Best Secrets Management Tools in 2026: Vault, OpenBao, Infisical and the Cloud Options Compared

The cheapest way to buy Vault as a service no longer exists. HCP Vault Secrets went end of sale on June 30, 2025, and the end of life for remaining contract customers was the earlier of their contract expiry or July 1, 2026, which means it is gone as of last month. HashiCorp's own guidance is to migrate to HCP Vault Dedicated, which is hosted Vault Enterprise and a different product at a different price.

Two weeks before that deadline, Vault skipped from 1.21 straight to 2.0. That was not an architecture rewrite; it aligns Vault with IBM's versioning and its Support Cycle-2 policy, which replaces HashiCorp's old long-term support designation. Meanwhile the fork created when Vault left open source has been shipping real features and picked up NVIDIA as a listed adopter.

If you are choosing a secrets manager this quarter, that is the backdrop. This guide splits the category into four shapes, compares every option at its published price, and ends with a migration checklist. Every price came from the vendor's own page in August 2026, and the encryption walkthrough was run on a laptop with the versions named.

First, What This Category Actually Covers

A secrets manager stores credentials, hands them to workloads that prove who they are, and revokes them. It is a different job from two neighbors people confuse it with.

Secrets scanning finds credentials already committed to your repository, which our developer security toolkit guide covers. Non-human identity management governs which machine identities exist at all and what they are allowed to do; our non-human identity guide covers that, and the distinction matters because a vault full of long-lived static tokens is still a bad position to be in. This post is about the storage and distribution layer in the middle.

One question separates the tools more than any feature list: do you need dynamic secrets? A dynamic secret is generated on demand with a lease, so a compromised credential expires by itself. That capability is the historic reason to run Vault and the reason it is heavier to operate than a key-value store with an API.

The Four Shapes

A self-hosted engine (Vault, OpenBao) gives you dynamic secrets, PKI, encryption as a service and a cluster to operate. A SaaS platform (Infisical, Doppler) gives you a good CLI, sync into every environment and a per-seat or per-identity bill. Your cloud provider's manager (AWS Secrets Manager, Google Secret Manager, Azure Key Vault) is already in your IAM model and bills per secret or per operation. Encrypted in git (SOPS with age) has no server at all: values are encrypted in files you commit, decrypted in CI.

Most teams end up with two of these, not one. That is normal, and the trick is picking the boundary deliberately rather than by accident.

Quick Comparison

The rest of this post takes those four shapes in order, then hands you a decision list and a migration plan.

Shape 1: The Self-Hosted Engines

These are the only options that generate credentials on demand. They are also the only ones where you own uptime.

Vault Under IBM

The most capable option here, and no longer open source. Vault moved to the Business Source License 1.1 in August 2023. Vault Enterprise 2.0 landed on April 13, 2026 with secret distribution through workload identity federation, credential rotation for RHEL and Ubuntu hosts, envelope encryption for large payloads, a SPIFFE secrets engine issuing JWT SVIDs, public certificate authority support and a SCIM integration in beta.

The operational news matters as much as the features. Self-managed Enterprise products moved to two feature releases a year, spring and fall, with monthly security patches, and each release gets at least two years of standard support under IBM's SC2 policy with extended support available into year six. Long-term support designations are retired. Even the HashiCorp support portal is being folded into IBM's, with a shutdown date of August 21, 2026.

Vault Community Edition is still free to run and still does dynamic secrets. What you give up without Enterprise is namespaces, disaster recovery replication, HSM auto-unseal and the compliance features, and what you take on is running and upgrading a cluster.

OpenBao, the Fork That Grew Namespaces

Vault's capability under MPL 2.0, including features Vault charges for. OpenBao forked from the last MPL 2.0 release of Vault, sits under the Linux Foundation with OpenSSF governance, and is a genuine project rather than a snapshot. Version 2.6.0 shipped on July 14, 2026 and 2.6.1 on July 22.

The 2.6 release added namespace sealing, which lets each namespace hold distinct Shamir key material so one tenant's data can be sealed and its access revoked independently. It also moved auto-unseal mechanisms into external kms plugin binaries with automatic restart, added a sys/workflows API for building simplified interfaces over the standard API, replaced the deprecated unauthenticated root token generation endpoint with an authenticated one, and shipped a distroless container image. Version 2.5 added horizontal read scalability across nodes.

