Best secrets managers for small teams (2026)

This list is written by a vendor, Crunu, so we have tried to make it useful anyway: the criteria are written down, every fact about another product comes from that product's own documentation, and each pick is the best fit for a specific kind of small team, not a score.

By small team we mean roughly 2 to 50 people, with a few applications, a handful of environments, some servers and a CI system, and nobody whose whole job is running secrets infrastructure. For a team like that, the right tool depends far more on two or three questions than on feature counts.

How we compared

We looked at every product through the same six questions.

1. Who can decrypt your values. Some products decrypt on their own servers to answer requests; others only ever hand ciphertext to the server and decrypt on your devices. Both are legitimate, but they put different people inside your trust boundary.
2. What you have to run. A managed service, a server you host, a cluster you operate, or no server at all.
3. How CI and servers sign in. A long-lived token stored as a pipeline secret, or a short-lived OIDC token from the CI provider that cannot be reused elsewhere.
4. What happens when someone leaves. Whether access stops at once, whether keys change, and whether the tool helps you know what to reissue.
5. Cost model for a small team. Per user, per identity including machines, per secret and per call, or free.
6. Fit with your platforms. Syncs to hosting providers, Kubernetes support, SSO, and the operating systems your team uses.

We did not score products or add up features. A tool with fewer features can be the right pick, and a tool with many can be the wrong one.

We also left some things out on purpose. We did not compare certifications, support quality or performance, because we could not check them the same way for every product from public documentation. We did not test products against each other in a lab. And we did not include tools built only for Kubernetes clusters, such as operators that sync secrets into a cluster, because most small teams meet secrets in .env files, CI settings and servers first.

The short list

Who can decrypt, in one paragraph

This question is worth a moment before the picks. Doppler, Infisical, HashiCorp Vault, AWS Secrets Manager, Google Secret Manager and Azure Key Vault all decrypt values on the server before returning them to an authorized caller; their own documentation says so. 1Password outside its Credential Broker preview, Bitwarden Secrets Manager, Keeper Secrets Manager, Phase in its default mode and Crunu decrypt only on clients. Akeyless sits in between: with a Customer Fragment in a Gateway you run, it says it cannot complete operations without you. File tools such as SOPS have no server at all. The who can decrypt guide goes through every product with quotes.

Best managed service with many integrations: Doppler

Doppler suits teams that want nothing to run and secrets to flow into the platforms they deploy to. It pushes values to AWS, Google Cloud and Azure secret stores, GitHub, GitLab, Vercel, Netlify and more, has a Kubernetes Operator that reloads deployments when secrets change, and its doppler run command injects variables into any process.

Why it suits small teams. The Developer plan is free for 3 users. Paid plans are priced per user, and Doppler's pricing page says that AI agents and non-human identities are not billed, so a few developers with many servers and pipelines pay for the people only. The Team plan adds OIDC sign-in for service accounts, SAML SSO, change requests and automatic rotation.

Watch out for. Doppler's security fact sheet says its web servers send secrets to an internal tokenization service that encrypts and decrypts them with a key per workplace. Decryption happens on Doppler's infrastructure. Self-hosting exists as Doppler On-prem, but only on the Enterprise plan, and the server source is not public. The free plan keeps 3 days of activity logs.

Compare: Doppler vs Infisical, Crunu vs Doppler.

Best open-source server you host: Infisical

Infisical is an open-source secrets server that a team can run itself. The core is MIT-licensed outside its ee/ directories, and self-hosting starts with a single packaged container, or a Docker Compose template with PostgreSQL and Redis, and scales to a high availability cluster. Infisical Cloud is there if you would rather not run it.

Why it suits small teams. The free plan covers 5 identities with unlimited projects. Infisical has projects and environments, secret versioning, syncs to GitHub, Vercel, AWS and others, a Kubernetes Operator, and OIDC Auth that accepts JWTs from any OIDC provider. Dynamic secrets are on the Advanced plan.

Watch out for. Infisical decrypts on the server: its documentation says the server "retrieves and decrypts requested data" before responding, using keys under a root key that the operator provides as an environment variable. Paid plans are priced per identity, and an identity is any human or machine, so pipelines and servers count.

Compare: Infisical vs HashiCorp Vault, Crunu vs Infisical.

Best open source that encrypts on your devices: Phase

Phase is the product closest to Crunu's model, and if open source matters to you it is the one to look at first. By default it encrypts on the client: every environment has its own key, wrapped to each account's public key to grant access, so the server stores ciphertext. Its Lockbox links keep the decryption seed in the URL fragment, which never reaches the server.

Why it suits small teams. Phase Cloud is free for up to 5 users or service accounts and 3 environments, and the free self-hosted plan has no limit on users or service accounts. The paid Cloud plan is priced per user, with unlimited service accounts. The code is MIT-licensed outside its ee/ directories, and it self-hosts with Docker Compose, Kubernetes or major clouds. It has a Kubernetes Operator and syncs to third-party platforms.

