# Keeper Secrets Manager alternative: Crunu vs Keeper > Crunu vs Keeper Secrets Manager: both decrypt on your devices. Compare hosting, CI sign-in with OIDC, keys per environment, removing people, sync and pricing. URL: https://crunu.com/alternatives/keeper-secrets-manager Language: en Updated: 2026-10-30 Both decrypt secrets on your devices, so neither vendor's servers see plaintext. Keeper is a paid add-on to its business plans, runs in Keeper's cloud or as Self-Managed Keeper, and brings FedRAMP, SOC 2 and ISO 27001. Crunu's cloud is free in early access, Enterprise adds your own server, and CI signs in with OIDC. Keeper Secrets Manager and Crunu both decrypt secrets on your devices; they differ in where the server runs and how CI proves who it is. Keeper Secrets Manager is an add-on to Keeper's business password manager: applications and devices read records from shared folders through the `ksm` CLI, CI plugins or SDKs. Crunu is a vault built only for environment variables, cloud credentials and API keys, organized into projects and environments, with an agent for machines and CI. Keeper describes Secrets Manager as fully managed and cloud-based. For infrastructure you control, it sells Self-Managed Keeper, a separate self-hosted deployment of its platform aimed at federal and OT networks. Crunu's server runs in the Crunu cloud or, on the Enterprise plan, on a server you choose, including serverless platforms. This page covers both sides. > **Note:** We checked every statement about Keeper Secrets Manager against Keeper's documentation, product page and GitHub organization on October 30, 2026. Sources are listed with this page. If something is out of date, tell us at . ## Who each one fits **Keeper Secrets Manager fits** organizations that already run Keeper for passwords and want developer secrets on the same business plan and admin console. It fits regulated buyers that need FedRAMP or StateRAMP authorization, SOC 2 and ISO 27001 certificates and FIPS 140-3 validated cryptography, and teams that want records pushed one way into AWS, Azure and Google secret stores. **Crunu fits** engineering teams that want to run the vault server themselves on the Enterprise plan, including on serverless platforms, or keep the option to move it there, and want CI to sign in without a stored credential. It fits teams that organize secrets by environment and want a clean record when someone leaves. ## Side by side | | Keeper Secrets Manager | Crunu | | ------------------------------- | -------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------- | | Where values are decrypted | On the client device running the `ksm` app, a CI plugin or an SDK; the server returns ciphertext | Only in the browser and the `crunu` agent. The server stores ciphertext and signed documents. | | Keys | Each shared folder and record has its own key, unwrapped by the application key | Each environment has its own key, sealed separately to each person and machine allowed to read it | | Hosting | Keeper's cloud; Self-Managed Keeper runs the platform, secrets management included, on your own infrastructure | Crunu cloud at app.crunu.com; on the Enterprise plan, also your own server on Docker, Cloudflare Workers, Vercel or Google Cloud Run | | CI sign-in | The GitHub Action reads a KSM configuration stored as a GitHub secret; no OIDC sign-in is documented | Service tokens bound by OIDC to repository, branch and deployment environment on GitHub Actions, GitLab CI, Bitbucket Pipelines or any issuer | | Removing a member | What happens to keys is not documented publicly | The keys of every environment they could read are rotated, with an exposure report and a reissue checklist | | Sync to cloud stores | One-way sync from the Keeper vault to AWS Secrets Manager, Azure Key Vault and Google Secret Manager | Not built in. A CI step can push values with `crunu run`. | | Sharing with outsiders | One-Time Share: a time-limited link to a record, decrypted on the recipient's device | Share links to selected files with an expiry, a view limit and a password; the key stays in the link after `#` | | Audit | Secrets Manager access events appear in