How we make this list: we compare pricing pages, product documentation and public user reviews. Rankite is independent; if a vendor ever pays for a featured spot, that listing is clearly labeled Partner.
Key takeaways
- HashiCorp Vault remains the deepest option for multi-cloud teams that need dynamic secrets, but it demands real operational effort.
- Doppler is the fastest path for product teams that just want environment variables and API keys synced safely across every environment.
- AWS and Google native vaults are the cheapest choice for single-cloud estates; they stop making sense the moment you span clouds.
- Akeyless and Infisical give you a managed or open-source alternative to running Vault yourself, with free tiers to start.
Quick comparison
| Tool | Best for | Starting price | Free plan |
|---|
 HashiCorp Vault | multi-cloud teams that need dynamic secrets | $0.50 per secret/month (Vault Secrets SaaS) | Yes (25 secrets on the free tier) |
 Doppler | developer teams that want secrets synced everywhere | $8 per user/month (Developer plan) | Yes (free for up to 3 users) |
 Akeyless | enterprises that want Vault-like depth as SaaS | See website | Yes (free tier with 5 clients) |
 AWS Secrets Manager | teams running entirely on AWS | $0.40 per secret/month | No |
 Google Cloud Secret Manager | GCP-centric teams that want the cheapest native vault | $0.06 per secret version/month | Yes (6 versions and 10,000 access operations monthly) |
 Infisical | open-source-first teams that want to self-host | See website | Yes (free self-hosted edition) |
 CyberArk Conjur | regulated enterprises already invested in CyberArk | See website | Yes (open source edition) |
 1Password Secrets Automation | teams already paying for 1Password | $8.99 per user/month (Business, billed annually) | Free trial (14 days) |
 Keeper Secrets Manager | compliance-heavy organizations that need FedRAMP | $10 per user/month (billed annually) | Free trial |
Is your product missing or out of date?
We review this list regularly. Vendors can request a listing, send updated pricing or ask about featured placement.
Somewhere in your company, a production database password lives in a Slack thread. An old API key is still valid even though the vendor was dropped two years ago. The deployment pipeline reads secrets from a shared spreadsheet that half the team can open. If any of that sounds familiar, the question is not whether you need a secrets manager. It is which one fits the way your team actually builds and ships software.
Starting price$0.50 per secret/month (Vault Secrets SaaS)
Free planYes (25 secrets on the free tier)
Vault is the reference point every other tool on this list gets measured against. It stores static secrets, mints short-lived dynamic credentials for databases and cloud accounts, handles encryption as a service, and logs every access in detail. When your security team asks for proof of who touched which credential and when, Vault has the answer ready.
The honest catch is operational weight. Running Vault well means clusters, unsealing, upgrades and policy design, which is a real job. The SaaS option (Vault Secrets at $0.50 per secret per month) removes that burden, with a free tier of 25 secrets to start. Watch the license: Vault moved to a Business Source License in 2023, so check the current terms with procurement before standardizing on it.
What we like- On-demand dynamic secrets for databases and cloud accounts
- Fine-grained policy engine with full audit logs
- Enormous integration ecosystem
Watch out for- Heavy to operate yourself
- Moved to BUSL licensing after 2023
- Enterprise pricing is quote-based
#2
Doppler
Best for: developer teams that want secrets synced everywhere
Visit doppler.com
Starting price$8 per user/month (Developer plan)
Free planYes (free for up to 3 users)
Doppler wins on developer experience. You organize secrets per project and environment once, and they flow to local dev, staging, production, Vercel, GitHub Actions and cloud secret stores through sync integrations. The CLI figures out which secrets belong to your directory the way git figures out your repo, which is why small teams adopt it in an afternoon.
The pricing model is refreshingly simple: you pay per human seat, and machine identities cost nothing extra, which matters for teams running AI agents alongside engineers. The Developer plan starts at $8 per user per month after the free tier for three users, while Team at $21 per user per month adds SAML SSO, rotation and longer audit retention. Doppler recently added an on-prem option on Enterprise, which answers the old objection that it was cloud-only.
What we like- Clean CLI with broad sync integrations
- Per-seat pricing with no charge for machine identities
- On-prem deployment now available on Enterprise
Watch out for- Team plan at $21 per user/month adds up fast
- Dynamic secrets are still early-stage
- Closed source
#3
Akeyless
Best for: enterprises that want Vault-like depth as SaaS
Visit akeyless.io
Starting priceSee website
Free planYes (free tier with 5 clients)
Akeyless pitches itself as the secrets platform for teams that like what Vault does but do not want to operate Vault. It is delivered as SaaS, built on a distributed-fragments cryptography design that keeps key material under customer control, and it extends beyond secrets into certificate lifecycle and privileged access. The free tier covers 5 clients and 2,000 static secrets, which is enough for a genuine pilot.
