Compare Secrets Kit and other secrets managers
Find the right fit
Your workflow. Your priorities.
Start with the features you need. Secrets Kit keeps credentials on your own machines, with unlimited peer-to-peer connections on the same LAN segment. Add hosted forwarding when you need it, or compare the team features of a centralized secrets manager.
Features & pricing, side by side
Checked October 26, 2026 · Prices in USD
Included Not included Not listed in reviewed documentation
Scroll sideways on smaller screens. Feature names stay visible as you compare.
| Features & plans | Local-firstSecrets KitFree client + optional RSS | BitwardenSecrets Manager | DopplerDeveloper / Team | InfisicalFree / Pro | AWSSecrets Manager |
|---|---|---|---|---|---|
| Plans & pricing | |||||
| Free entry point | FreeUnlimited LAN connections | Free2 users · 3 machine accounts | Free3 users | Free5 identities | Account creditsEligibility and terms apply |
| Paid pricing | $5per RSS connection / month2 minimum · $10/month | $6Teams / user / month, annual billingEnterprise: $12 | $8per additional Developer user / monthTeam: $21/user/month | $20Pro / identity / month, annual billing$23 on monthly billing | $0.40per secret / month+ $0.05 / 10,000 API calls |
| What you pay for | RSS connection capacityLAN peer-to-peer use stays free | User seatsMachine allowances vary by plan | User seatsNo additional agent seats | Human + machine identities | Stored secrets + API usage |
| Everyday use | |||||
| Primary secret storage | On your machinesKeychain / encrypted SQLite | Hosted vaultSelf-hosting: Enterprise | Hosted serviceOn-prem: Enterprise | Cloud / self-hostedSeparate self-hosting terms | AWS managed service |
| Application & command-line access | ✓seckit run |
✓bws run |
✓doppler run |
✓Infisical CLI | ✓AWS CLI / SDKs |
| Agent & automation access | ✓Hermes integration · scoped MCP | ✓Machine accounts | ✓Service tokens / accounts | ✓Machine identities | ✓AWS identity permissions |
| Connectivity | |||||
| Native LAN peer-to-peer sync | ✓Unlimited connections Same LAN segment |
— | — | — | — |
| Access across networks | ✓Optional paid RSS forwarding | ✓Through the vault service | ✓Through the hosted service | ✓Through the platform | ✓AWS service access |
| Key custody & continuity | |||||
| Who can decrypt? | Authorized local peersRSS relays cannot decrypt payloads | Authorized clientsEnd-to-end encrypted vault | Authorized service operationsService-side crypto | Authorized server operationsEnvelope-encryption hierarchy | Authorized service operationsAWS KMS-backed |
| Key custody | Independent local peer keysNo datastore key copied to RSS | Client-side cryptographic accessScoped machine credentials | KMS-protected workplace keysOptional enterprise key layer | Server root / internal KMS keysConfigured HSM option | AWS or customer-managed KMS key |
| Splitting & recovery | Per-peer wrappingNot threshold splitting; account recovery is separate | Wrapping / account recoveryNot a documented threshold delivery model | Layered encryptionNo threshold sharing established | Envelope key hierarchyNo threshold sharing established | Envelope encryptionNot customer threshold delivery |
| Server dependence | None for local/LAN useRSS for hosted cross-network forwarding | Service for fresh retrieval | Service for fresh retrievalLocal fallback available | Platform for fresh retrievalDeployment-dependent caches | Cloud API for fresh retrieval |
| Outage behavior | ✓Local use + primary/secondary RSS failover | Service-dependentSpecific client failover not established here | ✓Service failover + encrypted fallback | HA depends on deploymentReview backend and client behavior | Managed service / regional optionsNot local disconnected access |
| Team features & automation | |||||
| Organization administration | ×Local peer & agent policies | ✓Teams / Enterprise | ✓Team access controls | ✓Pro access controls | ✓AWS IAM |
| Organization audit logs | ×Local transaction history is separate | ✓Teams / Enterprise | ✓3 days Developer 90 days Team |
✓30 days on Pro | ✓CloudTrail |
| Automatic secret rotation | × | — | ✓Team | ✓Pro | ✓Rotation setup required |
Plan names qualify the checkmarks. A dash means the feature was not listed in the documentation reviewed, not that it is impossible to build. Hosted access, local caches, and native peer synchronization are different capabilities. Plan limits and annual billing requirements apply; taxes and related service charges may be additional.
Start free on your LAN.
Keep credentials on your machines. Add remote forwarding when you need it.
