Most "best secrets management tools" lists are written for enterprises. They compare HSM-backed key vaults and privileged access platforms that cost more per month than a small team's entire infrastructure bill. If you are three developers sharing a .env file over Slack, that is not the comparison you need.
This one is for teams of roughly 2 to 20 people. It covers the tools that actually make sense at that size, what each costs, and where each one falls down. Disclosure: we build Krypt, one of the tools below. It is listed where it belongs, not at the top, and the trade-offs section is as blunt as the others.
Pricing was checked in late August 2026. Verify on each vendor's site before deciding, because it changes.
Quick answer
If you want the short version:
- Simplest hosted workflow: Doppler, if per-seat pricing suits you
- Hosted with flat pricing: Krypt
- Open source, self-hosted: Infisical
- Already on one cloud: that cloud's native secrets manager
- Already paying for 1Password: 1Password's developer tools
- Free and small: Bitwarden Secrets Manager or SOPS
- You have a platform team: HashiCorp Vault, but you probably would not be reading this
Comparison
| Tool | Pricing model | Hosting | Setup | Best for |
|---|---|---|---|---|
| Doppler | Per seat | Managed | Low | Polished team workflow, budget for seats |
| Infisical | Free self-hosted; per seat cloud | Either | Low to medium | Open source, self-hosting |
| Krypt | Flat per team | Managed | Low | Hosted without per-seat cost |
| AWS Secrets Manager | Per secret plus API calls | Managed (AWS) | Medium | AWS-native workloads |
| Google Cloud Secret Manager | Per secret version plus access | Managed (GCP) | Medium | GCP-native workloads |
| Azure Key Vault | Per operation | Managed (Azure) | Medium | Azure-native workloads |
| 1Password | Per seat | Managed | Low | Teams already on 1Password |
| Bitwarden Secrets Manager | Free tier; per seat paid | Either | Low | Open source at small scale |
| HashiCorp Vault | Free self-hosted; managed HCP tier | Either | High | Platform teams, dynamic secrets |
Doppler
The most polished hosted option for developer teams. Clean dashboard, good CLI, broad integrations, secret rotation, SOC 2, and a Kubernetes operator. If money is not the constraint, it is the safe pick.
Pricing: free for 3 users on the Developer plan, then $8 per user per month. The Team plan, which is where role based access, SSO and change requests live, is $21 per user monthly or $12 per user billed annually. Some Team features are add-ons at $9 per seat on top.
Where it falls down: the bill. A five person team on Team pays $105 a month before add-ons, and every hire raises it. For a small team the seats are most of the cost, and the product does the same thing whether you have 3 users or 30. That is the reason most people searching for alternatives are searching.
Infisical
Open source, MIT licensed, with a CLI, dashboard, SDKs and a wide set of integrations. Self-host for free, or use the managed cloud. Secret referencing, approval workflows, dynamic secrets for databases on higher tiers.
Pricing: self-hosting is free. The managed cloud has a free starter tier and paid plans above it, priced per identity. Check current numbers before assuming it undercuts Doppler at your size.
Where it falls down: self-hosting is your database, your uptime, your upgrades. For a team that already runs infrastructure that is a small cost. For three people trying to ship a product it is a real one. The managed tier removes that but brings per-seat pricing back.
Krypt
This is ours. Managed, hosted, built specifically for small teams, and priced flat: £10 a month for the whole team regardless of headcount. Free tier is 3 members with unlimited projects and secrets.
Workflow: krypt init links a repo, krypt push uploads your .env, krypt pull fetches it on any machine, krypt run injects secrets into a process without writing a file. Secrets are split by environment. Role based access, approval flows for production, webhooks and an audit log are included.
Where it falls down, plainly: no SSO, no SOC 2. Encryption is AES-256 at rest with TLS in transit, decrypted server side, which is the same model Doppler uses but is not end to end. Webhooks are single attempt with no retries. It is a few months old with one person behind it. If any of those are blockers, one of the other tools is the better pick today. The security page has the full model.
Where it wins: it is the only hosted option in this list that does not charge per seat. If the reason you are leaving Doppler is the bill and you do not want to run a server, that is the gap it sits in.
AWS Secrets Manager, Google Cloud Secret Manager, Azure Key Vault
The three cloud providers each have a native secrets service, and if your application runs on one cloud and is consumed by that cloud's services, it is usually the path of least resistance. Native IAM integration, no new vendor, and automatic rotation for the provider's own databases.
