Identity and Access
Secrets management tools that keep the key out of git (2026)
A 2026 shortlist of stores and envelopes for keys you already own. Public docs, not a loot tutorial.
Expertise: Identity and Access · Level: Intermediate · 12 min read
A scanner without a store is a weekly incident.
The scan found the key. Someone still has to put the next one somewhere that is not a fixture. Secrets management is that shelf. Link secret scanning for the leak. This page is the store.
Six stores. One known vault. One open fork. One git envelope. Two developer SaaS shelves. One cloud manager. Public docs. Not a bake-off.
Technical check: we cross-check first-party product pages, public licenses, and live documentation. Rank is a technical recommendation, not a recap of other lists, and not a lab bake-off.
| Tool | Best for | License |
|---|---|---|
| HashiCorp Vault | Known open-core secret store | BSL / commercial |
| OpenBao | Open Vault-shaped API you can still fork | MPL-2.0 |
| SOPS | Encrypt the file you already commit | MPL-2.0 |
| Infisical | Developer-shaped secret SaaS you can also host | MIT (core) / commercial |
| AWS Secrets Manager | The button if the app already runs on AWS | AWS terms |
| Doppler | Developer SaaS for env sync | Commercial |
HashiCorp Vault
Best for known open-core secret store
Vault is the name people already wrote down. Dynamic secrets, leases, many auth methods. The license is not Apache.
Key features
- Dynamic secrets they document
- Many auth methods
- You can host it
- HCP if you will not
Why we like it
When the question is a lease, not a dotenv, this is the known shelf.
Limits
BSL. You staff it or you buy HCP. We did not run a cluster.
OpenBao
Best for open Vault-shaped API you can still fork
OpenBao is the Linux Foundation fork of Vault. Same shape of API. MPL-2.0. Younger operator memory than Vault.
Key features
- Vault-shaped API
- MPL-2.0
- You operate it
- LF stewardship
Why we like it
This is the hidden gem if the hole is the license, not the API.
Limits
Younger ecosystem. You still staff the box. Not a dotenv SaaS.
SOPS
Best for encrypt the file you already commit
SOPS encrypts YAML, JSON, and dotenv in place. KMS, age, or PGP unlocks it. The file stays in git.
Key features
- In-place encrypt
- age, KMS, PGP
- CI decrypt
- You keep the files
Why we like it
When the secret is a file the chart already mounts, an envelope is the honest control.
Limits
Not a dynamic lease. Key ceremony is yours. A decrypted leftover is still a leak.
Infisical
Best for developer-shaped secret SaaS you can also host
Infisical sells folders of secrets for apps and humans. Open core you can host. Cloud if you will not.
Key features
- Projects and folders
- Self-host or cloud
- CLI and SDKs
- Open core
Why we like it
Teams that hated Vault’s ceremony land here. Treat it as a store, not as scanning.
Limits
You still rotate. Cloud is a vendor. We did not run a tenant.
AWS Secrets Manager
Best for the button if the app already runs on AWS
Managed secrets with rotation hooks they document. IAM is the lock. Price is per secret per month.
Key features
- IAM lock
- Rotation they document
- Same account as the app
- AWS APIs
Why we like it
Honesty. If the compute is already AWS, a second vault is often vanity.
Limits
AWS-only. Cost at scale. Parameter Store is the cheaper sibling you should name.
Doppler
Best for developer SaaS for env sync
Doppler syncs secrets into the places developers already run. The pitch is fewer dotenv files in chat.
Key features
- Project configs
- Sync to clouds they list
- CLI
- Commercial
Why we like it
When the hole is a Slack paste, a sync tool is the job. Link scanning for the history.
Limits
Commercial. You still need a source of truth. We did not run it.
What the internet thinks about secrets management
Vault threads treat ceremony as the tax. SOPS threads treat the file as enough. Name which hole you actually have.
totallywrong on Hacker News, Dec 2023: “I just replaced a clunky secrets manager with Mozilla SOPS and secrets-in-code that we keep in git encrypted and can version like any other file.”
Prove SOPS still publishes
Confirm SOPS still publishes. Encrypt a fixture file you own. Do not commit the decrypted leftover.
git ls-remote --heads https://github.com/getsops/sops.gitFAQs
Does a store replace secret scanning?
No. The store holds the next key. Scanning finds the last one. Link both.
Is SOPS a vault?
No. It is an envelope around a file you already commit.
Vault or OpenBao?
Same shape of API. The license and the operator memory differ. Read both pages.
Is this a scored bake-off?
No. Order is editorial.