Compare the local-first alternatives, too.
Native peer synchronization is not exclusive to Secrets Kit. These closer alternatives make the tradeoffs clearer: encrypted defaults, custody, private routes, hosted forwarding and release maturity.
| Local workflow | Secrets Kit | env-sync | Envmesh | dotenvx | SOPS |
|---|---|---|---|---|---|
| Availability & price | 2.0.2 coming soonFree LAN · planned $5/RSS connection | Available CLIFree/open source | Early accessNo public price established | Available CLICore free; optional services separate | Available CLIFree; KMS usage can cost extra |
| Storage defaults | Encrypted SQLitemacOS Keychain also supported | SSH mode: plaintext unless AGE enabledSecure-peer: AGE required | Described encrypted local storeEarly-access architecture | Encrypted .env valuesVariable names remain visible | Encrypted structured files |
| Who holds keys? | Each peer independently | Local AGE identitiesMode-dependent | Device / Keychain design | Local private key by defaultOptional Armor differs | age/PGP recipients or selected KMS |
| How updates move | Direct encrypted peers + optional RSS | SSH/SCP or HTTPS + mTLS | Described direct device syncExisting private route | Git / file distribution | Git / deployment tooling |
| Threshold splitting | No threshold schemePer-peer key separation | Ordinary recipient encryption | Not established | Public/private-key model | ✓Optional Shamir key groups |
| Live server needed? | No for local/LANRSS for hosted forwarding | No central LAN server | No server in described designPrivate-route dependencies remain | No for core local workflow | No with local age/PGPYes for KMS-backed operations |
| Outages & failover | Local access + primary/secondary RSS failover | Local files/backupsNo hosted failover established | Local-first designNot a released HA guarantee | Local files + keys | Local files + keysCloud KMS changes dependence |
Sources and version/mode qualifications are in the product records below. These are different architectures, not equivalent security guarantees.
The questions behind the checkmarks
Encrypted where, and who can open it?
Encryption at rest can still allow a service to decrypt authorized requests. Client-side encryption, customer-managed KMS keys, and local custody have different trust boundaries.
Shared, wrapped, split, or recoverable?
Wrapping a key to several recipients is different from requiring several threshold shares. Account recovery or optional server-held key backup also differs from recovering local secret data. For escrow, ask whether a provider retains decryption-capable keys or can restore access; storing ciphertext alone does not answer that.
What survives an outage?
A local store, an encrypted cache, a replicated database, and automatic relay failover solve different failures. An SLA does not establish offline access.
What do you need to operate?
Include identity services, private network routes, KMS, gateways, backups and key recovery—not just a subscription price.
The wider landscape
32 products and workflows, reviewed by architecture.
Explore local tools, smaller services, enterprise platforms and cloud vaults. Each entry covers storage, custody, key splitting or recovery, transfer, server dependence, resilience, runtime access and pricing.
Checked 2026-10-26. Primary vendor documentation and project repositories. Vendor-described behavior is not an independent security audit or installed qualification. Unknown or plan-dependent behavior is stated explicitly. Historical offerings and early-access projects are identified separately.
32 entries
Local and file-based tools
env-syncInstallable open-source CLI
- Storage
- Local .env records; default SSH mode is plaintext at rest unless AGE is enabled. Secure-peer mode requires AGE.
- Key custody
- Local AGE identities in secure-peer mode; SSH trust in the default owner mode.
- Splitting & recovery
- Recipient encryption, not documented threshold sharing. Local keys and backups remain an operator responsibility.
- Transfer
- mDNS discovery; SCP/SSH or HTTPS with mutual TLS, depending on mode.
- Server dependence
- No central secrets server for LAN operation.
- Outages & failover
- Local files, write backups and offline peer catch-up; no hosted relay failover established.
- Applications & agents
- CLI and shell workflows; explicit peer approval in secure-peer mode.
- Pricing
- Free/open source.
Official sources: Product and modes · Security modes · Security
EnvmeshEarly access / active development
- Storage
- Vendor describes encrypted local stores on macOS devices.
- Key custody
- Device keys and platform Keychain; approved device relationships.
- Splitting & recovery
- Threshold splitting and recovery custody not established in reviewed sources.
- Transfer
- Vendor describes direct encrypted device sync over LAN or an existing private route.
- Server dependence
- Design has no coordination server; the private network route can have its own dependencies.
- Outages & failover
- Local-first design; no generally released hosted failover service verified.
- Applications & agents
- Per-command access and separate agent sessions are described; shipping maturity must be checked.