Keeper's event log; custom reports and alerts need the ARAM add-on | Hash-chained audit log, 365 days by default and extendable, with JSONL export | | Single sign-on and provisioning | Keeper Enterprise: SAML 2.0 sign-in and SCIM provisioning with Okta, Entra ID and others | Not available | | Kubernetes | Kubernetes Secrets Injector and an External Secrets Operator provider | Not available | | Certifications | SOC 2 and ISO 27001 certified, FIPS 140-3 validated, FedRAMP and StateRAMP Authorized | None published. Crunu is in early access. | | Pricing model | Paid add-on to Keeper business plans, licensed per user per year, with a free trial | Free during early access in the Crunu cloud; self-hosting on the Enterprise plan | ## Where it runs and how CI signs in *Figure: The same Crunu server runs on five platforms: Docker on your own server, Cloudflare Workers, Vercel, Google Cloud Run and AWS App Runner, which is closed to new AWS accounts. Moving between them takes one export archive with no plaintext values inside.* **Both keep plaintext off the server.** Keeper's encryption model says encryption and decryption happen on the client device running the KSM application, a CI plugin or the SDK; the server answers with ciphertext. Crunu encrypts and decrypts only in the browser and the `crunu` agent. On this point the products are equal, and we will not claim otherwise. Crunu's server still sees metadata such as names, email addresses and timestamps, and a web client served by a compromised server is the main remaining risk; the [limitations page](https://crunu.com/security/limitations) covers both. **Where the server runs.** Keeper Secrets Manager runs in Keeper's cloud. Keeper also offers Self-Managed Keeper, a self-hosted, container-based deployment of its platform, secrets management included, for on-premises data centers, private clouds and air-gapped networks; each deployment is licensed as its own tenant. Crunu can run in the Crunu cloud at app.crunu.com, or, on the Enterprise plan under a signed agreement, as your own server: one program with one database schema on a single Docker host, on Cloudflare Workers with D1, on Vercel with Postgres or on Google Cloud Run. A server moves between those platforms with one archive that holds no plaintext values, and the same archive works as a backup you can store anywhere. If data location or an exit plan matters to your team, compare those options side by side. The [self-hosting page](https://crunu.com/self-hosting) lists Crunu's commands. *Figure: Diagram of a GitHub Actions job signing in to Crunu with OIDC. Step 1: the job asks the GitHub Actions issuer for an ID token. Step 2: the issuer signs a JWT naming the repository kiteline/web-app and the branch main. Step 3: the job presents the JWT to Crunu, which checks the issuer, the audience, the repository and the branch. Step 4: Crunu rejects a replayed token, then returns ciphertext and the environment key sealed to the token; the values are decrypted in memory on the runner, and the CRUNU_TOKEN stored in CI is useless without the JWT.* **CI identity.** Keeper's GitHub Actions guide recommends storing the KSM configuration in a GitHub Actions secret and reading it as a variable. The credential then lives in the CI settings. Crunu [service tokens](https://crunu.com/features/ci-cd) can require the CI provider's OIDC token for one repository, branch and deployment environment, on GitHub Actions, GitLab CI, Bitbucket Pipelines or any OIDC issuer. A copied token without that JWT does not sign in, and replayed JWTs are rejected. Tokens also carry a lease, a usage limit and optional network binding. **People leaving.** Keeper does not publicly document what happens to record keys when a member is removed. In Crunu, the [member removal flow](https://crunu.com/features/offboarding) rotates the keys of every environment the person could read and shows which versions they received, when and from where, with a checklist of values to reissue at providers. ## Where Keeper is stronger - **Compliance.** SOC 2 and ISO 27001 certificates, FIPS 140-3 validation, FedRAMP and StateRAMP authorization. Crunu has none of these and no external audit published. - **Cloud store sync.