# Akeyless alternative: Crunu vs Akeyless > Crunu and Akeyless compared: who can decrypt with and without a Customer Fragment, hosting, CI, member removal and pricing model, checked against Akeyless docs. URL: https://crunu.com/alternatives/akeyless Language: en Updated: 2026-10-30 Akeyless is a SaaS secrets platform built on key fragments, with dynamic secrets, syncs and Kubernetes injection. It promises it cannot finish operations without you only when you run a Gateway with a Customer Fragment. Crunu stores only ciphertext by default, with no gateway, and rotates keys when a person leaves. Akeyless and Crunu both aim at the same promise, that the vendor should not be able to read your secrets, and they get there by different routes. Akeyless splits key material into fragments that its service holds, and adds an optional Customer Fragment kept in a Gateway you run; only with that fragment does its documentation say Akeyless "cannot complete cryptographic operations without the customer's involvement". Crunu has no fragments and no gateway: values are encrypted on your devices, and the server stores only ciphertext in every configuration. Akeyless is also a much broader platform than Crunu. It generates dynamic secrets, syncs to cloud secret stores, injects secrets into Kubernetes pods and signs people in through your identity provider. Crunu does none of these. This page is for teams weighing that breadth against a simpler model of who can decrypt. > **Note:** Crunu wrote this comparison. We checked every statement about Akeyless against its documentation and pricing page on October 30, 2026, and the sources are listed with this page. If something is out of date, tell us at . ## Who each one fits **Akeyless fits** organizations that want one SaaS platform for static and dynamic secrets across clouds, Kubernetes clusters and CI systems, with sign-in through SAML or OIDC. Its Hybrid SaaS option adds Gateways you run on your own network, and the Customer Fragment gives regulated teams a hard control boundary, at the price of more setup and lifecycle work. **Crunu fits** engineering teams whose secrets are mostly `.env` files, cloud credentials and API keys read by people, servers and pipelines. It fits teams that want the server unable to decrypt from the first day, without deploying anything extra, and, on the Enterprise plan, teams that want to [host the whole vault themselves](https://crunu.com/self-hosting) on Docker, Cloudflare Workers, Vercel or Google Cloud Run. ## Side by side | | Akeyless | Crunu | | ----------------------- | ------------------------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------- | | Where keys are combined | The client, or your Gateway when a Customer Fragment is used, combines fragment-derived values into a one-time key | Values are encrypted and decrypted only in the browser and the `crunu` agent | | What the vendor can do | Akeyless holds key fragments; only with a Customer Fragment can it not complete operations without you | The server holds no decryption key at any point; it sees metadata such as names, emails and timestamps | | Hosting | A SaaS platform; Hybrid SaaS adds Gateways that you run on premises | The Crunu cloud; on the Enterprise plan, also the whole server on Docker, Cloudflare Workers, Vercel or Google Cloud Run | | Source code | No platform source published; SDKs, the CLI and plugins are on GitHub | Not published | | CI pipelines | The GitHub Actions plugin signs in with the job's GitHub JWT by default | Service tokens bound by OIDC to a repository, branch and deployment environment on GitHub Actions, GitLab CI, Bitbucket Pipelines or any issuer | | Removing someone | Re-keying when a member leaves is not documented publicly | Removal rotates the keys of every environment they could read and lists the values to reissue | | Audit | Audit logs by secret type, operation, user and time | Hash-chained organization log with one-click verification and JSONL export, 365 days by default | | Sharing | Static or rotated secrets by email link or wrapped token, with a TTL, even outside your organization | Links for people without an account; the key stays in the URL fragment. Expiry, view limit and password. | | Dynamic secrets | Generated on each access for databases, clouds and other targets | Not offered by design: generating credentials on demand needs a key on the server | | Syncs and Kubernetes | Universal Secrets Connector for AWS, GCP, Azure, Kubernetes and Vault; Kubernetes Secrets Injector | Neither: no built-in sync and no Kubernetes operator | | Sign-in | SAML and OIDC sign-in methods | Password, Secret Key and an optional second factor; no SSO or SCIM | | Pricing model | Free plan with 5 clients; Enterprise priced per client and usage | Free during early access in the Crunu cloud; self-hosting on the Enterprise plan | ## Who can decrypt, with and without a gateway Akeyless describes its Customer Fragment as the strongest separation it offers: protected operations "cannot complete without customer fragment participation". Its own documentation also lists the cost: "Higher setup and lifecycle overhead for fragment generation, backup, rotation planning, and deployment integration." The Gateway that holds the fragment is yours to run, and when caching is enabled it "can cache secret values and metadata in customer-controlled cache layers". Without a Customer Fragment, the guarantee that Akeyless cannot finish an operation on its own is not part of the documented model. *Figure: Diagram of who can decrypt Akeyless values, split into your side and the provider side. On your side, your team’s devices, your machines, CI runners, and a gateway you run can decrypt. On the provider side, the Akeyless service stores only ciphertext and holds no key.* Crunu makes the same boundary the default, and keeps it simple. Every environment has its own key, sealed separately to the public key of each person, machine and pipeline that may read it. The server stores ciphertext, public keys and signed documents, and the list of who may read an environment is a document signed by an administrator, so a compromised server cannot quietly add itself as a reader. There is nothing extra to deploy, back up or plan rotation for. *Figure: Example: what the Crunu server stores for version 15 of payments-api / production at Kiteline, a fictional company: the ciphertext of the data and of its key, the environment key version and Priya Natarajan’s signature. The server holds no key and no value in any form.