- Pricing
- No public price established; early access.
Official sources: Product and availability · Architecture approach · Positioning
EnvManager — julienBelinga GitHub projectExperimental MVP; not a production recommendation
- Storage
- README describes a planned local encrypted store and replicated ciphertext.
- Key custody
- Proposed local user keypairs, per-version data keys and a team key.
- Splitting & recovery
- Ordinary envelope/team-key distribution; threshold splitting not documented.
- Transfer
- Proposed WebRTC peers with signaling and TURN fallback.
- Server dependence
- Signaling/relay infrastructure for some routes; not a hosted plaintext vault by design.
- Outages & failover
- MVP roadmap, not evidence of implemented outage recovery or qualified failover.
- Applications & agents
- CLI and editor integrations appear in the roadmap.
- Pricing
- Open-source project; no commercial price established. Distinct from envmanager.com.
Official sources: Project README and status
dotenvxAvailable CLI; separate optional services
- Storage
- Encrypted .env values alongside readable variable names.
- Key custody
- Local private keys by default; optional Armor changes custody and access arrangements.
- Splitting & recovery
- Public/private-key encryption; copied private keys still decrypt old copies. No threshold mechanism established.
- Transfer
- Git or another file distribution channel; local decryption at runtime.
- Server dependence
- Core file workflow needs no live hosted vault; optional services add dependencies.
- Outages & failover
- Local files and keys work offline; distribution/backup resilience belongs to the chosen workflow.
- Applications & agents
- dotenvx run injects decrypted values into a process.
- Pricing
- Core CLI is free; optional service/Armor pricing requires separate review.
Official sources: Product · Encrypted file model · Private keys
SOPSEstablished open-source file tooling
- Storage
- Encrypted structured files: YAML, JSON, ENV, INI and binary content.
- Key custody
- age/PGP recipients or configured cloud KMS/Vault Transit decryptors control access.
- Splitting & recovery
- Optional key groups and Shamir threshold can require multiple groups. Ordinary multiple recipients are different.
- Transfer
- Files usually travel through Git or deployment tooling; not native peer synchronization.
- Server dependence
- age/PGP can decrypt locally; a KMS backend requires that service.
- Outages & failover
- No SOPS-hosted failover. File copies, keys and chosen KMS determine recovery.
- Applications & agents
- CLI editing/decryption and infrastructure workflows; not an agent broker.
- Pricing
- Free/open source; KMS and hosting may cost extra.
Official sources: Project · Reference and key groups · Source
pass / password-storeEstablished Unix CLI
- Storage
- Individual GPG-encrypted files in a local password store.
- Key custody
- User-held GPG private keys; authorized recipients can decrypt.
- Splitting & recovery
- Multiple GPG recipients are not threshold shares. Key backup is user-managed.
- Transfer
- Optional Git distribution of encrypted files.
- Server dependence
- Local access needs no vendor server once files and keys are present.
- Outages & failover
- Offline local access; remote Git availability affects updates rather than existing copies.
- Applications & agents
- Unix command-line integration; application injection requires an appropriate workflow.
- Pricing
- Free/open source.
Official sources: Product · Primary README
gopassAvailable open-source CLI
- Storage
- Local password stores with supported crypto/storage backends.
- Key custody
- Local GPG or age keys according to backend and configuration.
- Splitting & recovery
- Recipient access and operator key backup; no general threshold service established.
- Transfer
- Git/filesystem-backed team stores rather than a dedicated relay mesh.
- Server dependence
- Local stores can operate without a live vendor service.
- Outages & failover
- Existing local copies remain usable; synchronization and key recovery depend on the backend.
- Applications & agents
- CLI and team workflows; assess the selected backend and integration.
- Pricing
- Free/open source.
Official sources: Project · Security model
git-cryptAvailable file tool; pre-1.0 maturity caveat
- Storage
- Selected Git files are encrypted in the repository and decrypted in an unlocked working tree.
- Key custody
- Shared symmetric repository key, distributed directly or wrapped to GPG recipients.
- Splitting & recovery
- Not threshold splitting; documentation explicitly limits revocation of previously granted access.
- Transfer
- Normal Git transport and history.
- Server dependence
- Local unlocked work needs no hosted vault; a Git remote is a separate choice.
- Outages & failover
- Repository/key backups, not automatic secrets-service failover.
- Applications & agents
- Transparent file encryption; not a scoped runtime secrets agent.
- Pricing
- Free/open source.
