License & Deployment Mix: 17 tools – 7 OSS, 7 SaaS. (OSS and SaaS counts can overlap when an open-source tool also offers a vendor-hosted edition.)
Overview
Secrets management is the practice of securely storing, accessing, distributing, and rotating sensitive credentials used by applications, services, and infrastructure. Secrets include database passwords, API keys, TLS certificates, SSH keys, encryption keys, cloud credentials, and any other data that must remain confidential.
Unlike password managers (which store human-facing credentials) or PAM (which brokers privileged human access), secrets management focuses on machine-to-machine credentials – the secrets that applications, containers, CI/CD pipelines, and infrastructure services consume programmatically.
Secrets management platforms provide:
- Encrypted secret storage – secrets stored encrypted at rest with access-controlled retrieval; no more plaintext credentials in config files, environment variables, or source code
- Dynamic secrets – generate short-lived, single-use credentials on demand (database passwords, cloud IAM tokens, TLS certificates); credentials expire automatically, eliminating stale secrets
- Secret rotation – automatically rotate static secrets (passwords, keys) on a schedule or after use; update all consumers without downtime
- PKI / certificate issuance – built-in certificate authority for issuing and managing X.509 certificates (TLS, mTLS, SSH CA); see also PKI & Certificate Management for dedicated PKI tools
- Transit encryption – encryption-as-a-service; applications send plaintext, the secrets manager encrypts it and returns ciphertext without exposing the encryption key
- Access policies – fine-grained policies controlling which applications, services, or users can access which secrets; identity-based access using tokens, certificates, or cloud IAM roles
- Audit logging – every secret read, write, rotation, and policy change logged; exportable to SIEM for compliance and incident investigation
- Leasing and TTLs – secrets issued with time-to-live (TTL); consumers must renew or request new secrets before expiry; prevents credential sprawl
The information on these pages was researched by a combination of human review and large language models. To suggest an addition or correction, please contact us. Prepared by Rhodium Systems Inc., author of the ResorsIT platform — a unified IT operations management platform for IT teams and MSPs that integrates a curated suite of open-source, commercial, and SaaS applications into a single system with shared identity, single sign-on, access control, and a common audit trail. Use this catalogue only as a starting point for your own research, and review any tool carefully against your own requirements before relying on it. Catalogue data version 2026.197.
Comparison
Deployment Model
| Tool | Self-Hosted | SaaS | License |
|---|---|---|---|
| OpenBAO | Yes | No | MPL-2.0 |
| HashiCorp Vault | Yes | Yes (HCP) | BUSL-1.1 |
| Infisical | Yes | Yes | MIT |
| CyberArk Conjur | Yes | Yes | LGPL-3.0 (OSS) |
| SOPS | Yes (CLI) | N/A | MPL-2.0 |
| age | Yes (CLI) | N/A | BSD-3-Clause |
| sealed-secrets | Yes (K8s) | N/A | Apache 2.0 |
| External Secrets Op. | Yes (K8s) | N/A | Apache 2.0 |
| Doppler | No | Yes | Proprietary |
| Akeyless | Hybrid | Yes | Proprietary |
| AWS Secrets Manager | No | Yes | Proprietary |
| AWS Parameter Store | No | Yes | Proprietary |
| GCP Secret Manager | No | Yes | Proprietary |
| Azure Key Vault | No | Yes | Proprietary |
| Vault Enterprise | Yes | Yes | Proprietary |
| 1Password Secrets | No | Yes | Proprietary |
| Delinea Secret Server | Yes | Yes | Proprietary |
Secret Engine Capabilities
| Tool | Dynamic DB | Dynamic Cloud | PKI/CA | SSH CA | Transit | KV Store |
|---|---|---|---|---|---|---|
| OpenBAO | Yes | Yes | Yes | Yes | Yes | Yes |
| HashiCorp Vault | Yes | Yes | Yes | Yes | Yes | Yes |
| Infisical | Yes | Yes | No | No | No | Yes |
| Conjur | No | No | No | No | No | Yes |
| SOPS | N/A | N/A | N/A | N/A | N/A | Yes (file) |
| Doppler | No | No | No | No | No | Yes |
| Akeyless | Yes | Yes | Yes | Yes | No | Yes |
| AWS SM | Yes (RDS) | N/A | No | No | No | Yes |
| GCP SM | No | N/A | No | No | No | Yes |
| Azure KV | No | N/A | Yes | No | Yes | Yes |
Authentication Methods
| Tool | Token | TLS Cert | K8s SA | OIDC | LDAP | Cloud IAM |
|---|---|---|---|---|---|---|
| OpenBAO | Yes | Yes | Yes | Yes | Yes | Yes |
| HashiCorp Vault | Yes | Yes | Yes | Yes | Yes | Yes |
| Infisical | Yes | Yes | Yes | Yes | No | Yes |
| Conjur | Yes | Yes | Yes | Yes | Yes | Yes |
| Doppler | Yes | No | Yes | Yes | No | No |
| Akeyless | Yes | Yes | Yes | Yes | Yes | Yes |
| AWS SM | N/A | N/A | N/A | N/A | N/A | Yes (IAM) |
| GCP SM | N/A | N/A | N/A | N/A | N/A | Yes (IAM) |
| Azure KV | N/A | N/A | N/A | N/A | N/A | Yes (Entra) |
Kubernetes Integration
| Tool | Sidecar | CSI Driver | Operator | Native |
|---|---|---|---|---|
| OpenBAO | Yes (Agent) | Yes | Yes | No |
| HashiCorp Vault | Yes (Agent) | Yes | Yes | No |
| Infisical | No | Yes | Yes | No |
| Conjur | Yes | No | Yes | No |
| sealed-secrets | N/A | N/A | Yes | Yes |
| ESO | N/A | N/A | Yes | Yes |
| Doppler | No | Yes | Yes | No |
| Akeyless | Yes | Yes | Yes | No |
High Availability
| Tool | Clustering | Replication | Auto-Unseal |
|---|---|---|---|
| OpenBAO | Yes (Raft) | Yes | Yes (Transit, KMS) |
| HashiCorp Vault | Yes (Raft) | Yes | Yes (Transit, KMS, HSM) |
| Infisical | Yes | Yes | N/A (no seal) |
| Conjur | Yes | Yes | N/A |
| Akeyless | Yes | Yes (global) | N/A |
Authentik Integration
| Tool | OIDC Auth | Admin SSO | Notes |
|---|---|---|---|
| OpenBAO | Yes | Yes (OIDC) | Authentik groups → Vault policies |
| HashiCorp Vault | Yes | Yes (OIDC) | Same as OpenBAO |
| Infisical | Yes | Yes (OIDC) | Native OIDC support |
| Doppler | No | Yes (SAML) | SAML SSO for dashboard |
| Akeyless | Yes | Yes (OIDC) | OIDC auth method |
Tools
17 tools.
