, RBAC, approval flows)
Offline usability	100% offline CLI	Requires connectivity to the Infisical server
Best for	Individual devs + small teams + AI-heavy workflows	Mid-to-large teams wanting a central dashboard + RBAC

Where tene shines

tene owns two niches Infisical doesn't serve: (1) individual developers who don't want to stand up or pay for a server, and (2) AI-editor workflows where the threat model is secret leakage through LLM context windows. tene's auto-generated rule files (CLAUDE.md, .cursor/rules/tene.mdc, .windsurfrules, GEMINI.md, AGENTS.md) teach every major AI editor to call `tene run --` instead of reading `.env`.

You can use both

tene and Infisical are complements. Use Infisical as the organization-wide source of truth, and `infisical export | tene import` on developer machines so local workflows pick up AI-editor safety without losing the team's central dashboard. `tene run --` then becomes the local runtime wrapper that keeps secrets out of LLM context.

Migrate from Infisical to tene

Export Infisical secrets as .env, then import into tene. Infisical stays available for rollback.

Export secrets from Infisical

$ infisical export --format dotenv > .env

Install tene

$ curl -sSfL https://tene.sh/install.sh | sh

3
Initialize a local vault
```
$ tene init
```
4
Import the .env
```
$ tene import .env
```
5
Delete the plaintext export
```
$ rm .env
```
6
Run your app through tene
```
$ tene run -- npm start
```

After migration: If your team depends on Infisical's dashboard + RBAC, keep Infisical as the shared source and use tene just for local developer runtime + AI-editor safety. The two are complementary — tene doesn't try to replace server-side workspaces.

FAQ

Can I self-host tene's team sync?: The CLI's team sync goes through app.tene.sh by default, with client-side encryption so the server never sees plaintext. Self-hosting the sync server is on the roadmap. In the meantime, you can use tene locally and Infisical server-side — they don't conflict.
Is tene open source like Infisical?: Yes, the entire CLI is MIT licensed at github.com/tomo-kay/tene. Infisical's core is MIT as well, but some enterprise features use the Infisical License. Both are auditable.
What if I need RBAC?: tene doesn't have RBAC (there's nothing to authorize on a local-only tool). If you need RBAC, use Infisical server-side and tene only for developer-machine runtime safety.
How does tene handle dynamic secrets (DB credentials with short TTL)?: tene is optimized for long-lived developer secrets (API keys, OpenAI tokens, webhook keys). For short-TTL dynamic secrets, Infisical or HashiCorp Vault are the right tools.

Other comparisons

See how tene compares against every other major secret manager.