1Password CLI

HashiCorp Vault

hashicorp/vault

Popular

Industry-standard secrets engine with dynamic credentials, PKI and encryption-as-a-service; BSL, owned by IBM.

OpenBao

openbao/openbao

Rising

Linux Foundation open-source (MPL) fork of Vault, API-compatible, created after HashiCorp's license change.

AWS Secrets Manager

aws.amazon.com

Popular

Managed AWS service for storing secrets with automatic rotation for RDS and other services.

Infisical

Infisical/infisical

Trending

Open-source secrets platform with environment sync, dynamic secrets, PKI and Kubernetes integration.

SOPS

getsops/sops

Popular

Encrypts values in YAML, JSON and .env files with KMS, age or PGP so secrets can live in Git; CNCF project.

External Secrets Operator

external-secrets/external-secrets

Popular

Syncs secrets from Vault, AWS, GCP, Azure and other stores into Kubernetes Secrets.

Sealed Secrets

bitnami/sealed-secrets

Encrypts Kubernetes Secrets into SealedSecrets that are safe to commit and only decrypted in-cluster.

Doppler

doppler.com

SaaS secrets manager that syncs environment variables across environments, CI and cloud platforms.

dotenvx

dotenvx/dotenvx

Trending (detected automatically)Rising

Encrypted .env files from the creator of dotenv, so secrets can be committed and decrypted at runtime.