# Doppler vs Infisical: encryption, hosting, pricing > Doppler and Infisical compared: where secrets are decrypted, self-hosting, open source, CI, syncs and how each one bills, checked against both vendors' docs. URL: https://crunu.com/compare/doppler-vs-infisical Language: en Updated: 2026-10-30 Both decrypt secrets on their own servers and both sync values into many platforms. Doppler is a closed-source cloud service with an on-prem option on Enterprise, billed per user with machine identities free. Infisical is open source under MIT, free to self-host, and billed per identity, human or machine. Doppler and Infisical share the same core design: both receive your secrets on their servers, decrypt them there to answer requests, and push them into the platforms you deploy to. The real differences are in who runs the server, whether you can read its code, and what you pay for. Doppler is a closed-source cloud service, with an on-prem option on its Enterprise plan, and bills per user. Infisical is open source, can be self-hosted for free, and bills per identity, counting machines as well as people. If you are choosing between them, the questions that matter are how many machines and pipelines read secrets, whether you need to run the server yourself, and which plan holds the features you need. > **Note:** Crunu wrote this comparison. We make a third option, described near the end, and we compared Doppler and Infisical using only their own documentation and pricing pages, checked on October 30, 2026. Sources are listed with this page. If something is out of date, tell us at . ## Who each one fits **Doppler fits** teams that want a managed service with nothing to operate and many integrations out of the box. Its pricing page says "AI agents and non-human identities ride free", so a team with a few developers and many servers, pipelines or agents pays for the people only. Paid plans add automatic rotation, change requests, environment-scoped roles and Trusted IPs. **Infisical fits** teams that want to read the code and run the server themselves. Its core is MIT-licensed, and self-hosting ranges from a single container to a cluster. Infisical Cloud is available too. An identity, in Infisical's words, "is any human or machine that authenticates to Infisical", and the free plan covers 5 of them with unlimited projects. ## Side by side | | Doppler | Infisical | | --------------------------- | ----------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------ | | Where secrets are decrypted | On Doppler's side: web servers pass secrets to a tokenization service that encrypts and decrypts them | On the Infisical server, which decrypts requested data before responding | | Key hierarchy | One 256-bit key per workplace encrypts all of its secrets | Data keys per organization and per project, protected by a root key the operator provides | | Hosting | Doppler's cloud; Doppler On-prem on the Enterprise plan | Infisical Cloud, or self-hosted from a single container to a cluster | | Source code | Closed; the CLI is open source under Apache 2.0 | MIT outside the `ee/` directories, which have their own license | | CI sign-in | OIDC service account identities on Team and Enterprise | OIDC Auth checks the subject, audiences and claims of JWTs from any OIDC provider | | Syncs | Pushes secrets to AWS, GCP and Azure stores, GitHub, GitLab, Vercel, Netlify and more | Secret Syncs push to services such as GitHub, Vercel and AWS | | Dynamic secrets | Enterprise plan | Advanced plan | | Audit history | 3 days on Developer, 90 days on Team, custom on Enterprise | 30 days on Pro, 90 days on Advanced, custom on Enterprise | | Sharing | Doppler Share encrypts in the browser; its Slack app encrypts on Doppler's servers | Secret Sharing links with an expiry, an optional password and a view limit; by default only signed-in members of your organization can open them | | SSO and SCIM | SAML SSO on Team, SCIM on Enterprise | SAML SSO from Pro, SCIM on Enterprise | | Kubernetes | Operator that syncs secrets and reloads deployments | Operator installed with Helm | | Free plan | Developer: free for 3 users | Free: 5 identities, unlimited projects | | Billing unit | Per user; non-human identities are not billed | Per identity, human or machine | ## Where each one decrypts Doppler's security fact sheet is direct: "When our web servers receive secrets, they are immediately sent to our internal tokenization service", which encrypts them with the workplace's unique 256-bit key. That key is made available to the tokenization service only for the lifetime of a request, but encryption and decryption still happen on Doppler's infrastructure. *Figure: Diagram of who can decrypt Doppler values, split into your side and the provider side. On your side, your team’s devices, your machines, and CI runners can decrypt. On the provider side, the Doppler service holds the key and can decrypt values too.* Infisical's security documentation describes a similar model on a server you may run yourself. "Before responding to a client request, the server securely retrieves and decrypts requested data from the storage backend." The root key is "a 256-bit AES key provided by the operator as an environment variable". Infisical's current documentation does not describe the product as end-to-end encrypted. *Figure: Diagram of who can decrypt Infisical values, split into your side and the provider side. On your side, your team’s devices, your machines, and CI runners can decrypt. On the provider side, the Infisical service holds the key and can decrypt values too.