# Phase secrets manager alternative: Crunu vs Phase > Crunu vs Phase: two client-side encryption models compared, from environment keys and server-side opt-ins to self-hosting, CI sign-in, offboarding and pricing. URL: https://crunu.com/alternatives/phase Language: en Updated: 2026-10-30 Phase and Crunu share the core model: secrets are encrypted on your devices, with a key per environment. Phase is open source and adds syncs and dynamic secrets for apps that opt into server-side encryption. Crunu has no such mode, offers serverless self-hosting on Enterprise, and rotates keys when someone leaves. Phase and Crunu both encrypt secrets on your devices and give every environment its own key; the differences are in the exceptions, the hosting and what happens around access. Phase is an open-source secrets manager with a cloud service and a self-hosted option, a CLI, syncs to other platforms and dynamic secrets. Crunu is a team vault for environment variables, cloud credentials and API keys, with an agent for machines and CI and a member removal flow that rotates keys. If you are choosing between the two, you are already choosing a client-side model, and this page will not pretend one of them invented it. It shows where the designs diverge: Phase lets an app opt into server-side encryption to get integrations, while Crunu never does; Phase self-hosts as containers, while Crunu, on its Enterprise plan, also runs on serverless platforms; and they document different things about CI and offboarding. > **Note:** We checked every statement about Phase against its security page, documentation, pricing page and license file on October 30, 2026. Sources are listed with this page. If something is out of date, tell us at . ## Who each one fits **Phase fits** teams that want an open-source, client-side encrypted secrets manager with a free self-hosted plan and a long list of integrations. It fits teams that are comfortable opting particular apps into server-side encryption to get syncs, the REST API or dynamic AWS credentials, and that need OIDC SSO, SCIM or a Kubernetes operator on an Enterprise plan. **Crunu fits** teams that want no server-side decryption path at all, for any app. It fits teams that want to host the server on Cloudflare Workers, Vercel or Google Cloud Run on the Enterprise plan, sign CI in with OIDC from GitHub, GitLab or Bitbucket, and get an exposure report and reissue checklist when someone leaves. ## Side by side | | Phase | Crunu | | -------------------------- | ------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Where values are decrypted | On your devices by default. Apps opted into server-side encryption keep an environment key on the server for syncs and the REST API. | Only in the browser and the `crunu` agent. There is no server-side mode. | | Keys per environment | An independent key pair per environment, wrapped to each account's public key to grant access | Each environment has its own key, sealed separately to the public key of each person and machine allowed to read it | | Account keys | Derived from a 24-word mnemonic phrase only you hold | Derived from your password and a Secret Key, with an Emergency Kit and a recovery code | | Self-hosting | A container runtime or orchestrator such as Docker, Docker Compose, Nomad or Kubernetes; a free self-hosted plan | On the Enterprise plan, under a signed agreement: Docker, Cloudflare Workers with D1, Vercel with Postgres or Google Cloud Run, moved between them with one archive | | CI sign-in | External identities for AWS IAM and Azure; sign-in with a CI provider's OIDC token is not documented | Service tokens bound by OIDC to repository, branch and deployment environment on GitHub Actions, GitLab CI, Bitbucket Pipelines or any issuer | | Removing a member | What happens to keys is not documented publicly | The keys of every environment they could read are rotated, with an exposure report and a reissue checklist | | Syncs to other platforms | Syncs to third-party platforms; the app must opt into server-side encryption | Not built in. A CI step can push values with `crunu run`. | | Dynamic secrets | AWS IAM credentials leased on demand, on Enterprise, with server-side encryption on | No, by design. Generating credentials needs a key on the server. | | Sharing with outsiders | Lockbox links keep the decryption seed in the URL fragment, which is never sent to the server | Share links to selected files with an expiry, a view limit and a password; the key stays in the link after `#` | | SSO, SCIM and Kubernetes | Enterprise: OIDC SSO with providers such as Entra ID and Okta, and SCIM. A Kubernetes Operator installed with Helm. | Not available | | Source code and audit | MIT outside `ee/` directories; SOC 2 Type 2, independently audited by Oneleet | Source code not published; no external audit yet | | Pricing model | Free Cloud plan for up to 5 users or service accounts, and a free self-hosted plan | Free during early access in the Crunu cloud; self-hosting on the Enterprise plan | ## Two client-side models *Figure: Diagram of who can decrypt Phase values, split into your side and the provider side. On your side, your team’s devices, your machines, and CI runners can decrypt. On the provider side, the Phase service stores only ciphertext and holds no key.