Doppler is a good product. It is also priced per seat, and for a small team that is the whole problem.
If you are here, you have probably already done the maths. Doppler's Developer plan is free for three users, then $8 per user per month beyond that. The Team plan, which is where role based access, change requests and SSO live, is $21 per user per month, or $12 per user if you commit to a year. Some Team features are add-ons at $9 per seat on top. Those are the published prices as of August 2026, and you should check Doppler's pricing page before quoting them, because they change.
Run that against a five person team. On Team, that is $105 a month to store environment variables. Hire two people and it is $147. The tool has not changed, the bill has.
This post covers what to use instead, and it is honest about the trade offs, including ours. Disclosure up front: we build Krypt, one of the options below. We have tried to describe every tool fairly and you should verify pricing on each vendor's site.
The trade off most comparisons miss
Read any "Doppler alternatives" list and you will see the same choice framed the same way. Either you pay per seat for a managed service, or you avoid per seat pricing by self hosting something open source and running it yourself.
That framing leaves out a third option: managed and hosted, but not priced per seat. It exists, it is just less common. Worth keeping in mind as you read, because "do I want to run my own secrets server" is a very different question from "do I want to pay per developer."
Quick comparison
| Tool | Pricing model | Hosting | Setup effort | Best for |
|---|---|---|---|---|
| Doppler | Per seat | Managed | Low | Teams that want the most polished managed option and can absorb per seat cost |
| Infisical | Free self hosted; paid cloud tiers | Self host or managed | Medium (self host) or Low (cloud) | Teams that want open source and are happy to self host |
| HashiCorp Vault | Free self hosted; managed HCP tier | Self host or managed | High | Organisations with a platform team and complex access policies |
| AWS Secrets Manager | Per secret plus API calls | Managed (AWS) | Medium | AWS native teams whose secrets are consumed by AWS services |
| 1Password | Per seat | Managed | Low | Teams already on 1Password for passwords |
| Bitwarden Secrets Manager | Free tier; per seat paid | Managed or self host | Low | Small teams who want open source without running a server |
| Krypt | Flat per team | Managed | Low | Small teams that want hosted and a fixed monthly bill |
Infisical
Infisical is the closest like for like alternative to Doppler. It is open source, has a CLI, a dashboard, SDKs, and a broad set of integrations. You can self host it for free or use their managed cloud, which has a free starter tier and paid plans above it.
Where it wins: if you want open source for trust or compliance reasons, or you want to run it inside your own infrastructure, Infisical is the obvious pick. The self hosted option removes per seat pricing entirely.
Where it costs you: self hosting means it is your database, your uptime, your upgrades. That is fine if you already run infrastructure, and a real tax if you are three people trying to ship a product. The managed cloud tier reintroduces per seat pricing above the free plan, so check the current numbers before assuming it is cheaper than Doppler at your team size.
HashiCorp Vault
Vault is the enterprise standard for secrets management and it earns that reputation. Dynamic secrets, fine grained policies, hardware security module support, audit devices, and integrations with nearly everything.
Where it wins: if you need short lived database credentials generated on demand, PKI, or policies that would make a compliance auditor smile, Vault does things nothing else on this list does.
Where it costs you: it is a serious piece of infrastructure to run. Expect real setup time and someone who owns it. For a small team whose actual problem is "stop pasting the Stripe key into Slack," Vault is a lot of machine for a small job. The managed HCP Vault option reduces the operational burden but is priced for organisations, not side projects.
AWS Secrets Manager
If your application already runs on AWS and consumes secrets from Lambda, ECS, or EC2, Secrets Manager is the path of least resistance. Pricing is per secret per month plus a small charge per API call, rather than per user, which makes it cheap for a handful of secrets and a large team.
Where it wins: native IAM integration, automatic rotation for RDS credentials, and no new vendor to trust.
Where it costs you: it is built for machines reading secrets, not for developers syncing a .env file to their laptop. There is no team workflow for local development in the way Doppler or Infisical provide. And it is AWS only, which is fine until it is not.
1Password
1Password's developer tooling lets you store secrets alongside your team's passwords and pull them into local environments and CI. If your team already pays for 1Password, the marginal cost of using it for secrets is low.