* So neither product keeps the server from reading values. What differs is whose server it is. With Doppler's cloud, Doppler runs it. With self-hosted Infisical, you run it and hold the root key, which moves the trust to your own operators and infrastructure. ## Self-hosting and source code Doppler's own pages answer whether it can be self-hosted: its on-prem page offers to "run Doppler entirely within customer-managed infrastructure", and its pricing page lists "Doppler On-prem or Cloud" on the Enterprise plan. So yes, but only on Enterprise, and the server code is not public. Infisical is self-hostable on every plan. Its pricing page notes that "the pricing structure for self-hosted Infisical differs from that of Infisical Cloud", and code in the `ee/` directories has its own license, so some features still depend on a paid plan when you run it yourself. ## Where Doppler is stronger - **Machines are free.** Per-seat billing with non-human identities free is easier to predict for teams with many servers, pipelines or agents. - **Nothing to run.** Doppler's cloud service is the default, and on-prem is an Enterprise option rather than something you have to maintain. - **Change requests on Team.** People can propose edits to configs they cannot write on Doppler's Team plan; Infisical lists approval workflows and access requests on Enterprise. - **Share links that encrypt in the browser.** Doppler Share keeps plaintext off Doppler's systems, except for secrets shared through its Slack app. ## Where Infisical is stronger - **Open source and self-hostable.** You can read the MIT core, run it in a single container, and keep the root key on your own infrastructure. - **OIDC for any provider.** OIDC Auth accepts JWTs from any OIDC provider, with checks on subject, audiences and claims. - **A larger free plan.** 5 identities and unlimited projects, compared with 3 users on Doppler's Developer plan. ## A third option: Crunu Crunu, which wrote this page, takes a different route: values are encrypted in the browser and the `crunu` agent, and the server stores only ciphertext, for people, for machines and for CI. Each environment has its own key, sealed to each recipient. When someone leaves, the keys of every environment they could read are rotated, and the [member removal flow](https://crunu.com/features/offboarding) shows which versions they received and lists values to reissue. You can use the Crunu cloud or, on the Enterprise plan, [host the server yourself](https://crunu.com/self-hosting) on Docker, Cloudflare Workers, Vercel or Google Cloud Run. It is free during early access. The server still sees metadata such as names, email addresses and timestamps, as the [limitations page](https://crunu.com/security/limitations) explains. Crunu is not a fit if you need what both Doppler and Infisical have and it lacks: built-in syncs to other platforms, dynamic secrets, automatic rotation of values at providers, a Kubernetes operator, SAML SSO, SCIM or a Windows CLI. Its source code is not published. The full comparisons are [Crunu vs Doppler](https://crunu.com/alternatives/doppler) and [Crunu vs Infisical](https://crunu.com/alternatives/infisical). ## FAQ ### Is Infisical end-to-end encrypted? Not according to its current documentation. Infisical's security page says the server retrieves and decrypts requested data before responding, using data keys protected by a root key that the operator provides. Doppler also encrypts and decrypts on its side, in a tokenization service. ### Can I self-host Doppler? Yes, on the Enterprise plan. Doppler On-prem runs in customer-managed infrastructure and is listed on the Enterprise tier of its pricing page. Infisical can be self-hosted on any plan, from a single container to a cluster. ### Which is cheaper, Doppler or Infisical? It depends on how many machines you have. Doppler bills per user and does not bill non-human identities. Infisical bills per identity, and an identity is any human or machine that authenticates. Check both pricing pages for current amounts. ### Do Doppler and Infisical support OIDC for CI? Yes. Doppler offers OIDC service account identities on its Team and Enterprise plans. Infisical's OIDC Auth works with JWTs from any OIDC provider and checks the subject, audiences and claims you configure. ### Which one has a better free plan? Doppler's Developer plan is free for 3 users, with 3 days of activity logs. Infisical's free plan covers 5 identities, people or machines, with unlimited projects. If several machines need access, Doppler's free plan may go further, since machines are not billed. ## Sources - [Doppler security fact sheet](https://docs.doppler.com/docs/security-fact-sheet) (accessed 2026-10-30) - [Doppler pricing](https://www.doppler.com/pricing) (accessed 2026-10-30) - [Doppler On-prem](https://www.doppler.com/doppler-on-prem) (accessed 2026-10-30) - [Doppler service account identities](https://docs.doppler.com/docs/service-account-identities) (accessed 2026-10-30) - [Doppler integrations](https://docs.doppler.com/docs/integrations) (accessed 2026-10-30) - [Doppler dynamic secrets](https://docs.doppler.com/docs/dynamic-secrets) (accessed 2026-10-30) - [Doppler Share security](https://docs.doppler.com/docs/share-security) (accessed 2026-10-30) - [Doppler Kubernetes Operator](https://docs.doppler.com/docs/kubernetes-operator) (accessed 2026-10-30) - [Doppler CLI license](https://github.com/DopplerHQ/cli/blob/master/LICENSE) (accessed 2026-10-30) - [Infisical security internals](https://infisical.com/docs/internals/security) (accessed 2026-10-30) - [Infisical pricing](https://infisical.com/pricing) (accessed 2026-10-30) - [Infisical self-hosting overview](https://infisical.com/docs/self-hosting/overview) (accessed 2026-10-30) - [Infisical license](https://github.com/Infisical/infisical/blob/main/LICENSE) (accessed 2026-10-30) - [Infisical OIDC Auth](https://infisical.com/docs/documentation/platform/identities/oidc-auth/general) (accessed 2026-10-30) - [Infisical Secret Syncs](https://infisical.com/docs/integrations/secret-syncs/overview) (accessed 2026-10-30) - [Infisical dynamic secrets](https://infisical.com/docs/documentation/platform/dynamic-secrets/overview) (accessed 2026-10-30) - [Infisical secret sharing](https://infisical.com/docs/documentation/platform/secret-sharing) (accessed 2026-10-30) - [Infisical Kubernetes Operator](https://infisical.com/docs/integrations/platforms/kubernetes/overview) (accessed 2026-10-30)