Secrets management, in detail
Stop mailing .env files. The strategic fact of this category: HashiCorp is IBM-owned since Feb 2025 and Vault's 2023 BSL relicense spawned the OpenBao fork — licensing is now part of the comparison, alongside three very different billing units (per seat, per secret, per API call).
| Tool | Free tier | Entry price | Billing unit | Watch out for | Best for |
|---|---|---|---|---|---|
| Doppler | 3 users, 10 projects | Team $21/user/mo | Per seat | Per-seat cost rises fast for wide teams | SecretOps: env sync across envs, CI and clouds |
| Infisical | ~5 users; MIT core | Pro ~$18/user/mo | Per seat (or self-host free) | Younger than Vault; fast-moving surface | Open-source Doppler/Vault alternative |
| HashiCorp Vault (HCP) | Dev cluster ~$0.03/hr | Usage/quote | Per cluster-hour | IBM-owned (Feb 2025); BSL license → OpenBao fork | Dynamic creds, PKI, encryption-as-a-service |
| AWS Secrets Manager | None (Parameter Store is free) | $0.40/secret/mo + $0.05/10k calls | Per secret + per call | Per-secret cost stings at hundreds of microservices | IAM-scoped secrets + automatic RDS rotation |
| 1Password | None (trial) | Teams $19.95/mo flat (≤10) | Flat / per seat | Machine-secrets features tied to plan tiers | Extending human vaults to machine secrets |
| GCP Secret Manager | Small free quota | ~$0.06/version/mo + access calls | Per version + per call | Version-based billing surprises heavy rotators | GCP-native equivalent of AWS Secrets Manager |
| Mozilla SOPS | Unlimited — OSS | $0 | Free (files in git) | No server, no UI — encryption for files you commit | Encrypted secrets in git with KMS/age keys |
Pricing models and free tiers change often — check each vendor for current terms. Compiled July 2026; the most volatile figures verified on official pricing pages.
Official pages: Doppler · Infisical · HashiCorp Vault (HCP) · AWS Secrets Manager · 1Password · GCP Secret Manager · Mozilla SOPS
Entry price at a glance
Cheapest paid plan, USD per month — per-user plans shown for a single seat. Hatched bars are usage-based or quote-only; values marked ~ are approximate.
Notes & recent changes
- Vault's Business Source License (Aug 2023) produced OpenBao under the Linux Foundation — the open fork tracks core features and matters for license-sensitive shops.
- AWS SSM Parameter Store standard parameters are free and cover a surprising share of Secrets Manager use cases.
- SOPS + age/KMS is the zero-infrastructure baseline: secrets live encrypted in the repo, decrypted in CI — no vendor at all.
Which one should you pick?
- DX-first env management → Doppler (or Infisical to self-host).
- Dynamic credentials/PKI at enterprise scale → Vault (weigh OpenBao).
- All-in on one cloud → that cloud's native manager.
- Small team, no new vendors → SOPS in git.