Watch out for. Syncs and the REST API need an app to opt into server-side encryption, which stores a key on the server for that app. Dynamic secrets, for AWS IAM credentials, are on Enterprise and also need server-side encryption. For CI, Phase documents external identities for AWS IAM and Azure; sign-in with a CI provider's own OIDC token is not documented. SSO and SCIM are on Enterprise.

Compare: Crunu vs Phase.

Best low-cost start with on-device encryption: Bitwarden Secrets Manager

Bitwarden Secrets Manager is a separate product from Bitwarden's password manager, built for machine secrets. Bitwarden says "all encryption and decryption of secrets data is done client-side": a machine's access token carries the key that decrypts the organization key locally.

Why it suits small teams. The free plan covers up to 2 users, 3 projects and 3 machine accounts. Teams and Enterprise are priced per user and include machine accounts, up to 20 and 50. The source code is public, the bws CLI runs on Windows, macOS and Linux, and Enterprise organizations can self-host with Docker. There is a Kubernetes Operator and integrations for GitHub Actions and GitLab.

Watch out for. CI uses a machine account access token stored as a pipeline secret; no OIDC sign-in is documented. Access tokens expire "Never" by default, and after you revoke one, an already authenticated machine "may continue to retrieve and decrypt secrets for up to one hour". Environments are not a separate concept: projects group secrets for access, and one organization key decrypts all secrets.

Compare: 1Password vs Bitwarden Secrets Manager, Crunu vs Bitwarden Secrets Manager.

Best if you already use 1Password: 1Password

If your company already pays for 1Password Business, putting developer secrets there keeps them with the admins and policies you already have. Vaults are encrypted on your devices, and 1Password never has the unencrypted vault key. For developers there are Environments, which can mount .env files locally without writing them to disk, service accounts, self-hosted Connect servers, a CLI and Kubernetes integrations. Sign-in through your identity provider and SCIM provisioning come with Business.

Why it suits small teams. One tool for logins, passkeys and developer secrets, managed by the admins you already have. Credential Broker, in public preview on Business, lets GitHub Actions jobs sign in with their OIDC token instead of a stored service account token.

Watch out for. There is no free team plan: the Teams Starter Pack is for 10 to 20 members, and Business is priced per user with a 14-day trial. Service accounts have hourly and daily rate limits. And 1Password's white paper is frank about removal: it "isn't cryptographically enforced" and keys are not changed, although the server stops sending data; moving items to a new vault gives them a new key.

Compare: 1Password vs Bitwarden Secrets Manager, Crunu vs 1Password.

Best when the server must not decrypt, even for CI: Crunu

Crunu is our product, so read this section with that in mind. It is built for teams whose secrets are .env files, cloud credentials and API keys, read by people, servers and pipelines, and who want a server that cannot decrypt any of them.

Why it suits small teams. Values are encrypted in the browser and the crunu agent, and the server stores only ciphertext, public keys and signed documents, for people, for machines and for CI alike. Each environment has its own key, sealed separately to every recipient, so a developer with development access never holds the production key. Pipelines on GitHub Actions, GitLab CI, Bitbucket Pipelines or any OIDC issuer use service tokens bound to a repository, branch and deployment environment. You can use the Crunu cloud, which is free during early access, or, on the Enterprise plan, host the server yourself on Docker, Cloudflare Workers, Vercel or Google Cloud Run, and move it between them with one archive.

The day someone leaves is where Crunu is most different. Removing a person stops the server serving them, rotates the keys of every environment they could read, shows which versions they received, and lists the values to reissue at each provider.

Watch out for. Crunu has no syncs to other platforms, no dynamic secrets, no automatic rotation of values at providers, no Kubernetes support, no SSO or SCIM, no SDKs and no Windows agent. Its source code is not published. It is a new product in early access, without a published SOC 2 report or external audit. The server still sees metadata such as names, email addresses and timestamps; the limitations page lists the rest. Phase and Bitwarden Secrets Manager share the basic promise that the server cannot decrypt, so Crunu is not alone there.

Compare: Crunu vs Doppler, Crunu vs Infisical, Crunu vs Phase.

Best for secrets that live in Git: SOPS

If you want secrets in the repository, reviewed in the same pull requests as the code, look at SOPS first. It encrypts only the values in YAML, JSON, ENV and INI files, so key names stay readable and diffs show which value changed. Keys come from age, PGP, AWS KMS, Google Cloud KMS, Azure Key Vault or HuaweiCloud KMS, and there is no server to run. It is MPL 2.0 and a CNCF Sandbox project.

Watch out for. Removing someone means removing their key, running sops updatekeys and sops rotate on every file, and then reissuing the secrets, because old commits still open with the old data key. CI needs a private key or cloud KMS access.