The tradeoff is opacity on pricing: you will talk to sales before you see a number, and client-based pricing means your bill scales with machine identities unless you model it first. Teams that need short-lived, identity-based access without standing credentials tend to find the tradeoff worth it.
What we like- No infrastructure to run or patch
- Identity-based access with no standing credentials
- Covers certificates and PAM in one platform
Watch out for- Paid tiers require a sales conversation
- Client-based pricing needs careful forecasting
- Vault API compatibility is close but not identical
Starting price$0.40 per secret/month
Free planNo
If everything you run lives in AWS, the native option is hard to beat. Secrets Manager integrates with IAM, rotates database credentials automatically, and shows up in CloudTrail for auditing. At $0.40 per secret per month plus $0.05 per 10,000 API calls, the math is simple and the first months are nearly free.
The limits appear the moment you leave AWS. Cross-cloud governance, non-AWS Kubernetes clusters and developer-friendly sync are all thinner here than in dedicated tools. Use it as your AWS vault; do not expect it to govern the rest of your estate.
What we like- Native IAM integration and built-in rotation for RDS and Redshift
- Nothing extra to deploy
- Predictable per-secret pricing
Watch out for- API call fees add up for chatty applications
- Thin outside AWS
- No multi-cloud governance story
#5
Google Cloud Secret Manager
Best for: GCP-centric teams that want the cheapest native vault
Visit cloud.google.com
Starting price$0.06 per secret version/month
Free planYes (6 versions and 10,000 access operations monthly)
Google's Secret Manager charges $0.06 per active secret version per location per month plus $0.03 per 10,000 access operations, and the free tier hands you 6 versions and 10,000 operations every month. For a startup on Cloud Run or GKE, that is effectively free secrets management with IAM access control and audit logging built in.
Two details catch buyers out. Replication across regions multiplies the per-version charge, so user-managed replication needs a real estimate. And like its AWS cousin, this is a single-cloud vault: it does not extend governance to the rest of your infrastructure.
What we like- Generous always-free tier
- Native fit with Cloud Run, Functions and GKE
- Cheapest per-secret pricing at volume
Watch out for- Per-location version pricing multiplies with replication
- GCP-only
- Rotation needs Pub/Sub wiring
Starting priceSee website
Free planYes (free self-hosted edition)
Infisical is the open-source answer for teams that want Doppler-style usability without giving up self-hosting. It is free to self-host, the dashboard is genuinely pleasant, and it has grown fast around secrets management, certificate lifecycle and secret scanning. Paid cloud tiers exist for teams that would rather not run it.
The honest tradeoff is maturity. Vault has a decade of production scars and a plugin for everything; Infisical is newer, and dynamic on-demand secrets are a paid-tier feature. If a long production track record is a procurement requirement, budget extra evaluation time.
What we like- Modern UI developers actually enjoy using
- Self-hostable under an open-source license
- Covers certificates and secret scanning alongside secrets
Watch out for- Younger product with a smaller ecosystem than Vault
- Dynamic secrets sit on paid tiers
- Fewer proven mega-scale deployments
#7
CyberArk Conjur
Best for: regulated enterprises already invested in CyberArk
Visit cyberark.com
Starting priceSee website
Free planYes (open source edition)
Conjur extends CyberArk's privileged access platform into application and machine secrets, with policy written as code in YAML and checked into source control. For organizations already running CyberArk PAM, it unifies human and non-human privileged access under one governance model, which auditors love.
It is not a light tool. Self-hosted Conjur is real infrastructure, enterprise pricing is per identity and quote-based, and the Palo Alto Networks acquisition of CyberArk introduces some roadmap uncertainty worth asking about directly. For greenfield secrets programs, the broader platform can be more than you need.
What we like- Security policy as code with granular RBAC
- Strong Kubernetes, mainframe and RPA coverage
- Unified view of human and machine identities
Watch out for- Heavy to operate
- Priced per identity
- Roadmap questions after the Palo Alto Networks acquisition
#8
1Password Secrets Automation
Best for: teams already paying for 1Password
Visit 1password.com
Starting price$8.99 per user/month (Business, billed annually)
Free planFree trial (14 days)
If your company already runs on 1Password, Secrets Automation extends the vault your people know into your infrastructure. The Connect server syncs secrets into your private cloud so applications fetch them at runtime, and developers use the same CLI habits they already have. Business now lists at $8.99 per user per month billed annually, with a 14-day trial.
The catch is fit: this is vault-extended secrets management, not a dedicated platform like Vault or Akeyless. It shines for human-adjacent secrets and app configs; it is less natural as the single governance layer for thousands of machine identities.
