Doppler vs Infisical: encryption, hosting, pricing

Doppler and Infisical share the same core design: both receive your secrets on their servers, decrypt them there to answer requests, and push them into the platforms you deploy to. The real differences are in who runs the server, whether you can read its code, and what you pay for. Doppler is a closed-source cloud service, with an on-prem option on its Enterprise plan, and bills per user. Infisical is open source, can be self-hosted for free, and bills per identity, counting machines as well as people.

If you are choosing between them, the questions that matter are how many machines and pipelines read secrets, whether you need to run the server yourself, and which plan holds the features you need.

Who each one fits

Doppler fits teams that want a managed service with nothing to operate and many integrations out of the box. Its pricing page says "AI agents and non-human identities ride free", so a team with a few developers and many servers, pipelines or agents pays for the people only. Paid plans add automatic rotation, change requests, environment-scoped roles and Trusted IPs.

Infisical fits teams that want to read the code and run the server themselves. Its core is MIT-licensed, and self-hosting ranges from a single container to a cluster. Infisical Cloud is available too. An identity, in Infisical's words, "is any human or machine that authenticates to Infisical", and the free plan covers 5 of them with unlimited projects.

Where each one decrypts

Doppler's security fact sheet is direct: "When our web servers receive secrets, they are immediately sent to our internal tokenization service", which encrypts them with the workplace's unique 256-bit key. That key is made available to the tokenization service only for the lifetime of a request, but encryption and decryption still happen on Doppler's infrastructure.

Infisical's security documentation describes a similar model on a server you may run yourself. "Before responding to a client request, the server securely retrieves and decrypts requested data from the storage backend." The root key is "a 256-bit AES key provided by the operator as an environment variable". Infisical's current documentation does not describe the product as end-to-end encrypted.

So neither product keeps the server from reading values. What differs is whose server it is. With Doppler's cloud, Doppler runs it. With self-hosted Infisical, you run it and hold the root key, which moves the trust to your own operators and infrastructure.

Self-hosting and source code

Doppler's own pages answer whether it can be self-hosted: its on-prem page offers to "run Doppler entirely within customer-managed infrastructure", and its pricing page lists "Doppler On-prem or Cloud" on the Enterprise plan. So yes, but only on Enterprise, and the server code is not public.

Infisical is self-hostable on every plan. Its pricing page notes that "the pricing structure for self-hosted Infisical differs from that of Infisical Cloud", and code in the ee/ directories has its own license, so some features still depend on a paid plan when you run it yourself.

Where Doppler is stronger

• Machines are free. Per-seat billing with non-human identities free is easier to predict for teams with many servers, pipelines or agents.
• Nothing to run. Doppler's cloud service is the default, and on-prem is an Enterprise option rather than something you have to maintain.
• Change requests on Team. People can propose edits to configs they cannot write on Doppler's Team plan; Infisical lists approval workflows and access requests on Enterprise.
• Share links that encrypt in the browser. Doppler Share keeps plaintext off Doppler's systems, except for secrets shared through its Slack app.

Where Infisical is stronger

• Open source and self-hostable. You can read the MIT core, run it in a single container, and keep the root key on your own infrastructure.
• OIDC for any provider. OIDC Auth accepts JWTs from any OIDC provider, with checks on subject, audiences and claims.
• A larger free plan. 5 identities and unlimited projects, compared with 3 users on Doppler's Developer plan.

A third option: Crunu

Crunu, which wrote this page, takes a different route: values are encrypted in the browser and the crunu agent, and the server stores only ciphertext, for people, for machines and for CI. Each environment has its own key, sealed to each recipient. When someone leaves, the keys of every environment they could read are rotated, and the member removal flow shows which versions they received and lists values to reissue. You can use the Crunu cloud or, on the Enterprise plan, host the server yourself on Docker, Cloudflare Workers, Vercel or Google Cloud Run. It is free during early access. The server still sees metadata such as names, email addresses and timestamps, as the limitations page explains.

Crunu is not a fit if you need what both Doppler and Infisical have and it lacks: built-in syncs to other platforms, dynamic secrets, automatic rotation of values at providers, a Kubernetes operator, SAML SSO, SCIM or a Windows CLI. Its source code is not published. The full comparisons are Crunu vs Doppler and Crunu vs Infisical.