* In their default modes, the two products answer the main question the same way. Phase says its servers store only ciphertext and cannot decrypt your secrets, with all encryption running on the client and an independent key for every environment. Granting access wraps an environment's keys to your account's public key. Crunu seals each environment key to the public key of every person and machine allowed to read it, and its server holds no decryption key at any point. If client-side encryption with per-environment keys is your requirement, both meet it. The difference is the exception. Phase lets you opt an app into server-side encryption when you need third-party syncs or the REST API; the environment key is then stored encrypted on the server and used for those operations, and dynamic secrets require it too. That is a reasonable trade, made per app, and Phase is open about it. Crunu has no equivalent switch. The server cannot be given a key, so syncs and generated credentials are not available, and nobody in your organization can turn on server-side decryption for convenience. ## What Crunu does differently *Figure: The same Crunu server runs on five platforms: Docker on your own server, Cloudflare Workers, Vercel, Google Cloud Run and AWS App Runner, which is closed to new AWS accounts. Moving between them takes one export archive with no plaintext values inside.* **Serverless hosting.** Phase self-hosts on a container runtime or orchestrator. Crunu's server, self-hosted on the Enterprise plan, is one program with one database schema that also runs on [Cloudflare Workers](https://crunu.com/docs/self-hosting/cloudflare-workers) with D1, on Vercel with Postgres or on Google Cloud Run, as well as on a single Docker host. It moves between those platforms with one archive that holds no plaintext values, so the hosting decision is not final. **CI with the provider's OIDC token.** Phase documents external identities for AWS IAM and Azure. Crunu [service tokens](https://crunu.com/features/ci-cd) can require the JWT that GitHub Actions, GitLab CI or Bitbucket Pipelines issue for a given repository, branch and deployment environment, and the agent picks that token up by itself in all three. A copied token without the JWT does not sign in. **People leaving.** Phase does not publicly document what happens to keys when a member is removed, and we will not guess. Crunu's [member removal flow](https://crunu.com/features/offboarding) rotates the keys of every environment the person could read, revokes their tokens and links, shows which versions they received, when and from where, and lists the values to reissue at providers. **Signed access and leases.** In Crunu, the list of who may read an environment is a document signed by an administrator, and clients reject older states, so a compromised server cannot add a reader or roll access back. Machines hold secrets on a lease and keep working through an outage until it ends, 24 hours by default. The server still sees metadata such as names, email addresses and timestamps, and a web client served by a compromised server is the main remaining risk; the [limitations page](https://crunu.com/security/limitations) covers both. ## Where Phase is stronger - **Open source.** The console is MIT-licensed outside its enterprise directories, with a free self-hosted plan. Crunu's source code is not published. - **Integrations when you want them.** Syncs to third-party platforms and dynamic AWS credentials, for apps you opt into server-side encryption. Crunu has neither. - **Identity and Kubernetes.** OIDC SSO and SCIM on Enterprise, and a Kubernetes Operator. Crunu has no SSO, SCIM or Kubernetes support. - **Independent audit.** Phase says it holds SOC 2 Type 2, independently audited by Oneleet, with audit reports in its trust center. Crunu has no external audit published yet. ## Moving from Phase to Crunu > **Note:** Crunu has no importer for Phase. You export each environment with the Phase CLI on a trusted computer and drag the resulting `.env` files into Crunu. 1. [Create an account](https://crunu.com/signup) and save your Emergency Kit. 2. Create a project for each Phase app and an environment for each Phase environment, for example `payments-api` with `development`, `staging` and `production`. 3. On a trusted computer, run `phase secrets export --env prod --app payments-api > .env` for each environment. The default output format is dotenv. 