Other file tools. Ansible Vault fits teams that deploy with Ansible, but everyone shares a vault password. dotenvx encrypts .env files with a keypair per file and has a paid service, Armor, for key custody and audit. git-crypt encrypts whole files transparently but, by its own README, cannot revoke access once granted.

Compare: SOPS vs Ansible Vault, Crunu vs SOPS, Crunu vs dotenvx, Crunu vs git-crypt.

Best when everything runs on one cloud: your provider's store

If every workload runs on one cloud, its own secret store is hard to beat for integration. Access uses the IAM roles your workloads already have, CI can assume those roles through OIDC, and there is nothing to operate.

• AWS. Parameter Store standard parameters carry no additional charge and suit configuration and a modest number of secrets. Secrets Manager adds rotation, cross-account access and Region replication, at a price per secret and per API call.
• Google Cloud. Secret Manager has monthly free usage, and Workload Identity Federation lets pipelines on GitHub Actions and GitLab use their OIDC tokens.
• Azure. Key Vault is billed per 10,000 operations, and Microsoft Entra controls sign-in.

Watch out for. In all three, the provider's service decrypts the value for any principal your policies allow; a customer managed key controls who may use the key, not where decryption happens. Microsoft itself suggests a separate protection key for highly sensitive data. These stores also do not help much with laptops and .env files shared between people.

Compare: AWS Secrets Manager vs Parameter Store, HashiCorp Vault vs AWS Secrets Manager.

Best for dynamic secrets: HashiCorp Vault or OpenBao

If you need database and cloud credentials created on demand and revoked when the lease ends, or PKI and encryption as a service in the same platform, look at HashiCorp Vault. HashiCorp is now part of IBM. Vault Community is free to run under the Business Source License 1.1; OpenBao is an open-source fork managed by the Linux Foundation's OpenSSF.

Watch out for. A Vault server starts sealed and decrypts on the server once unsealed. In the default configuration, unsealing with key shares is, in HashiCorp's words, "a manual process", and auto unseal needs a cloud KMS. Community edition lacks namespaces, replication and secrets sync. HCP Vault Dedicated removes the operations work as a paid service, and HCP Vault Secrets, the lighter managed product, reached end of life no later than July 1, 2026.

Compare: Crunu vs HashiCorp Vault, Infisical vs HashiCorp Vault.

Also considered

• Akeyless. A broad SaaS platform with dynamic secrets, syncs and Kubernetes injection, and a free plan for 5 clients. With a Customer Fragment in a Gateway you run, Akeyless says it cannot complete operations without you, at the cost of more setup. See Crunu vs Akeyless.
• Keeper Secrets Manager. Encrypts and decrypts on the client, with one-time share links and one-way sync to AWS, Azure and Google Cloud. It runs in Keeper's cloud, or on your own infrastructure with the separate Self-Managed Keeper, and is a paid add-on to Keeper business plans. See Crunu vs Keeper Secrets Manager.
• EnvKey. End-to-end encrypted, but EnvKey Cloud shut down on February 1, 2025. See the page for former EnvKey users.

What a team of ten pays for

Prices change, so we compare what each product counts rather than amounts. The example is a team of 10 people with 15 servers and pipelines that read secrets. Check each pricing page for current numbers.

The cheapest option on paper is not always the cheapest in practice. A free self-hosted server still needs someone to patch, back up and restore it, and per-identity pricing can grow quietly as pipelines are added. Count the hours as well as the seats.

How to choose in five questions

1. Must the vendor be unable to read values? If yes, start with Phase, Bitwarden Secrets Manager, 1Password, Keeper or Crunu. If server-side decryption is acceptable, Doppler and Infisical open up.
2. Do you want to run anything? Nothing, with a managed service: Doppler, 1Password, Bitwarden, Phase Cloud, the Crunu cloud or your cloud's store. A small self-hosted server: Infisical, Phase, or Crunu on its Enterprise plan. A cluster: Vault. No server at all: SOPS and the other file tools.
3. How does CI sign in? If you want OIDC instead of stored tokens, check the details: Doppler on Team, Infisical, Vault, the cloud stores and Crunu support it; 1Password has it in preview; Bitwarden and Phase do not document it for CI providers.
4. How often do people leave? If often, prefer a tool where removal changes keys or ends access cleanly, and that tells you what to reissue. Check what each one does before you need it.
5. Which platforms must it reach? If you need syncs into Vercel, Netlify or cloud stores, Kubernetes operators or Windows, rule out the tools without them early. That rules out Crunu for many teams.

Whatever you pick, keep secrets out of chat and out of unencrypted files in Git, give each person and machine only the environments it needs, and write down what you will reissue when someone leaves. The comparison matrix has every fact on this page side by side, with its source.