Visibility in this ranking can be paid for. Payment moves a vendor's position within the
shortlist; it never adds a vendor, and it never changes a word of the review. The largest vendors in secrets management software
cannot hold places 1 to 3. Places 1 to 3 go to challengers, vendors outside the best-known brands in a category,
wherever the category has them; the established names follow from place 4 in their ranked order. How it works: placement disclosure ·
editorial process.
The 13 tools, reviewed
#1 Infisical
Open-core secrets platform for apps, pipelines and Kubernetes · United States · infisical.com
Open core Hosted or self-hosted Dynamic secrets
Infisical sits first because a small team can be productive on it in an afternoon and still has room to grow. The free plan covers five identities with unlimited projects, the paid tiers are listed with numbers, and Pro adds rotation, SAML SSO and point-in-time recovery. Dynamic secrets arrive on Advanced, approval workflows and SCIM on Enterprise.
- Pricing: Per identity / month. Free for 5 identities; Pro lists at $20 per identity per month billed annually, Advanced at $40, Enterprise by quote. Free plan: free plan.
- Best for: Startups and mid-sized engineering teams
- Strengths: Secret versioning; Point-in-time recovery; Secret rotation.
Where it falls short
Pricing counts every human and machine that authenticates, so a company with many pipelines pays for each one.
Wrong for
A team whose machine count is large and fixed, where a per-seat plan would be cheaper, or a buyer who needs hardware-backed key custody and a decades-old vendor, who should compare Vault or a cloud KMS.
Visit Infisical →
#2 Doppler
Hosted secrets manager with per-seat pricing · United States · doppler.com
Per-seat pricing Config syncs On-prem option
Doppler organizes secrets as projects, environments and configs, and a CLI that wraps your start command is enough to get a service running locally and in CI. The pricing page says AI agents and non-human identities are not charged, so cost follows people, not workloads. Team adds SAML SSO, change requests, rotation, service accounts and 90 days of activity logs.
- Pricing: Per user / month. Free for 3 users, $8 per extra user; Team lists at $21 per user per month; Enterprise by quote. Free plan: free plan.
- Best for: Small teams deploying to PaaS and CI
- Strengths: Environments and configs; Secrets referencing; Config inheritance.
Where it falls short
Dynamic secrets, SCIM, user groups, log forwarding and Enterprise Key Management sit on the custom-priced tier. Activity logs on the Developer plan last three days, and syncs are capped at 5 on that plan and 100 on Team.
Wrong for
A buyer who needs dynamic database credentials or open-source code they can fork, or a very large team where $21 per seat adds up.
Visit Doppler →
#3 Bitwarden Secrets Manager
Open-source, end-to-end encrypted secrets for DevOps teams · United States · bitwarden.com
Open source Zero-knowledge Self-hostable
Bitwarden prices secrets in a way a small team can predict: a modest per-user fee, with machine accounts included up to 20 on Teams and 50 on Enterprise, then $1 each. Values are end-to-end encrypted, the code is open source, and the server can run on your own infrastructure.
- Pricing: Per user / month. Free for 3 machine accounts; Teams lists at $6 per user per month, Enterprise at $12, with $1 per extra machine account. Free plan: free plan.
- Best for: Budget-minded teams already on Bitwarden
- Strengths: Projects; Machine accounts; Access tokens.
Where it falls short
The feature set is narrower than the specialists: the vendor describes support in the web app and CLI only, and we found no dynamic-secret engine on its pages.
Wrong for
A platform team that needs dynamic credentials, PKI or fine-grained policy.
Visit Bitwarden Secrets Manager →
#4 HashiCorp Vault
Identity-based secrets, PKI and encryption service · United States · hashicorp.com
Dynamic secrets Self-host or HCP Source-available
Vault covers more ground than any other product here: static secrets, dynamic credentials, certificates, identity management, and client authentication through tokens, LDAP and third-party providers such as Azure and AWS. Policies are path-based and audit devices record each request. It can be self-hosted or bought as HCP Vault Dedicated, which is Vault Enterprise operated by HashiCorp on AWS or Azure.
