SOPS

CLI tool for encrypting YAML/JSON/ENV files with KMS, age, or PGP

ToolSecrets ManagementOpen SourceSelf-hosted

Pricing: Free (open source)

Reviewed by the CyberSecTool editorial team against the public sources cited below · Last reviewed April 2026 · How we review listings

What is SOPS?

SOPS (Secrets OPerationS) is a command-line tool for editing encrypted files. It uses KMS keys (AWS KMS, GCP KMS, Azure Key Vault, HashiCorp Vault, age, or PGP) to encrypt only the values in YAML, JSON, ENV, or INI files. Leaving the keys readable so you can diff changes in Git. Originally created at Mozilla and now a CNCF Incubating project, SOPS is a favorite for teams that want encrypted-in-Git secrets without adopting a full operator.

Best for: Infrastructure-as-code teams that want encrypted-in-Git secrets with a simple CLI
Pros
  • ✓ Encrypted values + readable keys makes Git review actually work
  • ✓ No server or operator to run; pure CLI tool
  • ✓ Multi-key support makes sharing with teammates painless
  • ✓ Works with almost every KMS; vendor-agnostic
Things to check
  • • Requires discipline: anyone can commit an unencrypted secret by accident
  • • Key management is on you; rotating a compromised key is manual
  • • Not a secrets manager; no audit trail of accesses
  • • Only encrypts at rest in Git; runtime apps still need a way to decrypt

Reported in public reviews and vendor documentation. See sources below.

Key Features

Encrypts only values, leaves keys readable for diffs
Supports YAML, JSON, ENV, INI, and binary files
KMS providers: AWS KMS, GCP KMS, Azure Key Vault, Vault, age, PGP
Multiple key support per file (team member or automation key)
Path regex for selective encryption
Git-friendly: small diffs on encrypted-value changes
Integrations with Helm (helm-secrets), Terraform, Kustomize
CLI and Go library usage
Rotates keys without re-encrypting every file
CNCF Incubating project

Are you SOPS? Improve this listing with screenshots, case studies and more.

Sources & references

Where the information on this listing comes from. Always verify pricing and capabilities against the vendor before a purchasing decision.

SOPS — official websitePrimary source
SOPS GitHub
GitHub
SOPS on Hacker News
Hacker News

Spot an error, or do you represent SOPS? Request a correction.

Quick Info
PricingFree (open source)
ModelOpen Source
Founded2015
CloudNo
Self-HostedYes
Open SourceYes
Visit Website →View on GitHub →

Last updated: Apr 23, 2026

SOPS Alternatives
View All AlternativesFeaturedSplitSecure
Distributed secrets management — no vault, no vendor depende...
Sealed Secrets
Encrypt Kubernetes secrets into a format safe to store in Gi...External Secrets Operator
K8s operator that syncs secrets from external stores into Ku...HashiCorp Vault
Industry-standard open-source secrets management platform...Doppler
Developer-first universal secrets management platform...