Keeper Secrets Manager alternative: Crunu vs Keeper

Keeper Secrets Manager and Crunu both decrypt secrets on your devices; they differ in where the server runs and how CI proves who it is. Keeper Secrets Manager is an add-on to Keeper's business password manager: applications and devices read records from shared folders through the ksm CLI, CI plugins or SDKs. Crunu is a vault built only for environment variables, cloud credentials and API keys, organized into projects and environments, with an agent for machines and CI.

Keeper describes Secrets Manager as fully managed and cloud-based. For infrastructure you control, it sells Self-Managed Keeper, a separate self-hosted deployment of its platform aimed at federal and OT networks. Crunu's server runs in the Crunu cloud or, on the Enterprise plan, on a server you choose, including serverless platforms. This page covers both sides.

Who each one fits

Keeper Secrets Manager fits organizations that already run Keeper for passwords and want developer secrets on the same business plan and admin console. It fits regulated buyers that need FedRAMP or StateRAMP authorization, SOC 2 and ISO 27001 certificates and FIPS 140-3 validated cryptography, and teams that want records pushed one way into AWS, Azure and Google secret stores.

Crunu fits engineering teams that want to run the vault server themselves on the Enterprise plan, including on serverless platforms, or keep the option to move it there, and want CI to sign in without a stored credential. It fits teams that organize secrets by environment and want a clean record when someone leaves.

Where it runs and how CI signs in

Both keep plaintext off the server. Keeper's encryption model says encryption and decryption happen on the client device running the KSM application, a CI plugin or the SDK; the server answers with ciphertext. Crunu encrypts and decrypts only in the browser and the crunu agent. On this point the products are equal, and we will not claim otherwise. Crunu's server still sees metadata such as names, email addresses and timestamps, and a web client served by a compromised server is the main remaining risk; the limitations page covers both.

Where the server runs. Keeper Secrets Manager runs in Keeper's cloud. Keeper also offers Self-Managed Keeper, a self-hosted, container-based deployment of its platform, secrets management included, for on-premises data centers, private clouds and air-gapped networks; each deployment is licensed as its own tenant. Crunu can run in the Crunu cloud at app.crunu.com, or, on the Enterprise plan under a signed agreement, as your own server: one program with one database schema on a single Docker host, on Cloudflare Workers with D1, on Vercel with Postgres or on Google Cloud Run. A server moves between those platforms with one archive that holds no plaintext values, and the same archive works as a backup you can store anywhere. If data location or an exit plan matters to your team, compare those options side by side. The self-hosting page lists Crunu's commands.

permissions:  id-token: write

CI identity. Keeper's GitHub Actions guide recommends storing the KSM configuration in a GitHub Actions secret and reading it as a variable. The credential then lives in the CI settings. Crunu service tokens can require the CI provider's OIDC token for one repository, branch and deployment environment, on GitHub Actions, GitLab CI, Bitbucket Pipelines or any OIDC issuer. A copied token without that JWT does not sign in, and replayed JWTs are rejected. Tokens also carry a lease, a usage limit and optional network binding.

People leaving. Keeper does not publicly document what happens to record keys when a member is removed. In Crunu, the member removal flow rotates the keys of every environment the person could read and shows which versions they received, when and from where, with a checklist of values to reissue at providers.

Where Keeper is stronger

• Compliance. SOC 2 and ISO 27001 certificates, FIPS 140-3 validation, FedRAMP and StateRAMP authorization. Crunu has none of these and no external audit published.
• Cloud store sync. A one-way sync from Keeper into AWS Secrets Manager, Azure Key Vault and Google Secret Manager. Crunu has no built-in sync.
• Identity and Kubernetes. SAML 2.0 and SCIM with Okta and Entra ID, a Kubernetes Secrets Injector and an External Secrets Operator provider. Crunu has no SSO, SCIM or Kubernetes support.
• Wider platform. Keeper lists automated password rotation, and just-in-time access through KeeperPAM. Crunu does not rotate values at providers; it rotates its own encryption keys.

Moving from Keeper Secrets Manager to Crunu

Keeper's one-way sync into cloud stores, its Kubernetes injector and its event history do not carry over. If a cloud store was the real destination, a CI step can push values there with crunu run.

Other Keeper Secrets Manager alternatives

Two other password manager vendors sell a secrets product that decrypts on the client. 1Password adds CI sign-in with OIDC for GitHub Actions through Credential Broker, in public preview, and keeps accounts on its own service. Bitwarden Secrets Manager has a free plan for 2 users and can be self-hosted on its Enterprise plan.

If you were using Keeper's sync mainly to feed a cloud store, consider whether that store alone is enough: AWS Secrets Manager, Google Secret Manager and Azure Key Vault each sign CI in with OIDC, though each decrypts values on the provider's side.

If you want an open-source developer tool with client-side encryption and a self-hosted option, look at Phase. Akeyless is a SaaS that can keep decryption on your side when you add its Customer Fragment.