Secrets manager comparison: 18 products side by side
The same 14 questions for every tool: who can decrypt your values, where it runs, how CI signs in and what happens when someone leaves. Each answer has a dated source on the tool’s comparison page.
Checked: Free during early accessSources last checked October 30, 2026
Every tool, every property
Rows are tools, grouped by kind; columns are the properties described below the table. Open a tool’s comparison for the note and source behind each answer.
- Yes
- documented and available
- Partial
- with limits: on some plans, in preview or by hand
- No
- not offered
- n/a
- doesn’t apply, or isn’t documented publicly
| Tool | Device-only decryption | Server sees values | Self-host | Open source | OIDC for CI | Re-key on leave | Key per environment | Audit log | Share links | Free plan | Sync out | Dynamic secrets | SSO and SCIM | Kubernetes |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Cloud secrets managers | ||||||||||||||
| Crunuour product | Yes | No | Partial | No | Yes | Yes | Yes | Yes | Yes | Yes | No | No | No | No |
| Doppler | No | Yes | Partial | No | Yes | n/a | No | Yes | Yes | Yes | Yes | Yes | Yes | Yes |
| Infisical | No | Yes | Yes | Yes | Yes | n/a | No | Yes | Yes | Yes | Yes | Yes | Yes | Yes |
| Phase | Partial | Partial | Yes | Yes | Partial | n/a | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes |
| EnvKeyDiscontinued | Yes | No | Yes | Yes | n/a | n/a | n/a | Yes | n/a | n/a | n/a | n/a | n/a | n/a |
| Akeyless | Yes | Partial | Partial | No | Yes | n/a | n/a | Yes | Yes | Yes | Yes | Yes | Partial | Yes |
| Servers you run | ||||||||||||||
| HashiCorp Vault | No | Yes | Yes | Partial | Yes | n/a | No | Yes | Partial | Yes | Yes | Yes | Yes | Yes |
| Password managers for developers | ||||||||||||||
| 1Password | Partial | Partial | Partial | No | Partial | No | Partial | Yes | Yes | No | Partial | n/a | Yes | Yes |
| Bitwarden Secrets Manager | Yes | No | Partial | Partial | No | n/a | No | Yes | Partial | Yes | n/a | n/a | Yes | Yes |
| Keeper Secrets Manager | Yes | No | Partial | No | No | n/a | Partial | Yes | Yes | No | Yes | n/a | Yes | Yes |
| Your cloud provider’s store | ||||||||||||||
| AWS Secrets Manager | No | Yes | No | No | Yes | n/a | Partial | Yes | No | No | No | No | Yes | Yes |
| AWS Systems Manager Parameter Store | No | Yes | No | No | Yes | n/a | Partial | Yes | No | Yes | n/a | n/a | Yes | Yes |
| Google Cloud Secret Manager | No | Yes | No | No | Yes | n/a | Partial | Yes | No | Yes | No | No | Partial | Yes |
| Azure Key Vault | No | Yes | No | No | Yes | n/a | Partial | Yes | No | No | n/a | No | Yes | Yes |
| Encrypted files in your repository | ||||||||||||||
| dotenvx | Partial | Partial | Yes | Yes | No | Partial | Yes | Yes | n/a | Yes | No | n/a | No | n/a |
| SOPS | Yes | No | Yes | Yes | n/a | Partial | Partial | Partial | No | Yes | No | No | n/a | n/a |
| Ansible Vault | Yes | No | Yes | Yes | n/a | Partial | Partial | No | No | Yes | No | No | n/a | n/a |
| git-crypt | Yes | No | Yes | Yes | n/a | No | Partial | No | No | Yes | No | No | n/a | n/a |
What each column asks
Fourteen questions, chosen because they change who can read your values, what you operate or what happens when access ends.
- Device-only decryptionDecrypted only on your devices
- If values are decrypted only on devices you control, a breach of the vendor’s servers doesn’t expose them.
- Server sees valuesServer handles plaintext values
- Whoever runs a server that handles plaintext, and anyone who breaks into it, could read what passes through.
- Self-hostRuns on your own infrastructure
- You decide where the data lives and who operates the service. Several tools, Crunu included, offer this only on an enterprise plan.
- Open sourceSource code published
- Published code can be read and audited by anyone, and kept running if the vendor changes course.
- OIDC for CICI signs in with OIDC
- Pipelines get short-lived access tied to the repository, instead of a long-lived token stored in CI settings.
- Re-key on leaveKeys change when someone leaves
- When people hold decryption keys, removing access is complete only once those keys are replaced.
- Key per environmentSeparate key per environment
- With a key per environment, access to development can’t turn into access to production.
- Audit log
- A record of who changed or fetched what tells you what a person or machine could have seen.
- Free planFree plan or free to use
- A small team can start with real projects before anyone signs a contract.
- Sync outSyncs values into other platforms
- Pushing values into clouds and CI saves copying by hand, but the syncing service has to read them.
- Dynamic secrets
- Credentials created on demand and revoked after a lease limit how long a leaked one works.
- SSO and SCIM
- Sign-in and provisioning from your identity provider make joining and leaving one step.
- KubernetesKubernetes integration
- An operator or CSI driver delivers values into clusters without custom glue code.
Two tools, side by side
Pages that compare two other products directly, with Crunu as a labeled third option.
1Password vs Bitwarden Secrets Manager
Checked October 30, 2026
AWS Secrets Manager vs Parameter Store
Checked October 30, 2026
Doppler vs Infisical
Checked October 30, 2026
HashiCorp Vault vs AWS Secrets Manager
Checked October 30, 2026
Infisical vs HashiCorp Vault
Checked October 30, 2026
SOPS vs Ansible Vault
Checked October 30, 2026
How this table is built
Each cell is one fact from the vendor’s own documentation, pricing, security or license pages, with the address and the day we read it. A cell says n/a when the question doesn’t apply or the vendor doesn’t document it publicly.
Crunu wrote this table and makes one of the products in it. Crunu’s cells describe the product today, and its gaps are listed on the limitations page. Security limitations
Found something wrong or out of date? Write to support@crunu.com with the cell and the source, and we’ll check it.
Looking at a third option?
Crunu encrypts values on your devices, so its server stores only ciphertext. Free during early access.