- Pricing: Quote only. Community edition is free to run; Enterprise and HCP Vault Dedicated are sold by the vendor, and we could not read published prices. Free plan: free plan.
- Best for: Platform teams with dynamic-secret needs
- Strengths: Static secrets engine; Dynamic secrets; Certificate management.
Where it falls short
Running it yourself means storage, unsealing, high availability and upgrade planning. From version 1.15 the source is under the Business Source License with IBM as licensor, which restricts competing hosted offers.
Wrong for
A small team without platform engineers, or a buyer who wants an open-source license in the strict sense.
Visit HashiCorp Vault →
#5 AWS Secrets Manager
AWS service for storing, retrieving and rotating credentials · United States · aws.amazon.com
AWS native Managed rotation Multi-region replicas
If your services already run on AWS, this is the shortest path: access is governed through IAM, many AWS services read from it directly, and rotation can be managed by the service with no Lambda function for supported secrets. Secrets can be replicated to other Regions, and a replica can be promoted to standalone.
- Pricing: Usage-based. Lists $0.40 per secret per month plus $0.05 per 10,000 API calls. Free plan: none.
- Best for: Teams running entirely on AWS
- Strengths: Automatic rotation; Managed rotation; Lambda rotation.
Where it falls short
The service is a store, not a cross-cloud platform: values live in AWS accounts and Regions, access is shaped by IAM, and non-AWS workloads need extra plumbing.
Wrong for
A multi-cloud company, a team that keeps secrets on laptops and non-AWS CI, or a firm that wants one vendor-neutral audit trail.
Visit AWS Secrets Manager →
#6 1Password
Secrets automation added to a password manager · Canada · 1password.com
Included with vault Service accounts Connect server
For a company where staff already use 1Password, secrets for pipelines can live next to employee vaults without a second vendor. The developer docs describe two paths: service accounts, which need no extra infrastructure but have rate limits and request quotas, and a self-hosted Connect server that caches values and removes those limits.
- Pricing: Per user / month. Secrets Automation is described as included with a 1Password subscription; see the vendor for business seat prices. Free plan: none.
- Best for: Companies already using 1Password
- Strengths: Service accounts; Connect server; CLI secret references.
Where it falls short
There is no dynamic-secret engine or rotation workflow on the pages we checked, and service accounts are rate-limited. The Connect server is something you host and keep available.
Wrong for
A platform team that needs rotation, dynamic credentials or policy-as-code, or a buyer who wants machine and human secrets in separate systems.
Visit 1Password →
#7 Akeyless
SaaS secrets, key and certificate platform with gateways · Israel · akeyless.io
SaaS vault Zero-knowledge gateway Multi-vault
Akeyless offers pure SaaS or a hybrid setup in which gateways inside your network hold part of the key so the vendor cannot decrypt on its own. Its pricing page defines the units precisely: clients, connectors to AWS, Azure, GCP, Kubernetes and Vault, certificates, and key-management transactions. The multi-vault governance module can sit over stores you already own.
- Pricing: Quote only. Starter tier available; paid plans priced per client, plus units for connectors and certificates, by quote. Free plan: free plan.
- Best for: Mid-sized firms wanting SaaS with local control
- Strengths: Static secrets; Dynamic secrets; Secret rotation.
Where it falls short
No numbers appear on the pricing page, and the meter has many units, so budgeting means a sales call and a reading of the true-up rules.
Wrong for
A small team that wants to see a price and sign up with a card, or one that prefers an open-source core.
Visit Akeyless →
#8 OpenBao
Open-source fork of Vault under OpenSSF · United States · openbao.org
Open source Vault API fork Self-hosted
OpenBao is a community project described as a fork of Vault managed by the Linux Foundation's OpenSSF, run under open governance. It carries the Vault model: tokens bound to path-based policies, dynamic secrets for systems such as Kubernetes and SQL databases, leases that expire, and audit devices. Its documentation is versioned, with release lines in the 2.x series.
