dotenvx

HashiCorp Vault

hashicorp/vault

Popular

Industry-standard secrets engine with dynamic credentials, PKI and encryption-as-a-service; BSL, owned by IBM.

OpenBao

openbao/openbao

Rising

Linux Foundation open-source (MPL) fork of Vault, API-compatible, created after HashiCorp's license change.

AWS Secrets Manager

aws.amazon.com

Popular

Managed AWS service for storing secrets with automatic rotation for RDS and other services.

Infisical

Infisical/infisical

Trending

Open-source secrets platform with environment sync, dynamic secrets, PKI and Kubernetes integration.

SOPS

getsops/sops

Popular

Encrypts values in YAML, JSON and .env files with KMS, age or PGP so secrets can live in Git; CNCF project.

External Secrets Operator

external-secrets/external-secrets

Popular

Syncs secrets from Vault, AWS, GCP, Azure and other stores into Kubernetes Secrets.

Sealed Secrets

bitnami/sealed-secrets

Encrypts Kubernetes Secrets into SealedSecrets that are safe to commit and only decrypted in-cluster.

Doppler

doppler.com

SaaS secrets manager that syncs environment variables across environments, CI and cloud platforms.

1Password CLI

developer.1password.com

Injects secrets from 1Password vaults into apps, scripts and CI via op run and service accounts.