Read that list again with pricing in mind: namespaces and read scaling are Vault Enterprise features, available here for nothing. Sponsors listed on the site include GitLab, SAP, Proton, Fermilab, ControlPlane and Adfinis, and NVIDIA appears among adopters. Eight companies now sell commercial support.

The honest caveat is ecosystem gravity. Vault has more tutorials, more Stack Overflow answers, more integrations that name it explicitly and more people who have operated it at 3am. OpenBao keeps API compatibility, so most of that knowledge transfers, but you are the one making the call.

Shape 2: The SaaS Platforms, Where the Meter Decides

Both options here are polished and developer-first: a CLI that injects secrets into a process, sync into CI and cloud providers, and self-hosting on the paid tiers. Feature lists will not separate them for you. Their pricing models will.

Infisical: Billed Per Identity

Infisical is MIT licensed at the core with 27,000 GitHub stars. Free covers 5 identities, 3 environments and 10 secret syncs. Pro is $20 per identity per month billed annually ($23 monthly) and adds access controls, secret rotation, SAML SSO and 30-day audit logs. Advanced is $40 per identity per month and adds dynamic secrets, honey tokens, custom roles and 90-day audit logs. Enterprise adds approval workflows, LDAP, SCIM, KMIP and self-hosting.

Doppler: Billed Per Human

Doppler bills per seat instead. Developer is free for 3 users with $8 a month per extra user. Team is $21 per user per month with change requests, SAML SSO, RBAC, 90-day logs and automatic rotation. Enterprise adds dynamic secrets and log forwarding. The line that matters is Doppler's own: AI agents and non-human identities ride free and do not count toward seats.

Running the Numbers

A team of 8 engineers running 150 services and agents pays Doppler roughly $168 a month on Team. On Infisical Pro, if those 150 machine identities each count, the same estate is in four figures. Flip the shape and the answer flips: 3 engineers with 10 identities is cheap on Infisical and barely registers on either.

Count your non-human identities before you read either pricing page, because that number is growing faster than your headcount and it is the largest cost difference in this category.

Shape 3: The Cloud Manager You Already Pay For

Least work if you live in one cloud. It is already in your IAM policy model, already audited by CloudTrail, and needs no cluster.

AWS Secrets Manager is $0.40 per secret per month plus $0.05 per 10,000 API calls. Google Secret Manager is $0.06 per active secret version per location per month plus $0.03 per 10,000 access operations, with $0.05 per rotation notification and destroyed versions free. Azure Key Vault charges per 10,000 operations rather than per secret stored.

The gotcha is volume. 500 secrets on AWS is $200 a month before a single API call, and per-secret pricing pushes teams toward stuffing many values into one JSON secret, which quietly destroys per-secret access control. If you are in that position, Google's per-version rate or a self-hosted engine will be cheaper. AWS Systems Manager Parameter Store standard parameters remain free and are the right home for configuration that is not a credential.

Shape 4: Encrypted in Git with SOPS and age

No server, no bill, no rotation either. SOPS is a CNCF sandbox project that encrypts the values in a YAML, JSON or .env file and leaves the keys readable, so an encrypted file still produces a meaningful git diff. Paired with age it needs no cloud KMS.

Here is the whole workflow, run locally with sops 3.13.3 and age 1.3.1:

Bash
Copy
age-keygen -o key.txt                      # prints the public key to stderr
cat > .sops.yaml <<'YAML'
creation_rules:
  - path_regex: \.yaml$
    age: age1v0hwa90c72kq737nmldg25kragalsez390fefpahyu9y8n5tsdcsukz20r
YAML
sops --encrypt --in-place secrets.yaml

The file that lands in git keeps its structure and loses its values:

yaml
Copy
database:
    host: ENC[AES256_GCM,data:VR2SjbbqDZ4tQgE=,iv:p6Vh3yvG1i7hDZVok16lnU5ekraECwG6nA/OSrEKcmM=,tag:cT71TttqKRWcuKkEAY+wtw==,type:str]
    password: ENC[AES256_GCM,data:fyaQknjAvt2gYR+Ebfr2B64=,iv:1t+3u5JEBvt7B9z9PyrzrkBa4cKX30ALTmiT4MJH+ls=,tag:sLeVLckj0U//drSKrq+10Q==,type:str]
stripe:
    secret_key: ENC[AES256_GCM,data:EYm3G333nlxQzRPJrrQD4YFdBotUADQ/d7rH,iv:d4us0HydwkJMzrevJw38Rb0J7Bge736ZiG2FvabuwZU=,tag:HB+hnnJJ8pKLf+QSOsfwPA==,type:str]