Pricing: AWS is $0.40 per secret per month plus $0.05 per 10,000 API calls. Google charges per active secret version plus per access. Azure charges per operation. All three are cheap for a handful of secrets, and none charge per user.
Where they fall down: they are built for machines reading secrets at runtime, not for developers syncing a .env to a laptop. There is no team workflow for local development the way the dedicated tools provide. And you are locked to that cloud, which is fine until you are not.
1Password
If your team already pays for 1Password, its developer tooling lets you keep secrets alongside passwords and pull them into local environments and CI with a CLI.
Pricing: Business is $7.99 per user per month. The developer features come with it.
Where it falls down: it is a password manager with developer features attached, not a secrets manager built around environments and deployments. Per-environment separation, production change approvals and per-project audit trails are thinner than the dedicated tools. Still per seat.
Bitwarden Secrets Manager
Bitwarden's secrets product follows the Bitwarden pattern: open source, a free tier for small teams, paid plans above that, self-host or hosted.
Pricing: free tier covers a small number of users and secrets. Paid tiers are per seat.
Where it falls down: integration depth and developer workflow lag Doppler and Infisical. It is newer and the ecosystem is smaller.
HashiCorp Vault
The enterprise standard. Dynamic secrets, PKI, fine grained policies, audit devices, integrations with everything. If you need database credentials generated on demand with a 1 hour TTL, nothing else here does it.
Pricing: the community edition is free to self-host under the BSL licence. HCP Vault is the managed tier, priced for organisations.
Where it falls down: it is serious infrastructure. Expect real setup time and someone who owns it. For a team whose problem is "stop pasting the Stripe key into Slack," Vault is a lot of machine for a small job.
SOPS and dotenv-vault
Not products, but worth knowing. SOPS encrypts a secrets file so it can be committed to git and decrypted with a key you hold. dotenv-vault syncs .env files with a similar model. Both are free and mature.
Where they fall down: key distribution, access control and "who changed what" become your problem to solve in git history. Fine for a solo developer or a two person team. Most people outgrow it when they get a production environment they care about and more than two people who can touch it.
How to choose
Answer these in order.
Do you need SSO or SOC 2 now? Doppler, Infisical cloud, Vault, or your cloud provider. Krypt and Bitwarden are not there.
Are you willing to run a server? If yes, Infisical self-hosted is the best value here. If no, cross off Vault and Infisical self-hosted.
Is everything on one cloud and consumed by that cloud? Use its native secrets manager and stop reading.
Is the per-seat bill the problem? Then it is self-host to avoid it (Infisical) or pay flat to have it hosted (Krypt).
Already on 1Password? Try the developer tools before adding a vendor.
Solo or two people with no production yet? SOPS or a .env file on disk is fine. You do not need any of this yet.
What this list leaves out on purpose
CyberArk Conjur, Delinea Secret Server, BeyondTrust, Akeyless, Keeper. All real products, all built for regulated enterprises with privileged access requirements and procurement departments. If you are choosing between them, you are not a small team and this is not the guide for you.
Also left out: secret scanning tools like GitGuardian and Cycode. They detect leaked secrets in your code. They do not store or distribute them. Different job, and some lists blur the two.
FAQ
What is the difference between a secrets manager and a password manager? A password manager stores credentials for humans to log in with. A secrets manager stores credentials for applications, split by environment, and delivers them to code at runtime. 1Password and Bitwarden do both; most tools here do one.
Do I need a secrets manager for a solo project? No. A .env file that is in .gitignore does the job. You need one when a second person needs the same secrets, or when a production environment exists that you want change control over.
Which is cheapest? Self-hosted Infisical or Bitwarden's free tier if you stay small. For a hosted service, Krypt's flat £10 for the whole team, or a cloud provider's native manager if you are already there and only have a few secrets.
Can I switch later? Yes. Every tool here imports and exports .env files. Migration is export, import, repoint your CI and local environments, then remove the secrets from the old tool.
What about end to end encryption? Most hosted tools, including Doppler and Krypt, decrypt server side so they can offer features like diffs and approval flows. If you need the server to never see plaintext, look at EnvKey or a self-hosted option where you hold the keys.