What we like- Secrets live where employees already work
- Connect server keeps secrets off developer machines
- Mature CLI and SDKs
Watch out for- Needs a Business seat per user
- Not a standalone secrets platform
- Adds up for large machine fleets
Starting price$10 per user/month (billed annually)
Free planFree trial
Keeper brings its password-management pedigree into infrastructure secrets, and the compliance story is its strongest card: FedRAMP and StateRAMP authorization plus ISO 27001 and SOC 2 make it an easy procurement sell in government-adjacent industries. Pricing starts at $10 per user per month billed annually, including 50,000 API calls per user per month.
Model your API volume honestly, because extra calls cost $10 per 25,000 and support can add 10 percent. For teams whose buying decision runs through a compliance checklist, though, Keeper clears hurdles that stop other tools cold.
What we like- FedRAMP and StateRAMP authorized
- 50,000 API calls per user per month included
- Zero-knowledge architecture
Watch out for- Overage at $10 per additional 25,000 API calls
- 10 percent support surcharge possible
- Password-manager DNA shows at scale
How we chose
We compared the tools teams actually evaluate for secrets in enterprise DevSecOps: dedicated vault platforms, developer-first SaaS, the three cloud-native secret stores, and vault-extended options from password managers. We checked current pricing pages and vendor documentation, read through public reviews on G2, Capterra and Reddit, and weighed feature depth against operational cost for small and mid-size companies. Nobody paid for placement, and nothing here is based on a hands-on trial we did not run.
What to check before you buy
Start with your cloud footprint. Single-cloud teams should stay with the native vault and spend the savings on rotation automation; multi-cloud teams need a dedicated platform with real governance across environments. Then count your machine identities, not just your engineers, because per-seat pricing and per-identity pricing produce wildly different bills at scale.
Ask about rotation for your specific databases, because built-in rotation for RDS or Cloud SQL beats a custom Lambda you will maintain forever. Check the audit story: can you show an auditor exactly who read which secret and when, without building a pipeline yourself? Finally, test the developer experience with a real team for a week. The vault developers avoid becomes the vault with stale secrets.
What secrets management actually costs
Pricing models in this category refuse to line up, so normalize before you compare. Per-secret pricing (AWS at $0.40, Vault SaaS at $0.50, Google at $0.06 per version) rewards teams with few secrets and punishes secret sprawl. Per-seat pricing (Doppler at $8 to $21, 1Password at $8.99, Keeper at $10) rewards heavy machine-to-machine use and punishes large human teams. Quote-based enterprise tools (CyberArk, Akeyless) need a real usage model before you sign.
The hidden costs are rotation engineering, the audit pipeline, and the on-call load of running a vault yourself. A tool that looks expensive per seat often wins once you price the alternative honestly.
Frequently asked questions
What is the best secrets management tool for a small team?
Doppler or Infisical usually win for small teams: Doppler for the fastest setup with a free tier for three users, Infisical if you want open source and self-hosting at no license cost.
Is HashiCorp Vault still free?
Vault has a free tier on the SaaS product (25 secrets) and remains available under a Business Source License for self-hosting. Enterprise features and support require a paid contract.
Should I use my cloud provider's secret manager instead of Vault?
If you run on one cloud, yes: the native vault is cheaper and simpler. Move to Vault, Akeyless or Conjur when you span clouds, need dynamic secrets, or face centralized governance requirements.
How do these tools handle secret rotation?
AWS and Google offer built-in rotation for common databases; Doppler added rotation on its Team plan; Vault, Akeyless and Conjur support dynamic short-lived credentials that expire automatically. Check your specific database before you commit.
What is the difference between a secrets manager and a password manager?
Password managers secure human credentials for websites and apps; secrets managers secure machine credentials like API keys and database passwords with APIs, rotation, and audit trails built for infrastructure.
Sources we checked (11)
- https://infisical.com/blog/secrets-manager-pricing
- https://infisical.com/blog/akeyless-vs-hashicorp-vault
- https://gbhackers.com/best-secrets-management-compared/
- https://www.akeyless.io/blog/azure-key-vault-alternatives/
- https://github.com/dorucioclea/vibeship-knowledgebase/blob/HEAD/docs/.content-ops/briefs/best-secrets-management-tools-brief.md
- https://github.com/data-advantage/vibereference/blob/HEAD/content/devops-and-tools/secret-management-providers.md
- https://tech-insider.org/1password-vs-lastpass-vs-roboform-2026/
- https://www.getapp.sg/software/2059469/keeper-secrets-manager
- https://slashdot.org/software/comparison/Doppler-vs-HashiCorp-Vault/
- https://cloud.google.com/secret-manager/pricing
- https://www.mtlc.co/cyberark-launches-open-source-secrets-management-solution-for-devops/
Is your product missing or out of date?
We review this list regularly. Vendors can request a listing, send updated pricing or ask about featured placement.
Shihab Mia · Founder, Rankite
Shihab has spent more than a decade helping SaaS and e-commerce brands grow through search. He writes Rankite's software buying guides from pricing pages, documentation and public user reviews. More about Shihab.