Official sources: README, key sharing and limitations
BlackBoxAvailable repository-based tooling
- Storage
- GPG-encrypted secret files stored in a version-control repository.
- Key custody
- Authorized operators retain GPG private keys.
- Splitting & recovery
- GPG recipient distribution, not a documented threshold protocol.
- Transfer
- Git, Mercurial or Subversion workflows.
- Server dependence
- Local decryption needs files and keys; no BlackBox cloud service.
- Outages & failover
- VCS/backups provide copies; no native relay failover.
- Applications & agents
- CLI encryption/decryption for repositories and deployment.
- Pricing
- Free/open source.
Official sources: Project and usage
Ansible VaultEstablished infrastructure file encryption
- Storage
- Encrypted variables or files used by Ansible.
- Key custody
- Operator supplies vault passwords or password-provider scripts.
- Splitting & recovery
- Vault IDs/password selection are not threshold splitting.
- Transfer
- Encrypted files move through the chosen repository/deployment channel.
- Server dependence
- No Ansible-hosted vault required; external password providers can add dependencies.
- Outages & failover
- File/password backup and automation resilience, not peer or relay failover.
- Applications & agents
- Ansible task-time decryption; not a general peer-sync client.
- Pricing
- Community tooling is free; other automation offerings have separate terms.
Official sources: Vault guide
Hosted and team vaults
Bitwarden Secrets ManagerAvailable hosted service; Enterprise self-hosting
- Storage
- Encrypted organization vault with client-side decryption.
- Key custody
- Client-held cryptographic access; machine accounts receive scoped access tokens.
- Splitting & recovery
- Account recovery and key wrapping are distinct from threshold secret delivery.
- Transfer
- Cloud or self-hosted service APIs; no native LAN peer sync listed.
- Server dependence
- Service required for fresh retrieval; do not infer disconnected operation.
- Outages & failover
- Customer-visible relay failover/cache behavior not established by reviewed Secrets Manager docs.
- Applications & agents
- bws run, SDKs and machine accounts.
- Pricing
- Free: 2 users/3 machine accounts. Teams $6 and Enterprise $12 per user/month, annual billing; additional machine accounts can cost extra.
Official sources: Plans · Organization features · CLI
DopplerAvailable hosted service; enterprise on-prem option
- Storage
- Central service with tokenized, encrypted secrets.
- Key custody
- Service-side crypto uses workplace keys protected by KMS; EKM adds customer key control.
- Splitting & recovery
- Layered encryption/KMS is not a documented threshold-sharing scheme.
- Transfer
- TLS API delivery and deployment integrations.
- Server dependence
- Service for fresh data; CLI can use an encrypted local fallback.
- Outages & failover
- Documented primary/failover infrastructure plus encrypted fallback snapshots; these are separate protections.
- Applications & agents
- doppler run, service tokens/accounts and integrations.
- Pricing
- Developer free for 3 users, $8/month per additional user. Team $21/user/month; no additional agent-seat charge.
Official sources: Pricing · Security architecture and failover · Fallback files
InfisicalAvailable cloud and self-hosted platform
- Storage
- Server-side encrypted storage with a root/internal-KMS/project-key hierarchy.
- Key custody
- Runtime can decrypt authorized requests; operator root key or configured HSM protects the hierarchy.
- Splitting & recovery
- Envelope hierarchy, not documented threshold secret sharing in this model.
- Transfer
- API, CLI, agents and deployment integrations.
- Server dependence
- Service for current data; cache/agent choices require separate configuration review.
- Outages & failover
- HA depends on deployment and supporting services; do not equate cache or replication with automatic client failover.
- Applications & agents
- CLI, machine identities, dynamic-secret and rotation features by plan.
- Pricing
- Free: 5 identities. Pro $20/identity/month annually or $23 monthly; humans and machines count.
Official sources: Pricing · Current security model · Project
PhaseAvailable cloud and self-hosted platform
- Storage
- E2EE environment records by default; optional server-side encryption mode.
- Key custody
- Default client-derived keys; server-side mode deliberately changes decryptability.
- Splitting & recovery
- Docs describe a token/server two-part key arrangement; not the same as configurable Shamir groups.
- Transfer
- Client/API access and deployment integrations; some integrations require server-side mode.
- Server dependence
- Platform for fresh data; self-hosting can be air-gapped, with configured local-cache fallback.
- Outages & failover
- CLI/SDK offline cache documented; independent relay-style failover not established.
- Applications & agents
- CLI, service accounts, agent access and dynamic credentials by plan.