4. Drag each file into the matching environment, then delete the plaintext copy. 5. Replace `phase run` with `crunu run --env payments-api/production -- npm start`, enroll servers as machines, and give pipelines service tokens with OIDC binding. Syncs, dynamic secrets and secret references that Phase resolves at run time do not carry over. Check that exported values hold the resolved text, not a reference, before you import them. > **Warning:** Exported files hold plaintext secrets. Keep them out of Git and synced folders, and delete them after the import. ## Other Phase alternatives [Infisical](https://crunu.com/alternatives/infisical) is the other open-source option to look at. It covers more ground, with separate certificate and privileged access products, but its server decrypts secrets before responding, so it is a different model from Phase's default. [Doppler](https://crunu.com/alternatives/doppler), the managed alternative, also encrypts on its own infrastructure. If you want to stay client-side, [Bitwarden Secrets Manager](https://crunu.com/alternatives/bitwarden-secrets-manager) decrypts on the client with one organization key, and [dotenvx](https://crunu.com/alternatives/dotenvx) keeps encrypted `.env` files next to your code. [EnvKey](https://crunu.com/alternatives/envkey) used to fill this niche; its hosted cloud shut down on February 1, 2025, and its README still describes the open-source code as end-to-end encrypted. For a wider view, the guide [self-hosting a secrets vault](https://crunu.com/guides/self-hosting-a-secrets-vault) compares what you actually run for each option, and [who can decrypt your secrets](https://crunu.com/guides/who-can-decrypt-your-secrets) covers the encryption models side by side. ## FAQ ### Is Crunu an alternative to Phase? Yes. Both encrypt on your devices with a key per environment, so you keep that model. Crunu adds serverless self-hosting on its Enterprise plan, CI sign-in with OIDC from GitHub, GitLab and Bitbucket, and a removal flow that rotates keys. Phase keeps open-source code, syncs, dynamic secrets, SSO and Kubernetes. ### How do I move from Phase to Crunu? Export each environment with `phase secrets export --env prod --app > .env` on a trusted computer, drag the file into the matching Crunu environment and delete the plaintext copy. Then replace `phase run` with `crunu run` and give pipelines OIDC-bound service tokens. ### Do Phase and Crunu both encrypt end to end? By default, yes: Phase says its servers store only ciphertext and cannot decrypt secrets in its default mode, and Crunu's server never holds a decryption key. The difference is that a Phase app can opt into server-side encryption for syncs and the REST API. Crunu has no such option. ### Can I self-host Phase and Crunu? Yes. Phase has a free self-hosted plan and runs on a container runtime or orchestrator such as Docker Compose or Kubernetes. Crunu offers self-hosting on its Enterprise plan, under a signed agreement, on Docker, Cloudflare Workers, Vercel or Google Cloud Run, and moves between them with one archive that holds no plaintext values; see [self-hosting](https://crunu.com/self-hosting). ### Which one supports GitHub Actions OIDC? Crunu does: service tokens can require the GitHub Actions OIDC token for a repository, branch and deployment environment, and the same works for GitLab CI and Bitbucket Pipelines. Phase documents external identities for AWS IAM and Azure, and sign-in with a CI provider's OIDC token is not described in its docs. ## Sources - [Phase security](https://phase.dev/security/) (accessed 2026-10-30) - [Phase docs: Security architecture](https://docs.phase.dev/security/architecture) (accessed 2026-10-30) - [Phase pricing](https://phase.dev/pricing/) (accessed 2026-10-30) - [Phase docs: Self-hosting](https://docs.phase.dev/self-hosting) (accessed 2026-10-30) - [Phase console license](https://github.com/phasehq/console/blob/main/LICENSE) (accessed 2026-10-30) - [Phase docs: External identities](https://docs.phase.dev/access-control/external-identities) (accessed 2026-10-30) - [Phase docs: Users](https://docs.phase.dev/console/users) (accessed 2026-10-30) - [Phase docs: Dynamic secrets](https://docs.phase.dev/console/dynamic-secrets) (accessed 2026-10-30) - [Phase docs: SCIM provisioning](https://docs.phase.dev/access-control/provisioning/scim) (accessed 2026-10-30) - [Phase docs: Single sign-on](https://docs.phase.dev/access-control/authentication/sso) (accessed 2026-10-30) - [Phase docs: Kubernetes](https://docs.phase.dev/integrations/platforms/kubernetes) (accessed 2026-10-30) - [Phase docs: CLI commands](https://docs.phase.dev/cli/commands) (accessed 2026-10-30) - [Infisical security internals](https://infisical.com/docs/internals/security) (accessed 2026-10-30) - [Doppler security fact sheet](https://docs.doppler.com/docs/security-fact-sheet) (accessed 2026-10-30) - [Bitwarden Help: Secret decryption](https://bitwarden.com/help/secret-decryption/) (accessed 2026-10-30) - [EnvKey on GitHub](https://github.com/envkey/envkey) (accessed 2026-10-30) - [dotenvx on GitHub](https://github.com/dotenvx/dotenvx) (accessed 2026-10-30) - [Infisical home page](https://infisical.com/) (accessed 2026-10-30)