The Best Secrets Management Tools in 2026
One vendor bills per human, another per identity. In most infrastructures those two numbers are not close.
Doppler is free for 3 users and $8 per additional user per month, rising to $21 per user on Team. Infisical is free forever at 5 identities and $20 per identity per month billed annually.
Those units are not the same thing. A user is a person. An identity is anything that authenticates, which includes your CI pipelines, services and servers. Count both before comparing the numbers.
Key facts4 tools compared: Doppler, Infisical, HashiCorp Vault, AWS Secrets Manager
- 4 tools compared: Doppler, Infisical, HashiCorp Vault, AWS Secrets Manager
- Infisical (best for: Teams that know their identity count and want an open source core): From $20 per identity per month, billed annually; free forever at 5 identities
- HashiCorp Vault (best for: Large estates with dedicated platform teams): Open source edition is free to self-host; commercial pricing is a custom quote
- AWS Secrets Manager (best for: Teams entirely inside AWS who want one fewer vendor): Usage-based, per secret stored per month plus per API call
Secrets management is one of the few security categories where the pricing unit, not the price, is the thing to read carefully. Every vendor stores encrypted values and injects them at runtime. Where they diverge is what counts as a billable thing, and the two most common answers, users and identities, can differ by an order of magnitude in the same company.
Top Picks
Based on features, real-world fit, and value for money.
| Tool | Pricing | Best for |
|---|---|---|
| Doppler | From $8 per additional user per month; free for 3 users | Teams whose secrets are used mainly by people and by pipelines they already count |
| Infisical | From $20 per identity per month, billed annually; free forever at 5 identities | Teams that know their identity count and want an open source core |
| HashiCorp Vault | Open source edition is free to self-host; commercial pricing is a custom quote | Large estates with dedicated platform teams |
| AWS Secrets Manager | Usage-based, per secret stored per month plus per API call | Teams entirely inside AWS who want one fewer vendor |
Pricing read from each vendor's own published pricing page, checked Aug 2026. Every vendor here publishes a price.
Best for: Teams whose secrets are used mainly by people and by pipelines they already count
PricingFrom $8 per additional user per month; free for 3 users
Visit Doppler →
Best for: Teams that know their identity count and want an open source core
PricingFrom $20 per identity per month, billed annually; free forever at 5 identities
Visit Infisical →Best for: Large estates with dedicated platform teams
PricingOpen source edition is free to self-host; commercial pricing is a custom quote
Visit HashiCorp Vault →
Best for: Teams entirely inside AWS who want one fewer vendor
PricingUsage-based, per secret stored per month plus per API call
Visit AWS Secrets Manager →What it is
A secrets manager stores API keys, database credentials and tokens outside your codebase, and delivers them to applications at runtime with access control and an audit trail. It replaces the .env file that lives in three places and gets pasted into Slack once a quarter.
Why it matters
The reason to buy one is not encryption at rest, which is table stakes. It is rotation and revocation: knowing every place a credential is used, so that when someone leaves or a key leaks you can replace it in one action rather than grepping repositories.
That capability is what you are pricing, and it is why the identity count matters, since every identity is a place a secret goes.
Key features to look for
Pricing
Doppler and Infisical publish prices. HashiCorp Vault's commercial edition is quote-only, and the open source edition is free to self-host. AWS Secrets Manager bills per secret stored per month plus per API call, independent of users and identities.
The cheapest published entry is Doppler at $8 per additional user per month after 3 free users. Infisical is $20 per identity per month billed annually, or $23 billed monthly, a 13% annual saving. Costs jump at Doppler Team, $21 per user per month, plus a $9 per seat custom-roles add-on, and on Infisical when machine identities outnumber people.
| Plan | Price | Best for |
|---|---|---|
| Doppler additional user | $8 per additional user per month | Paid rate after 3 free users |
| Doppler Team | $21 per user per month | Change requests, SAML SSO and identity features |
| Doppler custom roles | $9 per seat per month | Add-on for fine-grained custom roles |
| Infisical annual | $20 per identity per month, billed annually | Billed annually, a 13% saving versus monthly |
| Infisical monthly | $23 per identity per month, billed monthly | Same paid tier, billed monthly |
| HashiCorp Vault | Custom quote | Commercial pricing requires a sales conversation |
| AWS Secrets Manager | Per secret stored per month plus per API call | Independent of users or identities |
The bottom line
For a small team with a modest number of services, Doppler's free tier for 3 users and $8 per additional user is the simplest thing to budget, because it prices something you already know. Infisical at $20 per identity is the more honest unit for the job and the better fit once you have counted your machine identities and they are not overwhelming.
If you are inside AWS and hold a manageable number of secrets, per-secret billing avoids the question entirely. Vault remains the answer for large estates, and the cost is an engineer rather than an invoice.
Frequently asked questions
Some offers on this page may be paid placements or contain affiliate links.
Get the Cyberpresso brief
Free daily newsletter, read in 5 minutes.
Subscribe free