Phase secrets manager alternative: Crunu vs Phase

Phase and Crunu both encrypt secrets on your devices and give every environment its own key; the differences are in the exceptions, the hosting and what happens around access. Phase is an open-source secrets manager with a cloud service and a self-hosted option, a CLI, syncs to other platforms and dynamic secrets. Crunu is a team vault for environment variables, cloud credentials and API keys, with an agent for machines and CI and a member removal flow that rotates keys.

If you are choosing between the two, you are already choosing a client-side model, and this page will not pretend one of them invented it. It shows where the designs diverge: Phase lets an app opt into server-side encryption to get integrations, while Crunu never does; Phase self-hosts as containers, while Crunu, on its Enterprise plan, also runs on serverless platforms; and they document different things about CI and offboarding.

Who each one fits

Phase fits teams that want an open-source, client-side encrypted secrets manager with a free self-hosted plan and a long list of integrations. It fits teams that are comfortable opting particular apps into server-side encryption to get syncs, the REST API or dynamic AWS credentials, and that need OIDC SSO, SCIM or a Kubernetes operator on an Enterprise plan.

Crunu fits teams that want no server-side decryption path at all, for any app. It fits teams that want to host the server on Cloudflare Workers, Vercel or Google Cloud Run on the Enterprise plan, sign CI in with OIDC from GitHub, GitLab or Bitbucket, and get an exposure report and reissue checklist when someone leaves.

Two client-side models

In their default modes, the two products answer the main question the same way. Phase says its servers store only ciphertext and cannot decrypt your secrets, with all encryption running on the client and an independent key for every environment. Granting access wraps an environment's keys to your account's public key. Crunu seals each environment key to the public key of every person and machine allowed to read it, and its server holds no decryption key at any point. If client-side encryption with per-environment keys is your requirement, both meet it.

The difference is the exception. Phase lets you opt an app into server-side encryption when you need third-party syncs or the REST API; the environment key is then stored encrypted on the server and used for those operations, and dynamic secrets require it too. That is a reasonable trade, made per app, and Phase is open about it. Crunu has no equivalent switch. The server cannot be given a key, so syncs and generated credentials are not available, and nobody in your organization can turn on server-side decryption for convenience.

What Crunu does differently

Serverless hosting. Phase self-hosts on a container runtime or orchestrator. Crunu's server, self-hosted on the Enterprise plan, is one program with one database schema that also runs on Cloudflare Workers with D1, on Vercel with Postgres or on Google Cloud Run, as well as on a single Docker host. It moves between those platforms with one archive that holds no plaintext values, so the hosting decision is not final.

CI with the provider's OIDC token. Phase documents external identities for AWS IAM and Azure. Crunu service tokens can require the JWT that GitHub Actions, GitLab CI or Bitbucket Pipelines issue for a given repository, branch and deployment environment, and the agent picks that token up by itself in all three. A copied token without the JWT does not sign in.

People leaving. Phase does not publicly document what happens to keys when a member is removed, and we will not guess. Crunu's member removal flow rotates the keys of every environment the person could read, revokes their tokens and links, shows which versions they received, when and from where, and lists the values to reissue at providers.

Signed access and leases. In Crunu, the list of who may read an environment is a document signed by an administrator, and clients reject older states, so a compromised server cannot add a reader or roll access back. Machines hold secrets on a lease and keep working through an outage until it ends, 24 hours by default. The server still sees metadata such as names, email addresses and timestamps, and a web client served by a compromised server is the main remaining risk; the limitations page covers both.

Where Phase is stronger

• Open source. The console is MIT-licensed outside its enterprise directories, with a free self-hosted plan. Crunu's source code is not published.
• Integrations when you want them. Syncs to third-party platforms and dynamic AWS credentials, for apps you opt into server-side encryption. Crunu has neither.
• Identity and Kubernetes. OIDC SSO and SCIM on Enterprise, and a Kubernetes Operator. Crunu has no SSO, SCIM or Kubernetes support.
• Independent audit. Phase says it holds SOC 2 Type 2, independently audited by Oneleet, with audit reports in its trust center. Crunu has no external audit published yet.

Moving from Phase to Crunu

Syncs, dynamic secrets and secret references that Phase resolves at run time do not carry over. Check that exported values hold the resolved text, not a reference, before you import them.

Other Phase alternatives

Infisical is the other open-source option to look at. It covers more ground, with separate certificate and privileged access products, but its server decrypts secrets before responding, so it is a different model from Phase's default. Doppler, the managed alternative, also encrypts on its own infrastructure.

If you want to stay client-side, Bitwarden Secrets Manager decrypts on the client with one organization key, and dotenvx keeps encrypted .env files next to your code. EnvKey used to fill this niche; its hosted cloud shut down on February 1, 2025, and its README still describes the open-source code as end-to-end encrypted.

For a wider view, the guide self-hosting a secrets vault compares what you actually run for each option, and who can decrypt your secrets covers the encryption models side by side.