- Pricing: Open source. Free open-source software; you pay for hosting and your own operations. Free plan: open source.
- Best for: Self-hosting teams wanting an open Vault
- Strengths: Key-value secrets; Dynamic secrets; Data encryption.
Where it falls short
There is no hosted offering or commercial contract from the project, so patching, backups, high availability and incident response are yours.
Wrong for
A team without platform engineers or one that needs a vendor with a support contract.
Visit OpenBao →
#9 Azure Key Vault
Azure service for secrets, keys and certificates · United States · azure.microsoft.com
Azure native HSM-backed tier Entra ID access
Microsoft describes Key Vault as a service for three jobs: secrets, keys and certificates. The Standard tier uses software validated to FIPS 140 Level 1, and the Premium tier uses HSM-protected keys on FIPS 140-3 Level 3 validated modules.
- Pricing: Usage-based. Standard and Premium tiers billed per 10,000 transactions plus certificate and key operations; the rates did not render on the pricing page. Free plan: none.
- Best for: Teams building on Azure and Entra ID
- Strengths: Secrets storage; Key management; Certificate management.
Where it falls short
The service is shaped around Azure resources, and the developer experience outside Azure is less direct. Teams juggle several vaults, access models and tiers, and per-transaction billing is hard to forecast without a calculator.
Wrong for
A company running mostly outside Azure, or one that wants one interface across clouds and CI systems.
Visit Azure Key Vault →
#10 Google Secret Manager
Google Cloud service for versioned secrets · United States · cloud.google.com
Google Cloud native Versioned secrets IAM access
Secret Manager does a small job cleanly. Secrets have versions, access goes through IAM, audit logging is built in, and customer-managed encryption keys are supported. The pricing page lists charges for active secret versions and per-10,000 access operations, with the first 10,000 operations free, so small estates cost little.
- Pricing: Usage-based. Lists active secret versions and access operations separately, with the first 10,000 access operations a month free. Free plan: free plan.
- Best for: Teams building on Google Cloud
- Strengths: Secret versions; IAM access control; Rotation schedules.
Where it falls short
Rotation does not change the credential for you, there is no dynamic-secret engine, and it works only inside Google Cloud projects. Non-Google workloads need federation and glue code.
Wrong for
A multi-cloud or on-premises team, or anyone who wants rotation done by the product.
Visit Google Secret Manager →
#11 Keeper Secrets Manager
Zero-knowledge secrets for DevOps inside Keeper · United States · keepersecurity.com
Zero-knowledge Keeper platform Cloud-based
Keeper describes its Secrets Manager as a fully cloud-based, zero-knowledge platform for non-human identities, infrastructure secrets, API keys and database passwords, with a CLI, SDKs and integrations for pipelines and containers. The Admin Console manages it beside the company's password manager and PAM product, and and the docs describe use in CI/CD pipelines, containers and automation scripts.
- Pricing: Quote only. Sold as part of the Keeper platform; the secrets manager price is not listed on the pages we read. Free plan: free trial.
- Best for: Existing Keeper customers adding machine secrets
- Strengths: Secrets Manager CLI; Developer SDKs; Integrations.
Where it falls short
Public pricing for the secrets product was not available to us, and the surrounding platform is oriented to PAM and password management.
Wrong for
A developer-led startup that wants a free tier and published prices, or a team that wants to fork the server.
Visit Keeper Secrets Manager →
#12 Pulumi ESC
Environments, secrets and configuration layer for cloud teams · United States · pulumi.com
Aggregates vaults OIDC credentials Usage-based
ESC lets a team compose environments from configuration and secrets pulled from AWS Secrets Manager, HashiCorp Vault, Azure Key Vault, 1Password and other sources, then hands the result to a CLI, an SDK, a Kubernetes operator or Pulumi programs. It issues short-lived cloud credentials through OIDC, and it is usable on its own without Pulumi IaC.
