Azure Key Vault alternative for app secrets: Crunu vs Azure

Azure Key Vault decrypts your secrets automatically when you read them; Crunu encrypts them on your devices so its server never can. Key Vault is the managed Azure service for secrets, keys and certificates: Microsoft Entra ID authenticates every caller, access is set per vault, and the service encrypts each secret when you add it. Crunu is a team vault for environment variables, cloud credentials and API keys, encrypted before upload and delivered to laptops, servers and CI pipelines in any cloud.

Microsoft's own documentation adds a line that frames this whole comparison. For highly sensitive data, it suggests adding extra layers of protection, for example encrypting data with a separate protection key before storing it in Key Vault. That extra layer is exactly what Crunu does for every value.

Who each one fits

Azure Key Vault fits teams whose workloads run on Azure and authenticate through Microsoft Entra ID, with managed identities instead of stored credentials. It fits teams that keep keys and certificates next to secrets, want FIPS-validated modules behind the service, run on AKS, and prefer to stay inside one Azure subscription and bill.

Crunu fits teams whose .env files, cloud credentials and API keys travel beyond one cloud: developers' laptops, servers at several providers, CI on GitHub, GitLab or Bitbucket. It fits teams that want values encrypted before the store sees them, access per environment in one place, and a precise report of what a departing person received.

Microsoft's advice, applied by default

Key Vault stores every secret as encrypted data, behind a hierarchy of keys protected by FIPS-validated modules, with an encryption leaf key unique to each vault. This encryption is transparent: the service encrypts a secret when you add it and decrypts it automatically when an authorized caller reads it. That is encryption at rest, and it is done well. It also means the service, not your device, turns ciphertext back into the value.

Microsoft's answer for highly sensitive data is a second layer: encrypt the data with a separate protection key before it reaches Key Vault. Crunu builds that layer in for everything. Values are encrypted in the browser or the crunu agent with an environment key the server never has, and decrypted only where that key lives: a teammate's browser, an enrolled server running crunu daemon, or a CI runner with a service token. There is no separate key for you to manage, store and hand out, because each environment key is sealed to the public keys of the people and machines allowed to read it.

One vault per environment, or one environment per key

Key Vault sets access at the level of the vault, so Microsoft advises one vault per application, region and environment. A team with three applications in two regions and three stages ends up managing many vaults and their role assignments. In Crunu, the environment is already the unit of encryption and access: a project holds development, staging and production, and a developer with access to development never receives the production key.

When someone leaves, Key Vault access ends when their Entra ID account or role assignment does, and the logs in your storage account show what they read if logging was on. Crunu's member removal flow rotates the keys of every environment the person could read, shows which versions they received, and lists the values to reissue at providers. Values already seen stay valid until reissued, as the limitations page explains.

Where Azure Key Vault is stronger

• Microsoft Entra ID. Every caller authenticates through your directory, so sign-in, accounts and managed identities come from the same place. Crunu has no SSO and no SCIM.
• Keys and certificates too. Key Vault manages secrets, keys and certificates in one service, behind FIPS-validated modules. Crunu stores secrets only.
• Azure-native delivery. Managed identities, a Secrets Store CSI Driver provider on AKS and rotation with Azure Functions. Crunu has no Kubernetes support.
• Nothing new to adopt. It lives in your subscription and bill. Crunu is a new vendor in early access, with no external audit published.

Moving from Azure Key Vault to Crunu

Keys, certificates, managed identity access and AKS delivery stay in Azure. You can keep Key Vault for those and move only the team's environment variables.

Other Azure Key Vault alternatives

The other big clouds work the same way. AWS Secrets Manager decrypts each secret with AWS KMS before returning it, and in Google Secret Manager the service decrypts even when you bring your own key. If your workloads span clouds, HashiCorp Vault is the self-hosted option to consider, with dynamic credentials across providers.

If you want to manage secrets in one place and still have them land in Key Vault, Doppler pushes values into AWS, GCP and Azure stores, and Keeper Secrets Manager has a one-way sync into Azure Key Vault. Phase can bind an Azure managed identity or service principal to a Phase service account, and decrypts on your devices by default.

The article customer-managed keys: who decrypts? compares how Azure, AWS and Google Cloud handle your own keys, and the guide who can decrypt your secrets covers every product we compare.