* This is not a claim that Crunu is the only product where the vendor cannot decrypt. Akeyless with a Customer Fragment, Bitwarden Secrets Manager and Phase in its default mode make similar promises. The difference is how much you deploy to get it, and what the product does when someone leaves: the [member removal flow](https://crunu.com/features/offboarding) rotates every key the person held, shows which versions they received, and lists values to reissue. Crunu's [limitations page](https://crunu.com/security/limitations) covers what the model does not protect, such as metadata and malicious code on a device where keys are decrypted. ## Where Akeyless is stronger - **Dynamic secrets and rotation.** Akeyless generates credentials for databases, clouds and other targets on each access. Crunu never will, since that needs a key on the server. - **Integrations.** The Universal Secrets Connector manages and syncs secrets in AWS, GCP, Azure, Kubernetes and Vault, and the Kubernetes Secrets Injector adds secrets to pods. Crunu has no syncs and no Kubernetes support. - **Identity.** People can sign in through SAML or OIDC identity providers. Crunu has no SSO and no SCIM. - **Platform breadth.** Akeyless covers static secrets, dynamic secrets and secret sharing in one SaaS service, with Gateways for private networks. Crunu is focused on environments, machines and CI. ## Moving from Akeyless to Crunu > **Note:** Crunu has no importer for Akeyless. You move static values by hand: write them into `.env` or INI files on a trusted computer and drag the files into Crunu. 1. [Create an account](https://crunu.com/signup) and save your Emergency Kit before anything else. 2. Create a project for each application and an environment for each stage, mirroring the folders or paths you use in Akeyless. 3. On a trusted computer, read the static secrets you need with the Akeyless CLI or console and write them into `.env` or INI files. 4. Drag the files into the matching environments and invite the team, giving each person a role per environment. 5. Replace Akeyless calls in scripts and services with `crunu run --env / -- `, enroll servers as machines and give pipelines service tokens with OIDC binding. 6. Delete the plaintext files and revoke the Akeyless access methods you no longer use. Dynamic secrets, rotated secrets, syncs and Kubernetes injection have no equivalent in Crunu. If you depend on them, keep Akeyless for those jobs and move only static environment values. > **Warning:** Exported files hold plaintext secrets. Keep them out of Git and synced folders, and delete them as soon as the import is done. ## Other Akeyless alternatives If you need dynamic secrets, look at [HashiCorp Vault](https://crunu.com/alternatives/hashicorp-vault), self-managed or as HCP Vault Dedicated; its server decrypts once unsealed. [Infisical](https://crunu.com/alternatives/infisical) and [Doppler](https://crunu.com/alternatives/doppler) add dynamic secrets on higher plans, and both decrypt on their servers. If the vendor must not decrypt, [Phase](https://crunu.com/alternatives/phase) and [Bitwarden Secrets Manager](https://crunu.com/alternatives/bitwarden-secrets-manager) encrypt on the client by default. If you are weighing a platform against your cloud provider's own store, [HashiCorp Vault vs AWS Secrets Manager](https://crunu.com/compare/hashicorp-vault-vs-aws-secrets-manager) covers that trade-off. The [who can decrypt guide](https://crunu.com/guides/who-can-decrypt-your-secrets) puts all of these tools side by side. ## FAQ ### Is Crunu an alternative to Akeyless? Yes, for teams that use Akeyless mainly for static secrets read by people, servers and CI. Crunu keeps those values encrypted on your devices with no gateway to deploy. If you rely on dynamic secrets, syncs or Kubernetes injection, Crunu does not replace those. ### How do I move from Akeyless to Crunu? Read the static secrets you need with the Akeyless CLI or console on a trusted computer, write them into `.env` or INI files and drag the files into Crunu environments. There is no importer. Then switch scripts to `crunu run` and delete the plaintext files. ### Can Akeyless read my secrets? Akeyless holds key fragments. Its documentation says that if a Customer Fragment is configured, Akeyless cannot complete cryptographic operations without your involvement. That fragment lives in a Gateway you deploy, back up and maintain. ### Does Crunu need a gateway or an on-premises component? No. Values are encrypted in the browser and the agent, and the server stores only ciphertext whether you use the Crunu cloud or host it yourself on the Enterprise plan. Servers run the `crunu` agent, which fetches and decrypts only the environments that machine was given. ### Does Crunu support SAML or OIDC sign-in for people? No. People sign in with a password, a Secret Key and an optional second factor such as an authenticator app or a passkey. OIDC is used only to bind CI service tokens to a pipeline's identity. ## Sources - [Akeyless: Distributed Fragments Cryptography overview](https://docs.akeyless.io/docs/dfc-overview) (accessed 2026-10-30) - [Akeyless: trust and control boundaries](https://docs.akeyless.io/docs/zero-knowledge-architecture) (accessed 2026-10-30) - [Akeyless pricing](https://www.akeyless.io/pricing/) (accessed 2026-10-30) - [Akeyless GitHub Action](https://docs.akeyless.io/docs/github-action) (accessed 2026-10-30) - [Akeyless audit logs](https://docs.akeyless.io/docs/audit-logs) (accessed 2026-10-30) - [Akeyless: sharing static secrets](https://docs.akeyless.io/docs/sharing-static-secrets) (accessed 2026-10-30) - [Akeyless Universal Secrets Connector](https://docs.akeyless.io/docs/universal-secrets-connector) (accessed 2026-10-30) - [Akeyless dynamic secrets](https://docs.akeyless.io/docs/how-to-create-dynamic-secret) (accessed 2026-10-30) - [Akeyless SAML authentication](https://docs.akeyless.io/docs/auth-with-saml) (accessed 2026-10-30) - [Akeyless Kubernetes Secrets Injector](https://docs.akeyless.io/docs/akeyless-kubernetes-secrets-injector) (accessed 2026-10-30) - [Akeyless on GitHub](https://github.com/akeylesslabs) (accessed 2026-10-30)