#1★ TOP PICK
OpenBao
Vault before the licence changed — forked, MPL-2.0, run by a foundation.
94
OPEN SOURCEMPL-2.0SELF-HOSTLOCAL-FIRST
OpenBao is the Linux Foundation's fork of Vault, taken from the last release before the Business Source License and continued under MPL-2.0. It is not a reimplementation or a lookalike: it is the same codebase, so the API, the CLI, the policy language and the storage format are Vault's, and migration is closer to a rename than a port. Governance is the whole point — it sits under a foundation with multiple corporate contributors rather than a single vendor who can change the terms again. Around 6.9k stars and actively developed. If your reason for looking is the licence rather than the product, this is the answer and there is not much more to decide.
Strengths
- +The same codebase — migration from Vault is close to drop-in
- +MPL-2.0 under Linux Foundation governance, not a single vendor's discretion
- +Keeps Vault's dynamic secrets, PKI and transit engines
- +Existing Vault knowledge, tooling and Terraform providers transfer directly
Trade-offs
- −Inherits Vault's operational difficulty in full — this is not the easy option
- −Smaller community than Vault, and the ecosystem is still catching up
- −No enterprise namespaces or vendor support contract
- −Divergence from upstream Vault will grow over time
Free and open source. You run it on your own infrastructure. #2
SOPS
Encrypt secrets into the repo. No server to run at all.
96
OPEN SOURCEMPL-2.0SELF-HOSTLOCAL-FIRST
SOPS takes the opposite approach: rather than a service that hands out secrets, it encrypts the values inside YAML, JSON or ENV files so the file itself is safe to commit, with keys held in AWS KMS, GCP KMS, Azure Key Vault, age or PGP. Structure stays readable, values are ciphertext, and diffs still work. There is no server, no high availability to design, and nothing to page anyone about at 3am. Originally Mozilla's, now a CNCF project under MPL-2.0 with about 22.6k stars. It is the right answer far more often than its simplicity suggests — and the wrong one the moment you need rotation, revocation or an audit trail.
Strengths
- +No service to run, scale, back up or monitor — the operational cost is zero
- +Secrets live in Git with real diffs and full history
- +CNCF-governed under MPL-2.0
- +Works with cloud KMS, age or PGP for key custody
Trade-offs
- −No dynamic secrets, no automatic rotation, no revocation
- −Audit trail is your Git history and your KMS logs, nothing more
- −Rotating a leaked secret means a commit and a redeploy
- −Not a fit for large teams needing fine-grained runtime access control
Free and open source. No server, so no hosting cost either. #3
Infisical
Secrets management that a developer can actually use on day one.
84
OPEN SOURCEMIT core, with an `ee/` enterprise directory carve-outSELF-HOSTLOCAL-FIRST
Infisical was built on the premise that Vault is too hard for what most teams need, and it shows: a clean web UI, a CLI that injects secrets into a process without writing them to disk, native Kubernetes and GitHub Actions integrations, and secret scanning to catch leaks before they are committed. It covers the common ninety per cent — storage, rotation, environment scoping, access control — without the unsealing ceremony. Around 28.5k stars. One precision worth stating: the core is MIT, but everything under the `ee/` directory is licensed separately as enterprise, so check which side of that line the feature you need falls on before you build around it.
Strengths
- +By far the best developer experience in this comparison
- +CLI injects secrets into a process without touching the filesystem
- +Built-in secret scanning catches leaks before they ship
- +Self-hostable, with Kubernetes and CI integrations that work out of the box
Trade-offs
- −Enterprise features live behind an `ee/` carve-out — not a pure MIT product
- −No equivalent of Vault's dynamic database credentials or PKI engine
- −Single-vendor governance, the same structural risk that moved Vault to BSL
- −Younger, with a shorter track record under real load
Free and self-hostable for the MIT core; hosted plans and enterprise features are paid. #4
Doppler
Hosted secrets with the polish, if you would rather not run one.
42
SOURCE-AVAILABLEProprietary (hosted service)
Doppler is a fully managed secrets platform: a good UI, wide integration coverage across cloud providers and CI systems, environment and branch scoping, and automatic rotation for common backends. It is proprietary and hosted, which is the honest trade — you are exchanging the operational burden for a dependency on someone else's uptime and pricing. Included here because for a small team with no platform engineer, a managed service they will actually configure correctly beats a self-hosted one they will misconfigure, and pretending otherwise would not serve the reader.
Strengths
- +Nothing to operate — no unsealing, no HA design, no upgrades
- +Broad integrations across clouds, CI systems and frameworks
- +Clean UI that non-platform engineers can use without training
- +Automatic rotation for common backends
Trade-offs
- −Proprietary and hosted — your secrets sit in someone else's system
- −No self-host option at any price
- −Per-seat pricing grows with the team rather than with usage
- −You inherit their pricing decisions, exactly as Vault users inherited HashiCorp's
Free tier for individuals and small teams; paid team plans per seat per month. #5
AWS Secrets Manager
The obvious answer if everything already runs in AWS.
35
SOURCE-AVAILABLEProprietary (hosted service)
If your workloads are on AWS, Secrets Manager is already available, already inside your IAM boundary, and already covered by your compliance paperwork. It does rotation with Lambda, integrates natively with RDS, ECS and EKS, and requires no new infrastructure of any kind. It is priced per secret per month plus API calls, which is cheap for dozens of secrets and less cheap for thousands. The obvious limitation is the obvious one: it is AWS-only, so a multi-cloud estate ends up running something else alongside it, which defeats the point of a central secrets store.
Strengths
- +Already inside your existing IAM, VPC and compliance envelope
- +Native rotation with RDS, Redshift and DocumentDB
- +Zero infrastructure to run or patch
- +Cheap at small secret counts
Trade-offs
- −AWS-only — useless as a central store in a multi-cloud estate
- −Per-secret pricing adds up quickly at scale
- −Far less capable than Vault for dynamic credentials and PKI
- −Deepens AWS lock-in rather than reducing it
Roughly $0.40 per secret per month plus a small per-10,000-API-call charge. Rates checked 2026-07-31.