- Pricing: Per secret / month. 25 secrets free; Essentials $0.50 per secret per month, Pro $0.75, Enterprise $1.00, plus $0.10 per 10,000 API calls. Free plan: free plan.
- Best for: Pulumi users unifying several vaults
- Strengths: Environments; Secrets from other vaults; Dynamic cloud credentials via OIDC.
Where it falls short
Per-secret billing grows with the number of values, and the best-priced path is tied to the Pulumi account model with credits. Rotation and dynamic features vary by tier.
Wrong for
A team that has no existing vault and just wants one simple place for keys.
Visit Pulumi ESC →
#13 CyberArk Secrets Manager
Enterprise secrets vault for hybrid and multi-cloud workloads · Israel · cyberark.com
Enterprise PAM vendor SaaS or self-hosted Conjur OSS
CyberArk presents Secrets Manager as a vault and lifecycle service for credentials across cloud, on-premises and hybrid estates, available as SaaS or self-hosted, with a workload identity for each application. It belongs to a vendor with a long record in privileged access, now part of Palo Alto Networks, which matters to buyers who want secrets, PAM and reporting from one supplier.
- Pricing: Quote only. Quote only; deployable as SaaS or self-hosted. Free plan: none.
- Best for: Large regulated firms already using CyberArk
- Strengths: Centralized secrets storage; Secrets rotation; Workload identity.
Where it falls short
Procurement, deployment and licensing are enterprise-shaped, prices are not published, and a small team will carry more process than it needs.
Wrong for
A startup or small company that wants a card-and-go signup.
Visit CyberArk Secrets Manager →
Questions and answers
What is the best secrets management software in 2026?
Infisical ranks first of 13, best for startups and mid-sized engineering teams. Doppler is second (small teams deploying to PaaS and CI) and Bitwarden Secrets Manager third (budget-minded teams already on Bitwarden). Places 1 to 3 go to challengers, vendors outside the best-known brands, wherever the category has them.
Is a .env file ever acceptable for secrets?
For a laptop with throwaway development keys, yes, as long as the file is excluded from version control and holds nothing that reaches production.
Do we need HashiCorp Vault, or is it too much for a small team?
Vault is the most capable product here and also the one with the largest operating cost. Running it yourself means planning storage, unsealing, high availability, upgrades and token hygiene. Teams under about thirty engineers rarely have the spare time.
How is a secrets manager different from a business password manager?
A password manager stores logins that people type or autofill, and shares them between employees. A secrets manager stores credentials that software fetches by itself, with identities for machines, scoped tokens, rotation, and short-lived credentials.
Should we use our cloud provider's secret store or a cross-cloud product?
If more than ninety percent of your workloads run in one cloud and your engineers already use its identity system, the native store is the lower-effort choice, and the price per secret is small.
What does secrets management software cost for a team of ten?
It ranges from nothing to a few hundred dollars a month. Infisical, Doppler and Bitwarden all have free tiers for very small projects. Doppler's Team plan lists $21 per user per month, so ten people is about $210 before add-ons.
Can these tools rotate database passwords automatically?
Most can, but the mechanics differ. AWS Secrets Manager offers managed rotation or a Lambda function you maintain.
What are dynamic secrets and do we need them?
A dynamic secret is created when a service asks for it and expires on its own, for example a database user that exists for one hour. It limits the damage of a leak and removes the shared long-lived password.
How do we move from one secrets tool to another?
Plan for a staged move rather than a cutover. Export or bulk-read values through the old tool's API or CLI, load them into the new one, and run both in parallel while you switch services one at a time.
Is self-hosting a secrets manager worth the effort?
Only when a rule or a contract requires it. A self-hosted store becomes the most sensitive system you run: it needs backups, patching, monitoring, and a recovery plan that works when the platform itself is down.
Which secrets management tools work for AI coding agents?
Several vendors now describe controls for agents that need credentials. Bitwarden lists scoped, expiring tokens and an audit trail per agent. Doppler says AI agents and non-human identities are not charged as seats.