Checking that it actually held, on the same file:

text
Copy
$ grep -c 'database:\|stripe:\|password:\|secret_key:' secrets.yaml
4
$ grep -c 'hunter2\|sk_live_51H' secrets.yaml
0
$ SOPS_AGE_KEY_FILE=key.txt sops --decrypt secrets.yaml
database:
    host: db.internal
    password: hunter2-but-worse
stripe:
    secret_key: sk_live_51Hxxxxxxxxxxxxxxxx

Four structural keys still readable, zero plaintext values, clean round trip. What you do not get is rotation, leases, dynamic secrets or an audit log, and you have moved the problem to distributing the age key. For a small team, a homelab, or the Kubernetes manifests in a GitOps repository, that trade is often correct.

The Glue That Makes All Four Swappable

External Secrets Operator is worth knowing about regardless of which shape wins, and it is also a CNCF sandbox project. It runs in your cluster, reads from Vault, OpenBao, AWS, Google, Azure, Infisical or Doppler, and materializes native Kubernetes Secrets from a declarative ExternalSecret resource.

That indirection is what makes your choice reversible. Applications read a normal Secret, the operator owns the provider integration, and switching from AWS Secrets Manager to OpenBao becomes a change to one resource rather than to every deployment. If you are on Kubernetes, install this before you commit to a provider.

How to Pick

You need dynamic database credentials or internal PKI: OpenBao if the license or the bill is the blocker, Vault if you want the vendor and the ecosystem. Both do the job; only one has a Business Source License.

Everything is in one cloud and you have tens of secrets: the native manager. Adding a secrets platform to an estate that already has IAM is work with no payoff at that size.

You have more services and agents than engineers: read Doppler's per-seat pricing against Infisical's per-identity pricing with your real identity count. This is the single largest cost difference in the category.

You want self-hosting with a modern interface: Infisical, which is MIT at the core, or OpenBao if you need leases and dynamic secrets more than a UI.

Small team, GitOps repository, no server budget: SOPS with age, and be honest that you have chosen encryption over rotation.

Then Migrate: Getting Secrets Out of .env Files This Week

1. Inventory what you have. Collect every .env, CI variable and shared note. Compare environments against each other with our Env File Diff Checker to find the variable that only exists in production.
2. Check the files for problems before migrating them, with our Dotenv Linter. Duplicate keys and unquoted values with spaces cause failures that look like secret-manager bugs later.
3. Rotate anything that was ever in git. Assume every value in a committed .env is public. Generate replacements with our Random String Generator where the credential is yours to set.
4. Pick the boundary. One system for application credentials, and either the same one or your cloud's manager for infrastructure credentials. Write the decision down so the next engineer does not add a third.
5. Give workloads an identity, not a token. OIDC federation in CI, IRSA or workload identity in Kubernetes, so the secret manager hands out short-lived credentials rather than reading a static one. Our GitHub Actions guide covers the CI half.
6. Verify what landed. Decode what a cluster actually holds with our Kubernetes Secret Decoder, since a base64 round trip is where mismatched values usually surface.
7. Delete the originals and add a scanning step so they cannot come back.

Conclusion

The 2026 shift is that the open alternatives got good enough that the license became the deciding factor rather than the capability. OpenBao ships namespaces and horizontal read scaling under MPL 2.0, Infisical is MIT at the core, SOPS costs nothing and needs no server, and External Secrets Operator makes the choice reversible. Vault is still the most capable option and is now an IBM product on an IBM release cadence with no cheap SaaS entry point. Count your non-human identities, decide whether you truly need dynamic secrets, then pick the meter you can live with.

Related DevToolLab Tools

• Env File Diff Checker - Compare .env files across environments to find the variable that only exists in production.
• Dotenv Linter - Catch duplicate keys, bad quoting and invalid names before you migrate a file into a secrets manager.
• Random String Generator - Produce replacement values for any credential that was ever committed to git.
• Kubernetes Secret Decoder - Decode the base64 values in a Secret to confirm what your cluster is actually holding.

Related Guides

• Non-Human Identity Security - governing the machine identities your secrets manager issues credentials to
• Developer Security Toolkit - the scanning layer that catches secrets already committed
• Best Infrastructure as Code Tools - the same BUSL fork story playing out in Terraform and OpenTofu
• GitHub Actions Best Practices - OIDC federation so CI never holds a static credential

Prices and release versions change often. Verify current rates on each vendor's pricing page before committing to a plan.