Secrets Management

Vault36.3k★

Vault is the industry standard for managing secrets: API keys, database passwords, encryption keys, anything that should not live in a config file or an environment variable. It stores secrets, controls who can read them, rotates them automatically, and logs every access. It is also not open source anymore. HashiCorp moved Vault from MPL to the Business Source License in 2023, and IBM, which closed its HashiCorp acquisition in February 2025, is now the named licensor. You can self-host it free for your own use. You cannot offer it to third parties on a hosted or embedded basis to compete with IBM's paid versions, and that includes paid support arrangements. Each release converts to MPL 2.0 four years after it ships. High availability, auth methods, policies, and the unseal process all take real infrastructure knowledge. Solo and small teams: self-host the free binary if you have the ops muscle, or look at Infisical/infisical for something simpler. Managed means HCP Vault Dedicated. A Development cluster starts at $0.62 an hour, about $450 a month running full time, capped at 25 clients with no SLA. Production tiers start at $1.58 an hour plus $73 a month per Vault client. The catch is the license and the owner. You are depending on source-available software run by IBM. OpenBao, the MPL 2.0 fork under the Linux Foundation, exists for anyone who wants a guaranteed-open future.

Infisical29.4k★

Infisical holds the secrets your apps need at runtime: API keys, database passwords, tokens. Instead of a .env file getting passed around in Slack, you get a central store with per-environment scoping, a CLI that injects secrets straight into your process, and integrations that push them into GitHub Actions, Vercel, or Kubernetes. Self-hosting means Docker, Postgres, and Redis, plus a real plan for backing up the encryption keys, because losing those means losing every secret you have. It is worth being precise about what "open source" covers: everything outside the ee/ directory is MIT, and ee/ holds the enterprise pieces under a separate commercial license. Self-hosting the free build does not hand you the gated features. The cloud free tier caps at five identities and three environments, with no SSO, no RBAC, no audit logs, and no secret rotation. Pro is $20 per identity per month on annual billing, $23 monthly. Advanced is $40 and adds dynamic secrets and MFA enforcement. Solo developers and small teams fit inside the free tier or self-host comfortably. Cross five people or need an audit trail and the math moves quickly: ten identities on Pro is $200 a month. The catch is that per-identity pricing counts machine identities, not just humans. Every CI runner and every service that pulls a secret is billable. Count those before you compare this to HashiCorp Vault or Doppler, because that number is what actually decides it.

SOPS23.1k★

SOPS encrypts secret values in your config files while leaving field names in plain text, so you can safely store secrets in git. You can see that a file has a database_password field, but the value is encrypted gibberish until you decrypt it. This is elegant because your secrets live in version control alongside your code. No separate secrets server, no external service, no extra infrastructure. The encrypted files are diffable in git. You can see that someone changed the database password even though you can't read the new value. SOPS supports AWS KMS, GCP KMS, Azure Key Vault, HashiCorp Vault, and age (a simple file-based key) for encryption. It works with YAML, JSON, ENV, and INI files. The workflow: edit the file with sops secrets.yaml, it decrypts in your editor, you make changes, it re-encrypts on save. The catch: SOPS is for storing secrets, not managing access to them. There's no audit log of who accessed what, no dynamic credential rotation, no fine-grained permissions. For a team of 3 sharing a dozen secrets, SOPS is perfect. For a team of 50 with compliance requirements, you need Vault. Also, key management is on you; if you lose your encryption key and don't have KMS, your secrets are gone forever.

teller3.2k★

Teller unifies them behind one CLI and one config file. It's a secrets multiplexer. Map your environment variables to any combination of secret stores, and Teller fetches them at runtime. teller run, node app.js injects secrets into your process without them ever touching disk. It also syncs between providers: pull from Vault, push to AWS, or vice versa. Apache 2.0, written in Rust. No paid tier, no cloud version. The catch: Teller solves a real problem but it's a niche one. If you only use one secrets manager, you don't need it. Just use that provider's SDK. The value shows up when you have secrets scattered across 3+ providers and need one workflow. The community is small and the tool is emerging. Don't bet critical infrastructure on it without evaluating the bus factor. For a more established approach, look at how Infisical or HashiCorp Vault handle multi-source aggregation.