Best open-source secrets management tools
Open-source secrets management tools you can self-host and inspect. A neutral list of the open-source secrets management options in our directory, compared on capabilities, deployment, and sources. We do not crown a single winner; tools are listed alphabetically.
What this shortlist looks at
Tools listed here
Bitwarden (Business)
Security-conscious organizations wanting an affordable, auditable, and self-hostable password managerOpen-source enterprise password manager with self-hosting and transparent security
Open-source enterprise password manager with self-hosting and transparent security
cert-manager
Any Kubernetes team that needs TLS. Which is nearly all of themKubernetes certificate controller supporting Let's Encrypt, Vault, and more
Kubernetes certificate controller supporting Let's Encrypt, Vault, and more
CyberArk Conjur
Large enterprises with complex compliance and PAM requirementsEnterprise privileged access and secrets management platform
Enterprise privileged access and secrets management platform
External Secrets Operator
Kubernetes teams that want to use cloud-native or Vault secrets directly in podsK8s operator that syncs secrets from external stores into Kubernetes Secrets
K8s operator that syncs secrets from external stores into Kubernetes Secrets
HashiCorp Vault
Teams needing flexible, self-hosted secrets management with extensive plugin ecosystemIndustry-standard open-source secrets management platform
Industry-standard open-source secrets management platform
Infisical
Teams wanting open-source with a modern developer experienceOpen-source end-to-end encrypted secrets management for teams
Open-source end-to-end encrypted secrets management for teams
Sealed Secrets
Small-to-medium Kubernetes teams doing pure GitOps without a separate secrets backendEncrypt Kubernetes secrets into a format safe to store in Git
Encrypt Kubernetes secrets into a format safe to store in Git
SOPS
Infrastructure-as-code teams that want encrypted-in-Git secrets with a simple CLICLI tool for encrypting YAML/JSON/ENV files with KMS, age, or PGP
CLI tool for encrypting YAML/JSON/ENV files with KMS, age, or PGP
SPIFFE / SPIRE
Platform teams running microservices at scale that need to replace static service credentialsWorkload identity standard: short-lived SVIDs replace shared service secrets
Workload identity standard: short-lived SVIDs replace shared service secrets