** A one-way sync from Keeper into AWS Secrets Manager, Azure Key Vault and Google Secret Manager. Crunu has no built-in sync. - **Identity and Kubernetes.** SAML 2.0 and SCIM with Okta and Entra ID, a Kubernetes Secrets Injector and an External Secrets Operator provider. Crunu has no SSO, SCIM or Kubernetes support. - **Wider platform.** Keeper lists automated password rotation, and just-in-time access through KeeperPAM. Crunu does not rotate values at providers; it rotates its own encryption keys. ## Moving from Keeper Secrets Manager to Crunu > **Note:** Crunu has no importer for Keeper. You read records with the `ksm` CLI on a trusted computer, write the values into `.env` files and drag the files into Crunu. 1. [Create an account](https://crunu.com/signup) and save your Emergency Kit. 2. Create a project for each application and an environment for each stage, for example `payments-api` with `development`, `staging` and `production`. 3. On a trusted computer, run `ksm secret list` to find the records an application uses, then read each field with `ksm secret get -u -f "API Key"` and write the values into a `.env` file. 4. Drag the files into the matching environments, then delete the plaintext copies. 5. Switch programs that read secrets through the `ksm` CLI or an SDK to `crunu run --env payments-api/production -- npm start`, and enroll their servers as machines. 6. Give pipelines service tokens with OIDC binding, then remove the KSM configuration from your CI secrets. Keeper's one-way sync into cloud stores, its Kubernetes injector and its event history do not carry over. If a cloud store was the real destination, a CI step can push values there with `crunu run`. > **Warning:** The files from step 3 hold plaintext secrets. Keep them out of Git and synced folders, and delete them after the import. ## Other Keeper Secrets Manager alternatives Two other password manager vendors sell a secrets product that decrypts on the client. [1Password](https://crunu.com/alternatives/1password) adds CI sign-in with OIDC for GitHub Actions through Credential Broker, in public preview, and keeps accounts on its own service. [Bitwarden Secrets Manager](https://crunu.com/alternatives/bitwarden-secrets-manager) has a free plan for 2 users and can be self-hosted on its Enterprise plan. If you were using Keeper's sync mainly to feed a cloud store, consider whether that store alone is enough: [AWS Secrets Manager](https://crunu.com/alternatives/aws-secrets-manager), [Google Secret Manager](https://crunu.com/alternatives/google-secret-manager) and [Azure Key Vault](https://crunu.com/alternatives/azure-key-vault) each sign CI in with OIDC, though each decrypts values on the provider's side. If you want an open-source developer tool with client-side encryption and a self-hosted option, look at [Phase](https://crunu.com/alternatives/phase). [Akeyless](https://crunu.com/alternatives/akeyless) is a SaaS that can keep decryption on your side when you add its Customer Fragment. ## FAQ ### Is Crunu an alternative to Keeper Secrets Manager? Yes, for developer secrets: environment variables, cloud credentials and API keys for people, machines and CI. Both decrypt on your devices. Crunu adds Enterprise self-hosting on platforms such as Cloudflare Workers and Vercel, OIDC sign-in for CI and a removal flow; Keeper keeps its certifications, cloud sync and Kubernetes integrations. ### How do I move from Keeper Secrets Manager to Crunu? Read each application's records with `ksm secret list` and `ksm secret get` on a trusted computer, write the values into `.env` files, drag them into Crunu environments and delete the plaintext copies. Then give pipelines OIDC-bound service tokens and remove the old KSM configuration. ### Can Keeper Secrets Manager be self-hosted? Through a separate product. Keeper describes Secrets Manager as fully managed and cloud-based, and Self-Managed Keeper runs the Keeper platform, secrets management included, on your own infrastructure, including air-gapped networks. Crunu's server can run in the Crunu cloud or, on the Enterprise plan, on [your own