Crunu vs Infisical for team secrets
Crunu and Infisical compared: server-side vs on-device encryption, open source and self-hosting, syncs, dynamic secrets, roles, CI identity and pricing.
Comparison in detail
On this page
Infisical is an open-source secrets platform with a hosted cloud and a self-hosted option. It covers secrets management, dynamic secrets, rotation, syncs to other platforms, a Kubernetes operator, SDKs in many languages, and separate products for certificates and privileged access. Crunu is smaller and makes one different choice at its core: the server never holds a key that could decrypt your values.
If you are choosing between the two, the question is mostly which trade-off you want. Infisical's server decrypts secrets to serve them, and Infisical offers syncs, rotation and generated credentials on top of that. Crunu's server cannot read values, which rules those features out.
Who each one fits
Infisical fits teams that want an open-source, self-hostable platform with broad automation: secret syncs, dynamic credentials, rotation, approval workflows, temporary access, Kubernetes and SDKs. It fits companies that need a vendor with SOC 2 compliance today, and that accept a server that can decrypt secrets as part of the design.
Crunu fits teams that want a vault whose server cannot read values if its host or database is compromised. It fits teams that deliver static secrets to Linux machines and CI pipelines, want a signed record of who may read each environment, and want a precise report of what a departing person received.
Side by side
| Infisical | Crunu | |
|---|---|---|
| Where secrets are decrypted | On the Infisical server, which decrypts stored data before responding to a client | Only in the browser and the crunu agent. The server stores ciphertext and signed documents. |
| Key hierarchy | AES-256-GCM with a root key set by the operator, per-organization and per-project data keys, optional external KMS | A key per environment, sealed separately to each recipient's public key |
| Source code | Core under the MIT license, enterprise code in ee/ under a separate license | Not published today |
| Hosting | Infisical Cloud in US and EU regions, or self-hosted with Docker, Docker Compose, Helm, a Linux package, AWS or GCP | Crunu cloud at app.crunu.com, or your own server on Docker, Cloudflare Workers, Vercel or Google Cloud Run |
| Syncs to other platforms | Secret syncs to platforms such as GitHub, Vercel, AWS and Kubernetes | Not built in |
| Dynamic secrets and rotation | Dynamic secrets from the Advanced plan. Secret rotation from the Pro plan. | No. Crunu rotates its encryption keys; values are reissued at providers from a checklist. |
| Temporary access | Temporary access grants from the Advanced plan | No expiry for people on environment access lists |
| CI identity | OIDC Auth with subject, audience and claims checks; trusted IPs per access token | Service tokens with optional OIDC binding to repository, branch and deployment environment |
| Kubernetes | Operator installed with Helm, with deployment reload on change | Not available |
| History | Versioned changes with point-in-time recovery, a paid feature | 100 versions per environment with compare and revert |
| Audit retention | None on Free, 30 days on Pro, 90 days on Advanced, custom on Enterprise | 365 days by default, extendable, hash-chained |
| Pricing model | Per identity per month, human or machine, with a free tier of 5 identities. Free trial on paid plans. | Free during early access |
Where Infisical is stronger
- Open source. Infisical's core is under the MIT license, and its documentation covers self-hosting with Docker, Kubernetes, a Linux package, AWS and GCP. Crunu's source code is not published.
- Automation. Secret syncs, dynamic secrets, scheduled rotation and approval workflows are all available, depending on plan. Crunu has none of these.
- Ecosystem. Infisical ships a Kubernetes operator, a Terraform provider and SDKs for nine languages, including Node.js, Python, Go and Java. Crunu offers
crunu runandcrunu pull, with no SDKs and no Kubernetes support. - Temporary access. Infisical offers temporary access grants on its Advanced plan and above. In Crunu, only invitations, share links, service tokens, machine leases and break-glass access expire.
- Assurance. Infisical describes itself as SOC 2, HIPAA and FIPS 140-3 compliant and runs penetration tests twice a year. Crunu is in early access and does not publish a SOC 2 report or an external audit.
What Crunu does differently
The server is blind by design. Infisical's layered keys mean a stolen database alone is not enough to decrypt data. The running server, though, is given the root key by its operator and decrypts requested data before it responds. Crunu has no such key on the server. Values are sealed on your devices to the public keys of the people and machines allowed to read them.
Signed access. The list of who may read an environment is a document signed by an administrator, and every version is signed by its author. Clients and agents check those signatures and reject older states, so a compromised server cannot quietly add itself as a reader.
Leaving is a key event. Removing a member rotates the keys of every environment they could read. The member removal flow shows which versions they received and lists values to reissue at providers.
What Crunu cannot protect. The server still sees metadata such as names, email addresses and timestamps, and a web client served by a compromised server is the main remaining risk. Crunu's limitations page covers this and the local crunu.html file that reduces it.
Moving to Crunu
- Create an account and save your Emergency Kit.
- Create a project for each Infisical project and an environment for each environment you use.
- On a trusted machine, write the values you need into
.envfiles. - Drag the files into the matching environments, then delete the plaintext copies.
- Replace
infisical runwithcrunu run, enroll your servers as machines, and give pipelines service tokens with OIDC binding.
Dynamic secrets, syncs and Kubernetes delivery have no equivalent in Crunu. Keep Infisical for those, or plan another approach.
Sources
Every page this comparison relies on, and the day we last verified it.
- Infisical security internals · checked October 27, 2026
- Infisical home page · checked October 27, 2026
- Infisical pricing · checked October 27, 2026
- Infisical license · checked October 27, 2026
- Infisical self-hosting overview · checked October 27, 2026
- Infisical secrets management · checked October 27, 2026
- Infisical OIDC Auth for machine identities · checked October 27, 2026
- Infisical Kubernetes Operator · checked October 27, 2026
- Infisical point-in-time recovery · checked October 27, 2026
- Infisical CLI: run · checked October 27, 2026
Questions about Crunu and Infisical
Something else? Write to support@crunu.com
Does Infisical encrypt end to end?
Infisical's security documentation describes server-side encryption: the server decrypts requested data before it responds. For Infisical Cloud, the same page describes policy controls on employee access to customer data. That is a policy and access-control promise, not on-device encryption.
Can I self-host both?
Yes. Infisical documents Docker, Docker Compose, Helm, a Linux package, AWS and GCP deployments. Crunu's server runs on your own infrastructure with Docker, Cloudflare Workers, Vercel or Google Cloud Run.
Which one is cheaper?
Crunu is free during early access. Infisical's core is MIT-licensed, and its cloud has a free tier plus plans priced per identity. Check both pricing pages for current terms.
Can Crunu generate database credentials?
No. Generating credentials on demand requires a key on the server, which Crunu's design does not allow.