Every tool here will store a secret and hand it back to an authorised process. Comparing them on that is a wasted afternoon. The questions that separate them are less comfortable: when your secrets manager is down, does your application still start, and when someone gets in, how much do they get?
At a glance
| Tool | Model | Best for | Licence | Watch out for |
|---|---|---|---|---|
| AWS Secrets Manager | Managed | AWS-native workloads | Proprietary | Locked to one cloud |
| Doppler | Managed | Multi-cloud teams | Proprietary | Third party holds everything |
| HashiCorp Vault | Self-hosted | Full control, every feature | Proprietary core | Operational weight |
| OpenBao | Self-hosted | Vault without the licence change | MPL-2.0 | Younger, smaller community |
| Infisical | Self-hosted | Vault's model, gentler curve | Proprietary | Per-identity pricing |
| Akeyless | Managed | Enterprise, hybrid estates | Proprietary | Pricing opaque |
| SOPS | Files in Git | Small teams, no server | MPL-2.0 | Manual rotation and revocation |
| External Secrets Operator | Kubernetes bridge | Syncing into clusters | Apache-2.0 | 3 CRITICAL advisories this year |
| CyberArk Conjur | Self-hosted | Existing CyberArk estates | Proprietary | Enterprise-shaped |
| Azure Key Vault | Managed | Azure-native workloads | Proprietary | We hold almost no data on it |
Self-hosted
HashiCorp Vault
36,213 stars · shipped 2026-09-01 · 0 advisories · free tier · score 69.4, confidence 0.75
The category's reference implementation and the best-evidenced self-hosted option here. Dynamic credentials, PKI, transit encryption, leasing: it does all of it.
Verdictstill the right answer when you need the full feature set and can carry the operational load.
OpenBao
MPL-2.0 · 7,328 stars · shipped 2026-09-09 · 0 advisories · score 54.6, confidence 0.41
The fork that exists because Vault's licence changed. Migration is deliberately straightforward.
Verdictthe direct answer if your reason for leaving Vault is licensing rather than capability.
OpenBao alternatives
openbao alternative is the most-clicked query we see in this category, so it is worth being specific about what people are actually asking.
- You forked for licensing reasons and want the same thing then stay on OpenBao, or go back to Vault if its terms suit you after all.
- Running a secrets server is too much weight then Doppler or AWS Secrets Manager. The honest answer here is not another self-hosted server.
- You want the model with a gentler interface then Infisical.
- You want to delete the service entirely then SOPS.
Infisical
29,212 stars · shipped 2026-09-10 · 0 advisories · from $18/identity/month · 18 integrations · score 67.3, confidence 0.68
The newer self-hosted option with a friendlier interface and a commercial tier.
Verdictbest fit for a team that wants Vault's model without Vault's learning curve. Price the per-identity cost at your real headcount first.
CyberArk Conjur
946 stars · shipped 2026-06-16 · 0 advisories · score 37.0
Lowest score here, which reflects how poorly enterprise software fits our signal set rather than product quality.
Verdictrelevant mainly if you are already a CyberArk shop.
Managed services
AWS Secrets Manager
Usage-based, free tier · 30 integrations · score 77.6, confidence 0.73
Highest score in the category. If your workloads are in AWS, the IAM integration is the argument and it is a strong one: you are not managing a second identity system.
Verdictthe default for AWS-only estates.
Doppler
From $21/month, free tier · 54 integrations, the most here · score 77.1, confidence 0.73
One place for secrets across providers rather than one per cloud.
Verdictthe choice when your stack is spread across clouds.
Akeyless
Subscription, free tier · 6 integrations · score 66.7, confidence 0.73
Verdictenterprise and hybrid estates. Expect a quote-based conversation.
Azure Key Vault
Confidence 0.06 · score 50.0
Verdicttreat as unmeasured. That score is our neutral prior, meaning we know almost nothing about it, not that it is average. Evaluate directly.
Secrets without a secrets manager
SOPS
MPL-2.0 · 23,083 stars · shipped 2026-07-23 · 0 advisories · 11 integrations · score 45.4
Encrypts secrets into files that live in your existing repository, decrypted at deploy time with a key from your cloud KMS. Its score is low and is measuring the wrong thing: SOPS is not trying to be a secrets manager. It removes an entire service from your infrastructure, with no availability dependency and no per-seat cost.
Its weakness is real. Rotation is manual, and revocation means re-encrypting and redeploying.
Verdictfrequently the right answer for small teams. Wrong if you need audit trails or fast revocation.
External Secrets Operator
Apache-2.0 · 6,848 stars · shipped 2026-08-28 · 5 advisories, 3 in the last 12 months (CRITICAL) · 19 integrations · score 54.6
Pulls from a backing store into Kubernetes secrets. The only entry here with recent CRITICAL disclosures, in a component that by design holds credentials to your secrets backend.
Verdictuseful, but read the advisories directly before deploying it.
Three things to check that no comparison covers
Does your application cache secrets? Fetching at startup and holding them means an outage is survivable. Fetching per request couples every request to a third party.
How fast is revocation, really? Removing a policy is instant. Invalidating already-issued tokens often is not.
What is the blast radius of the machine that can read everything? Every one of these has one, and it is usually your CI runner.
Method, and what we could not verify
Confidence runs from 0.06 to 0.75.
We hold no licence record for AWS Secrets Manager, Doppler, Akeyless, Azure Key Vault, HashiCorp Vault, Infisical or CyberArk Conjur. For Vault in particular that is a meaningful gap, since the licence change is the entire reason OpenBao exists.
Advisory data covers only projects with a public repository, so the four managed services show no history because none is published. That asymmetry flatters managed services in every table above.
We take no vendor payment for placement.
Evaluate these against your own constraints
Ten products across three models. The right one depends on whether you can carry an operational dependency, how fast you need revocation, and whether your secrets can live in Git. Tell the evaluation agent your constraints.
Sources
Advisory data from advisories.ecosyste.ms, adoption from GitHub, both retrieved 2026-09-11. Pricing independently observed; each product page links the vendor page it was observed from.