1Password Secrets Automation
1Password Secrets Automation extends the popular 1Password password manager into infrastructure and application secrets management.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: none
age
age (Actually Good Encryption) is a simple, modern file encryption tool designed as a replacement for PGP/GPG.
License: BSD-3-Clause (OSS) · Kind: web · Deploy: saas, package · SSO: none
Akeyless
Akeyless is a hybrid SaaS vault platform built around a patented Distributed Fragments Cryptography (DFC) technology.
License: Proprietary (proprietary) · Kind: web · Deploy: native, saas · SSO: none
AWS Secrets Manager
AWS Secrets Manager is Amazon’s managed secrets service for storing, rotating, and retrieving credentials, API keys, and other sensitive data.
License: Proprietary (proprietary) · Kind: web · Deploy: saas, k8s · SSO: none
AWS Systems Manager Parameter Store
AWS Systems Manager Parameter Store (SSM PS) is a configuration and secrets storage service within the AWS Systems Manager suite.
License: Proprietary (proprietary) · Kind: web · Deploy: saas, k8s · SSO: none
Azure Key Vault
Azure Key Vault is Microsoft’s cloud-based service for securely storing and managing secrets, encryption keys, and TLS/SSL certificates.
License: Proprietary (proprietary) · Kind: web · Deploy: saas, k8s · SSO: none
Bitnami Sealed Secrets
Sealed Secrets is a Kubernetes controller and CLI tool (kubeseal) that enables encrypting Kubernetes Secret manifests so they can be safely stored in version control.
License: Apache-2.0 (OSS) · Kind: web · Deploy: k8s · SSO: none
CyberArk Conjur
Conjur is a secrets management platform developed by CyberArk, the leading privileged access management (PAM) vendor. The open-source edition provides centralized secrets storage, RBAC, and machine identity authentication.
License: LGPL-3.0-only (OSS) · Kind: web · Deploy: native, docker, k8s · SSO: none
Delinea Secret Server
Delinea Secret Server (formerly Thycotic Secret Server) is an enterprise privileged access management (PAM) platform focused on privileged credential storage, session management, and credential rotation.
License: Proprietary (proprietary) · Kind: web · Deploy: native · SSO: none
Doppler
Doppler is a SaaS-native secrets management platform that positions itself as a universal secrets manager for development teams.
License: Proprietary (proprietary) · Kind: web · Deploy: native, saas · SSO: none
External Secrets Operator
External Secrets Operator (ESO) is a Kubernetes operator that synchronizes secrets from external secret management systems into Kubernetes Secrets.
License: Apache-2.0 (OSS) · Kind: web · Deploy: k8s · SSO: none
Google Cloud Secret Manager
Google Cloud Secret Manager is GCP’s managed service for storing and accessing secrets such as API keys, passwords, certificates, and other sensitive data.
License: Proprietary (proprietary) · Kind: web · Deploy: saas, k8s · SSO: none
HashiCorp Vault
HashiCorp Vault is the industry-standard secrets management platform, originally released in 2015. It provides centralized secrets storage, dynamic credential generation, encryption as a service, and identity-based access control.
License: LicenseRef-BSL-1.1 (source-available) · Kind: web · Deploy: native, docker · SSO: none
HashiCorp Vault Enterprise
HashiCorp Vault Enterprise is the commercial edition of Vault, adding features required for large-scale enterprise deployments: namespaces for multi-tenancy, performance and disaster recovery replication, Sentinel policy framework, MFA enfo…
License: Proprietary (proprietary) · Kind: web · Deploy: native · SSO: none
Infisical
Infisical is a modern, developer-first secrets management platform designed to replace .env files and scattered configuration across development workflows.
License: MIT (OSS) · Kind: web · Deploy: native, docker, k8s · SSO: none
OpenBAO
OpenBAO is a community-driven, open-source (MPL-2.0) fork of HashiCorp Vault, created in December 2023 after Vault’s move to the BUSL licence; it has since diverged with its own features such as a PostgreSQL storage backend.
License: MPL-2.0 (OSS) · Kind: web · Deploy: native, docker · SSO: none
SOPS
SOPS (Secrets OPerationS) is an encrypted file editor originally created by Mozilla and now maintained by the CNCF as a Sandbox project.
License: MPL-2.0 (OSS) · Kind: web · Deploy: saas, k8s, package · SSO: none
