Cyberpresso Cyberpresso
Expert Guide Editorially reviewed

The Best Secrets Management Tools in 2026

One vendor bills per human, another per identity. In most infrastructures those two numbers are not close.

LC
Louis CorneloupFounder, Dupple · 810,000+ readers · Updated Aug 2026
Independently researched. No pay-for-placement. 4 tools compared
TL;DR

Doppler is free for 3 users and $8 per additional user per month, rising to $21 per user on Team. Infisical is free forever at 5 identities and $20 per identity per month billed annually.

Those units are not the same thing. A user is a person. An identity is anything that authenticates, which includes your CI pipelines, services and servers. Count both before comparing the numbers.

Secrets management is one of the few security categories where the pricing unit, not the price, is the thing to read carefully. Every vendor stores encrypted values and injects them at runtime. Where they diverge is what counts as a billable thing, and the two most common answers, users and identities, can differ by an order of magnitude in the same company.

Top Picks

Based on features, real-world fit, and value for money.

Best Secrets Management Tools: 4 tools compared, updated Aug 2026
ToolPricingBest for
DopplerFree for 3 users, then $8 per month per additional user. Team at $21 per user per month with change requests, SAML SSO…Teams whose secret consumers are mostly people and pipelines they already count
InfisicalFree forever with 5 identities. Paid at $20 per identity per month billed annually, or $23 billed monthly, a 13% annual…Teams that know their identity count and want an open source core
HashiCorp VaultOpen source edition is free to self-host. Commercial pricing is not published and requires a sales conversationLarge estates with dedicated platform teams
AWS Secrets ManagerUsage-based, charged per secret stored per month plus per API call. Priced independently of users or identitiesTeams entirely inside AWS who want one fewer vendor

Pricing read from each vendor's own published pricing page, checked Aug 2026. Every vendor here publishes a price.

1

Doppler

Top Pick

Best for: Teams whose secret consumers are mostly people and pipelines they already count

PricingFree for 3 users, then $8 per month per additional user. Team at $21 per user per month with change requests, SAML SSO and identity features. Custom roles are an add-on at $9 per seat per month

Visit Doppler →
2

Infisical

Best for: Teams that know their identity count and want an open source core

PricingFree forever with 5 identities. Paid at $20 per identity per month billed annually, or $23 billed monthly, a 13% annual saving

Visit Infisical →
3

HashiCorp Vault

Best for: Large estates with dedicated platform teams

PricingOpen source edition is free to self-host. Commercial pricing is not published and requires a sales conversation

Visit HashiCorp Vault →
4

AWS Secrets Manager

Best for: Teams entirely inside AWS who want one fewer vendor

PricingUsage-based, charged per secret stored per month plus per API call. Priced independently of users or identities

Visit AWS Secrets Manager →

What it is

A secrets manager stores API keys, database credentials and tokens outside your codebase, and delivers them to applications at runtime with access control and an audit trail. It replaces the .env file that lives in three places and gets pasted into Slack once a quarter.

Why it matters

The reason to buy one is not encryption at rest, which is table stakes. It is rotation and revocation: knowing every place a credential is used, so that when someone leaves or a key leaks you can replace it in one action rather than grepping repositories.

That capability is what you are pricing, and it is why the identity count matters, since every identity is a place a secret goes.

Key features to look for

Billing unit
Per user or per identity. This is the whole comparison. A team of ten people can easily run a hundred machine identities, and only one of these models charges for them.
Free tier shape
Doppler is free for 3 users, Infisical free forever at 5 identities. The two limits constrain completely different things.
Rotation
Automatic credential rotation on a schedule or on demand. The main reason to buy rather than build, and the feature most often gated to higher tiers.
Access controls
Who can read which secret in which environment. Doppler prices fine-grained custom roles as an add-on at $9 per seat per month.
CI and runtime integrations
How secrets reach the running process. Breadth here decides whether the tool covers your whole estate or becomes the second place secrets live, which is worse than one place.
Audit trail
Who accessed what and when. Required for most compliance regimes and the first thing an auditor asks for.
Mistakes to avoid
×Comparing $8 to $20 directly. Doppler's $8 buys a person, Infisical's $20 buys an identity, and most infrastructures have far more identities than people. Count both before either number means anything.
×Forgetting machine identities exist. CI runners, containers, scheduled jobs and services each authenticate. In per-identity pricing these are the bill, and they are invisible on an org chart.
×Treating self-hosted Vault as free. There is no licence cost and a substantial operational one, and the moment it becomes critical infrastructure someone owns it full time.
Expert tips
→Inventory your identities before requesting a quote. Count CI pipelines, running services and scheduled jobs alongside people. The number usually surprises teams, and it is the number that decides which pricing model is cheaper.
→Check what rotation costs. It is the reason to buy a secrets manager and it is frequently on a higher tier than the storage that gets demoed.
→Price the AWS option separately if you are on AWS. Per-secret and per-call billing is a third model entirely, and for a small number of secrets accessed often, or a large number accessed rarely, it lands in a completely different place.

The bottom line

For a small team with a modest number of services, Doppler's free tier for 3 users and $8 per additional user is the simplest thing to budget, because it prices something you already know. Infisical at $20 per identity is the more honest unit for the job and the better fit once you have counted your machine identities and they are not overwhelming.

If you are inside AWS and hold a manageable number of secrets, per-secret billing avoids the question entirely. Vault remains the answer for large estates, and the cost is an engineer rather than an invoice.

Frequently asked questions

How much does secrets management cost?
Doppler is free for 3 users then $8 per additional user per month, or $21 per user on Team. Infisical is free at 5 identities then $20 per identity per month billed annually. AWS Secrets Manager bills per secret and per API call. HashiCorp does not publish commercial pricing.
What is an identity in secrets management pricing?
Anything that authenticates to retrieve a secret, which includes people but also CI pipelines, services and servers. It is the reason a per-identity price and a per-user price cannot be compared without counting your own infrastructure first.
Is a secrets manager worth it for a small team?
The threshold is usually rotation rather than size. Once you cannot answer where a credential is used well enough to replace it in an afternoon, you need one, and that point arrives earlier than most teams expect.
Should I self-host?
Only with someone to own it. Both Infisical and Vault offer self-hosted paths, and both convert a subscription into operational work. That trade is sensible when you have a platform team and expensive when you do not.
Related guides
Password ManagersVulnerability ScannersSiem ToolsCybersecurity Statistics 2026

Get the Cyberpresso brief

Free daily newsletter, read in 5 minutes.

Subscribe free