infrastructure](https://crunu.com/self-hosting): Docker, Cloudflare Workers, Vercel or Google Cloud Run. ### Does Keeper decrypt secrets on its servers? No. According to Keeper's encryption model, the server returns ciphertext and the client device decrypts record keys and secrets. Crunu works the same way: values are encrypted and decrypted only in the browser and the `crunu` agent. ### Is Keeper Secrets Manager free? No. It is a paid add-on to Keeper's business plans, licensed per user per year, and Keeper offers a free trial. Crunu is free during early access. ## Sources - [Keeper Secrets Manager product page](https://www.keepersecurity.com/secrets-manager.html) (accessed 2026-10-30) - [Self-Managed Keeper](https://www.keepersecurity.com/self-managed-keeper/) (accessed 2026-10-30) - [Keeper docs: Secrets Manager overview](https://docs.keeper.io/en/keeperpam/secrets-manager/overview) (accessed 2026-10-30) - [Keeper docs: Security and encryption model](https://docs.keeper.io/en/keeperpam/secrets-manager/about/security-encryption-model) (accessed 2026-10-30) - [Keeper docs: GitHub Actions](https://docs.keeper.io/en/keeperpam/secrets-manager/integrations/github-actions) (accessed 2026-10-30) - [Keeper docs: Sync command](https://docs.keeper.io/en/keeperpam/secrets-manager/secrets-manager-command-line-interface/sync-command) (accessed 2026-10-30) - [Keeper docs: Secret command](https://docs.keeper.io/en/keeperpam/secrets-manager/secrets-manager-command-line-interface/secret-command) (accessed 2026-10-30) - [Keeper docs: Event descriptions](https://docs.keeper.io/enterprise-guide/event-reporting/event-descriptions) (accessed 2026-10-30) - [Keeper docs: Event reporting](https://docs.keeper.io/enterprise-guide/event-reporting) (accessed 2026-10-30) - [Keeper docs: One-Time Share](https://docs.keeper.io/enterprise-guide/sharing/one-time-share) (accessed 2026-10-30) - [Keeper docs: Okta integration with SAML and SCIM](https://docs.keeper.io/enterprise-guide/user-and-team-provisioning/okta-integration-with-saml-and-scim) (accessed 2026-10-30) - [Keeper docs: Kubernetes Secrets Injector](https://docs.keeper.io/en/keeperpam/secrets-manager/integrations/kubernetes-secrets-injector) (accessed 2026-10-30) - [Keeper docs: Just-in-time access (KeeperPAM)](https://docs.keeper.io/en/keeperpam/privileged-access-manager/just-in-time-access-jit) (accessed 2026-10-30) - [Keeper Security on GitHub](https://github.com/Keeper-Security) (accessed 2026-10-30) - [1Password Developer: Credential Broker in GitHub Actions](https://www.1password.dev/brokered-access/github-actions) (accessed 2026-10-30) - [1Password Developer: Connect server](https://www.1password.dev/connect/) (accessed 2026-10-30) - [Bitwarden Help: Secrets Manager plans](https://bitwarden.com/help/secrets-manager-plans/) (accessed 2026-10-30) - [Bitwarden Help: Manage your secrets organization](https://bitwarden.com/help/manage-your-secrets-org/) (accessed 2026-10-30) - [AWS IAM: Create a role for OpenID Connect federation](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-idp_oidc.html) (accessed 2026-10-30) - [AWS Secrets Manager: Secret encryption and decryption](https://docs.aws.amazon.com/secretsmanager/latest/userguide/security-encryption.html) (accessed 2026-10-30) - [Google Cloud IAM: Workload Identity Federation with deployment pipelines](https://cloud.google.com/iam/docs/workload-identity-federation-with-deployment-pipelines) (accessed 2026-10-30) - [Google Cloud Secret Manager: Encryption](https://cloud.google.com/secret-manager/docs/encryption) (accessed 2026-10-30) - [Microsoft Learn: Use GitHub Actions with OpenID Connect to connect to Azure](https://learn.microsoft.com/en-us/azure/developer/github/connect-from-azure-openid-connect) (accessed 2026-10-30) - [Azure Key Vault: About secrets](https://learn.microsoft.com/en-us/azure/key-vault/secrets/about-secrets) (accessed 2026-10-30) - [Phase security](https://phase.dev/security/) (accessed 2026-10-30) - [Phase docs: Self-hosting](https://docs.phase.dev/self-hosting) (accessed 2026-10-30) - [Akeyless docs: Customer Fragment](https://docs.akeyless.io/docs/zero-knowledge-architecture) (accessed 2026-10-30)