The best Secrets management
Every option ranked — open-source, self-hostable, and commercial — by our transparent Sovereignty Score, with honest trade-offs so you choose what fits you, not us.
Where API keys, database passwords and certificates live, who can read them, and what happens when one leaks. The category that changed most when HashiCorp changed its licence.
L3Infrastructure — layer 3 of the AI stack- 1
OpenBao
Top pickOpen sourceVault before the licence changed — forked, MPL-2.0, run by a foundation.
Free and open source. You run it on your own infrastructure. · in our HashiCorp Vault comparison →
What is OpenBao? →94sovereignty - 2
SOPS
Open sourceEncrypt secrets into the repo. No server to run at all.
Free and open source. No server, so no hosting cost either. · in our HashiCorp Vault comparison →
What is SOPS? →96sovereignty - 3
Infisical
Open sourceSecrets management that a developer can actually use on day one.
Free and self-hostable for the MIT core; hosted plans and enterprise features are paid. · in our HashiCorp Vault comparison →
What is Infisical? →84sovereignty - 4
Doppler
CommercialHosted secrets with the polish, if you would rather not run one.
Free tier for individuals and small teams; paid team plans per seat per month. · in our HashiCorp Vault comparison →
What is Doppler? →42sovereignty - 5
AWS Secrets Manager
CommercialThe obvious answer if everything already runs in AWS.
Roughly $0.40 per secret per month plus a small per-10,000-API-call charge. Rates checked 2026-07-31. · in our HashiCorp Vault comparison →
What is AWS Secrets Manager? →35sovereignty
Run these yourself
What each one actually needs — real RAM, honest running cost, and the setup time nobody quotes.
Replacing a specific tool?
Head-to-head comparisons for each popular secrets management product.
Straight head-to-heads
Two secrets management tools, side by side — verified facts and a plain verdict.