The Best Secrets Management Tools in 2026

A secrets manager stores API keys, database passwords and signing keys outside the code and hands them to the app at runtime. Storing them is well understood, and the harder work is keeping local, preview and production values in step, rotating them and tracking which service reads which secret.

This guide compares eight tools by where secrets live, how they reach the app and how they work locally. It also includes Encore, where secrets are declared in backend code.

What you need to decide:

• Whether secrets live in your cloud provider, a dedicated vault or encrypted in Git.
• How values reach local machines, CI, previews and production.
• Who can read and rotate each secret, and how that is audited.
• Whether you need dynamic, short-lived credentials or static values are enough.

Secrets management tools at a glance

AWS Secrets Manager

AWS Secrets Manager

AWS Secrets Manager stores secrets encrypted with KMS, controls access with IAM and logs reads to CloudTrail. It rotates RDS and other credentials with managed or Lambda-based rotation, and ECS and Lambda can inject values at startup. Reading a secret from code is one SDK call:

import { SecretsManagerClient, GetSecretValueCommand } from "@aws-sdk/client-secrets-manager";

const client = new SecretsManagerClient({});
const { SecretString } = await client.send(
  new GetSecretValueCommand({ SecretId: "prod/stripe" }),
);

Pricing is per secret per month plus API calls, so caching values in the process matters at high request rates. Local development has no equivalent, and each service needs an IAM policy for each secret.

Google Secret Manager

Google Secret Manager

Google Secret Manager stores versioned secrets per project with IAM access per secret and audit logs. Cloud Run can mount a secret as an environment variable or a file, which avoids SDK code:

Like the AWS service, it covers deployed environments only, and local values are handled separately.

HashiCorp Vault

HashiCorp Vault

Vault covers the widest range of features on this list. Beyond key-value storage, it issues dynamic database and cloud credentials that expire, acts as a certificate authority and encrypts data as a service. Apps authenticate with Kubernetes, AWS IAM or other methods and read through the API, the Vault Agent or a sidecar.

Running Vault well means high availability, unsealing, backups and policy management, which is a platform team's job. HCP Vault is the managed option. HashiCorp moved Vault and Terraform to the Business Source License in 2023. The Terraform change prompted the OpenTF fork, now OpenTofu.

OpenBao

OpenBao

OpenBao is a fork of Vault's last open source release, maintained under the Linux Foundation with the MPL 2.0 license. Its API and most engines are compatible with Vault, so existing clients and policies carry over, and it is developed in the open with its own roadmap. It brings the same operational load as self-hosted Vault.

Infisical

Infisical

Infisical is an open source secrets platform with a dashboard for projects and environments, secret versioning, rotation and a Kubernetes operator, available as a hosted service or self-hosted. The CLI injects values into any command, which covers local development:

Production apps still need a machine identity and either the SDK, the operator or a sync into the cloud's own manager.

Doppler

Doppler

Doppler organises secrets into projects and configs per environment and syncs them into AWS Secrets Manager, Google Secret Manager, Vercel, GitHub Actions and many other targets. doppler run -- npm start injects values locally. It suits teams deploying to several platforms that want one source of truth, and it is hosted only.

1Password

1Password

1Password's developer tools let .env files reference vault items instead of holding values, and op run resolves them when a command starts:

# .env
STRIPE_KEY="op://Shop/Stripe/secret-key"

op run reads that file, resolves each reference and starts the command with the values in its environment:

Service accounts and Connect servers cover CI and production. It fits teams that already keep credentials in 1Password, with fewer infrastructure features such as dynamic credentials.

SOPS

SOPS

SOPS encrypts the values in YAML, JSON or env files with age, PGP or a cloud KMS key, leaving the keys readable, so encrypted secrets live in Git next to the code and diff cleanly. It is popular with Flux and Argo CD. There is no server and no audit log of reads, and rotation means re-encrypting and committing.

Encore

In Encore, a secret is declared in backend code and read by calling it:

import { secret } from "encore.dev/config";

const stripeKey = secret("StripeSecretKey");

Values are set per environment type with encore secret set or the dashboard, and local values sync to everyone working on the app, with a .secrets.local.cue file for per-machine overrides. A missing secret is a warning locally and a failed deploy in the cloud. On deploy, Encore copies values from its vault into AWS Secrets Manager or Google Secret Manager in your account, as part of the AWS infrastructure or GCP equivalent it provisions. External vaults can reference values kept in Google Secret Manager instead. It only applies to apps built with Encore.

Where leaked secrets come from

Leaked keys usually come from code rather than from the secrets store. GitGuardian counted about 23.8 million new hardcoded secrets in public GitHub repositories in 2024, and found that most secrets leaked in 2022 were still valid two years later, as InfoQ reported. Whatever the tool, use one secret per purpose and separate values per environment, run a scanner on the repository, rotate anything that has been committed and keep secrets out of logs and error reports.

How to choose

• AWS Secrets Manager or Google Secret Manager for apps on a single cloud.
• Vault or OpenBao for dynamic credentials and a platform team to run them.
• Infisical or Doppler for one dashboard across many environments and platforms.
• 1Password for teams already on it.
• SOPS for encrypted secrets in Git.
• Encore if the backend is built with Encore and secrets should be declared in its code.

Related guides

• How to manage secrets on AWS with an AI agent
• Best infrastructure for AI coding agents
• AWS CDK vs Terraform
• Best preview environment platforms