Where it wins: one vendor, one login, and a security model your team already trusts.
Where it costs you: it is a password manager with developer features bolted on, not a secrets manager designed around environments and deployments. Per environment separation, change approvals for production, and audit trails per project are thinner than dedicated tools. And it is still per seat.
Bitwarden Secrets Manager
Bitwarden's secrets product is newer than the others and follows the Bitwarden pattern: open source, a free tier that covers small teams, and paid plans above that. You can use their hosted version or self host.
Where it wins: open source, genuinely usable for free at small scale, and a company with a long security track record.
Where it costs you: integration depth and developer workflow are behind Doppler and Infisical. Paid tiers are per seat.
Krypt
This is ours, so take the following with that in mind.
Krypt is a managed secrets manager built specifically for small teams. Pricing is flat: £10 per month for the whole team, however many people join. The free tier covers three members with unlimited projects and secrets. There is no per seat tier at any level.
How it works: create a project, link a repo with krypt init, push your .env with krypt push, pull it on any other machine with krypt pull. Secrets are split by environment so development, staging and production cannot get crossed. krypt run injects secrets into a process without writing a file. Role based access, approval flows for production changes, webhooks and an audit log are included.
Where it wins: it is the hosted option in this list that does not charge per seat. If the reason you are leaving Doppler is the bill, and you do not want to run a server, this is the gap Krypt sits in.
Where it costs you, stated plainly: there is no SSO and no SOC 2 certification. Secrets are encrypted with AES-256 at rest and TLS in transit, decrypted server side, which is the same model Doppler uses but is not end to end encryption. Webhook deliveries are single attempt with no retries. The product is a few months old with one person behind it. If any of those are blockers, one of the tools above is a better fit today. You can read the full security model on our security page and the pricing detail on the pricing page.
Or skip the SaaS entirely
Two options worth knowing about that are not products. SOPS encrypts secrets files so you can commit them to git and decrypt with a key you control. dotenv-vault syncs .env files with a similar workflow. Both are free, both are mature, and both are a reasonable answer for a solo developer or a two person team.
The trade off is that key management, access control, and "who changed what" become your problem to solve in git history and out of band conversations. Most teams outgrow this around the point they have a production environment they care about and more than two people who can touch it.
Which should you pick
Answer these in order.
Do you need SSO or SOC 2 today? If yes, your options are Doppler, Infisical cloud, Vault, or AWS Secrets Manager. Krypt and Bitwarden are not there yet.
Do you want to run a server? If yes, Infisical self hosted is the best value on the list. If no, cross off Vault self hosted and move on.
Is everything on AWS and consumed by AWS services? Then Secrets Manager is probably right and you can stop reading.
Is the bill the main reason you are leaving? Then the question is whether you want to self host to avoid per seat pricing, or pay a flat fee to have someone else host it. Infisical for the first, Krypt for the second.
Is the team already on 1Password? Try their developer tools before adding another vendor.
When Doppler is still the right call
It would be dishonest to write this without saying it. Doppler is the most polished managed option here. The integrations are broad, the CLI is excellent, secret rotation is built in, and the SOC 2 report exists. If you are a funded company of fifteen engineers, $21 a seat is a rounding error and the alternatives are trading real capability for savings you will not notice. Per seat pricing is only a problem when the seats are the majority of the cost.
FAQ
Is Doppler free? Yes, for up to three users on the Developer plan. Beyond that it is $8 per user per month on Developer, or $21 per user per month on Team (as of August 2026).
What is the cheapest Doppler alternative? For a self hosted setup, Infisical or Bitwarden. For a hosted service, Krypt's flat £10 per month for the whole team, or Bitwarden's free tier if you stay small enough for it.
Can I migrate from Doppler without downtime? Yes. Every tool on this list can import from a .env file, and Doppler can export one. Export from Doppler, import into the new tool, switch your CI and local environments, then remove the secrets from Doppler once nothing reads them.
Does flat pricing mean worse security? No. Pricing model and security model are unrelated. Check each tool's encryption approach, access controls and audit logging on their own merits.