Secrets Management

Vault36.5k★

Vault is the industry standard for managing secrets: API keys, database passwords, encryption keys, anything that should not live in a config file or an environment variable. It stores secrets, controls who can read them, rotates them automatically, and logs every access. It is also not open source anymore. HashiCorp moved Vault from MPL to the Business Source License in 2023, and IBM, which closed its HashiCorp acquisition in February 2025, is now the named licensor. You can self-host it free for your own use. You cannot offer it to third parties on a hosted or embedded basis to compete with IBM's paid versions, and that includes paid support arrangements. Each release converts to MPL 2.0 four years after it ships. High availability, auth methods, policies, and the unseal process all take real infrastructure knowledge. Solo and small teams: self-host the free binary if you have the ops muscle, or look at Infisical/infisical for something simpler. Managed means HCP Vault Dedicated. A Development cluster starts at $0.62 an hour, about $450 a month running full time, capped at 25 clients with no SLA. Production tiers start at $1.58 an hour plus $73 a month per Vault client. The catch is the license and the owner. You are depending on source-available software run by IBM. OpenBao, the MPL 2.0 fork under the Linux Foundation, exists for anyone who wants a guaranteed-open future.

Infisical30.3k★

Infisical replaces the .env file that gets passed around in Slack: one central store for API keys, database passwords and tokens, scoped per environment, with a CLI that injects secrets into your process and syncs that push them to GitHub, Vercel and AWS. The core is MIT and free to self-host. It now also covers certificates, privileged access and a credential proxy for AI agents. Self-hosting is Docker plus Postgres plus Redis, and Redis is not a throwaway cache: it holds the job queue for rotations and syncs, so back it up like the database. Store the ENCRYPTION_KEY off that box. Cloud Free gives you 5 identities and 3 environments, with no access controls, SSO or audit logs. Pro is $20 per identity per month billed annually ($23 monthly); Advanced is $40 ($46) for dynamic secrets and custom roles. Self-hosted SSO needs a license key from sales (no public price). Solo and small teams: free. Medium: Pro. Large: Enterprise. The catch: an identity is any human or machine. Every CI pipeline and service that pulls a secret is billable, and the 5 free identities vanish once you upgrade. Count your machines before comparing this to HashiCorp Vault or Doppler.

SOPS23.6k★

SOPS encrypts the values in your config files and leaves the keys readable, so secrets can live in git next to your code. You can see a file has a database_password field, but the value is gibberish until someone with the key decrypts it. MPL-2.0, free, and a CNCF sandbox project. There's no server to run. It's a single binary that handles YAML, JSON, ENV, INI and binary files, and encrypts with AWS KMS, GCP KMS, Azure Key Vault, HuaweiCloud KMS, HashiCorp Vault or OpenBao, age, or PGP. sops edit secrets.yaml decrypts in your editor and re-encrypts on save. Field names stay plain, so a git diff shows which secret changed even when you can't read it. The only cost is the key service you pick. age and PGP are $0. AWS KMS is $1/mo per key, and a small team stays inside the 20,000 free requests a month. Solo: use it with age. Small teams: use a cloud KMS so nobody's laptop holds the only key. Larger teams: keep it for config in git, and add Vault, OpenBao or Infisical (Infisical/infisical) when apps need secrets at runtime. The catch: SOPS stores static secrets. It doesn't issue short-lived credentials or rotate them, and access is per file, not per secret. It can log decryptions to Postgres, but that's opt-in plumbing, not a dashboard. Lose your only key and the secrets are gone, so encrypt to more than one recipient.

teller3.2k★

Teller unifies them behind one CLI and one config file. It's a secrets multiplexer. Map your environment variables to any combination of secret stores, and Teller fetches them at runtime. teller run, node app.js injects secrets into your process without them ever touching disk. It also syncs between providers: pull from Vault, push to AWS, or vice versa. Apache 2.0, written in Rust. No paid tier, no cloud version. The catch: Teller solves a real problem but it's a niche one. If you only use one secrets manager, you don't need it. Just use that provider's SDK. The value shows up when you have secrets scattered across 3+ providers and need one workflow. The community is small and the tool is emerging. Don't bet critical infrastructure on it without evaluating the bus factor. For a more established approach, look at how Infisical or HashiCorp Vault handle multi-source aggregation.