Crunu vs Doppler for team secrets

Doppler is a secrets manager offered as a cloud service, with an on-prem option on its Enterprise plan. You keep variables per project and config, run your app with doppler run, and Doppler pushes values into the platforms you deploy to, from AWS Secrets Manager to Vercel. Crunu covers similar ground for projects and environments, but it is built on a different premise: the server stores only ciphertext and never holds a key that could decrypt your values.

That premise has costs. Pushing values into other platforms and rotating them automatically needs a service that can work with the values themselves. Doppler offers both. Crunu does not, by design. This page lays out where each approach wins.

Who each one fits

Doppler fits teams that want secrets to flow into many platforms with little setup: cloud secret stores, CI systems, hosting providers and Kubernetes. It fits teams that want automatic rotation, change requests, SAML SSO and Windows support, and that are comfortable with secrets being encrypted on the vendor's side rather than on their own devices.

Crunu fits teams that want a vault whose server cannot read values, even if its database or hosting is breached. It fits teams that deliver secrets to their own Linux machines and CI pipelines, want a precise record of what a departing person received, and may want to host the server themselves.

Side by side

Where Doppler is stronger

• Integrations. Doppler lists sync targets across AWS, GCP, Azure, GitHub, GitLab, Bitbucket Pipelines, Vercel, Netlify, Render, Railway and more. Crunu has no built-in sync with any cloud or hosting platform.
• Automation on values. Doppler rotates secrets automatically on paid plans, and lists dynamic secrets on Enterprise. Crunu only rotates its own encryption keys.
• Workflow features. Change requests let people propose edits to configs they cannot write. Crunu's approval flow covers access requests, not edits to values.
• Identity and platforms. SAML SSO on Team, SCIM on Enterprise, and a CLI for Windows. Crunu has no SSO, no SCIM and no Windows agent.
• Assurance. Doppler says it is SOC 2 and ISO 27001 certified, has white box penetration tests at least once a year and runs a public bug bounty. Crunu is in early access and does not publish a SOC 2 report or an external audit.

What Crunu does differently

The server is blind. Doppler's design keeps keys away from internet-facing systems, but its service still receives secrets and encrypts them on its side. In Crunu, values are encrypted before they leave your device and decrypted only on devices that hold an environment key. A full copy of Crunu's database does not help anyone guess passwords, because the account key also depends on the Secret Key.

Doppler applies the same idea in one product: Doppler Share encrypts on the client, so plaintext never reaches its systems, except for secrets shared through its Slack app. Crunu does this for everything, including share links for people without an account.

Departures leave a trail. Crunu records which versions of which environments each person received. When someone leaves, the member removal flow rotates the keys of every environment they could read and lists the values to reissue at providers.

Honest limits. The server still sees metadata such as project names, email addresses and timestamps. Network restrictions are enforced by the server, not by cryptography. The limitations page lists the rest.

Moving to Crunu

1. Create an account and save your Emergency Kit.
2. Create a project for each Doppler project and an environment for each config you use.
3. On a trusted machine, write each config's values into a .env file.
4. Drag the files into the matching environments, then delete the plaintext copies.
5. Replace doppler run with crunu run. Enroll your servers as machines and give pipelines service tokens with OIDC binding.
6. Platforms that Doppler synced into need a recipe in CI or manual updates, since Crunu has no built-in sync.