- Pricing
- Cloud free up to 5 users/service accounts. Pro $10/user/month annually ($12 monthly); self-hosted free core is available.
Official sources: Pricing · Security modes · Architecture
EnvManager — envmanager.comCommercial hosted service; separate from the GitHub MVP
- Storage
- Hosted environment variables using Supabase Vault encryption at rest.
- Key custody
- Service decrypts for authorized operations; not a client-only custody claim.
- Splitting & recovery
- Threshold splitting or special recovery custody not established.
- Transfer
- CLI pull/run and deployment-target synchronization.
- Server dependence
- Hosted service for normal access and synchronization.
- Outages & failover
- Offline/cache and automatic failover commitments not established in reviewed sources.
- Applications & agents
- Scoped CLI injection with output redaction; not a sandbox against arbitrary credential access.
- Pricing
- 7-day trial; advertised $9/month founding-team offer, then $19/month. Eligibility/annual terms must be checked.
1Password developer tools / Secrets AutomationAvailable subscription product
- Storage
- Encrypted 1Password vaults; Connect can cache data in customer infrastructure.
- Key custody
- Client-side account keys; service-account and Connect credentials grant runtime access.
- Splitting & recovery
- Secret Key/account recovery are not Shamir threshold distribution.
- Transfer
- CLI/service accounts or a self-hosted Connect REST API.
- Server dependence
- Fresh data needs cloud access; an initialized Connect cache reduces repeated cloud dependency.
- Outages & failover
- Connect caching is documented, not proof of an automatically configured multi-node failover deployment.
- Applications & agents
- op run/read/inject, SDKs and service accounts.
- Pricing
- Business $8.99/user/month annually; Teams Starter $24.95/month annually for 10 members. Confirm developer/Connect entitlements.
Official sources: Developer architecture and cache · Business pricing · Runtime usage
Keeper Secrets ManagerAvailable cloud platform/add-on
- Storage
- Encrypted records; vendor documents encryption and decryption on the client device.
- Key custody
- Record keys are wrapped through application/shared-folder keys; local client credentials matter.
- Splitting & recovery
- One-time provisioning tokens are not threshold shares. No threshold mechanism established here.
- Transfer
- Cloud API, SDKs and integrations.
- Server dependence
- Service access for fresh retrieval.
- Outages & failover
- Specific offline/failover guarantees not established by the reviewed KSM sources.
- Applications & agents
- CLI, SDKs, CI/CD and agent integrations.
- Pricing
- Quote/plan-dependent add-on; no reliable universal public dollar rate established.
Official sources: Encryption model · Product · Add-on pricing
PsonoAvailable cloud and self-hosted product
- Storage
- Client-encrypted objects with configurable server-side key backup.
- Key custody
- COMPLIANCE_SERVER_SECRETS controls server-held user-key backups; noone trades recovery for stricter custody.
- Splitting & recovery
- Recovery/key wrapping configuration, not documented threshold splitting.
- Transfer
- Client/server synchronization and psono-ci access.
- Server dependence
- Server for current data; optional encrypted offline browser copies.
- Outages & failover
- Offline policy is configurable; product-level automatic failover not established.
- Applications & agents
- Browser clients and CI retrieval; remote-decryption mode changes the trust boundary.
- Pricing
- Free/open-source and paid business offerings; verify current currency, minimum users and deployment license.
Official sources: Product · Key custody configuration · Plans/downloads
PassboltAvailable team credential platform; adjacent use case
- Storage
- Server holds encrypted credential objects; product describes client-side public/private-key sharing.
- Key custody
- User private keys; optional account-recovery policy requires a separate custody review.
- Splitting & recovery
- Recipient sharing is not threshold sharing; recovery configuration must be assessed independently.
- Transfer
- Cloud or self-hosted client/server distribution.
- Server dependence
- Server for collaboration; not a native peer mesh.
- Outages & failover
- Self-hosted availability is operator-managed; local-runtime failover not established here.
- Applications & agents
- Team credential collaboration; assess API/CLI fit for automated workloads.
- Pricing
- Community edition free; commercial self-hosted/cloud plans have per-user terms and currency-dependent prices.
Infrastructure platforms
HashiCorp Vault / HCP VaultAvailable server platform; CE, Enterprise and HCP differ
- Storage
- Encrypted backend behind a server-side cryptographic barrier.
- Key custody
- An unsealed server can decrypt authorized requests; KMS/HSM auto-unseal adds an external dependency.
- Splitting & recovery
- Default Shamir shares protect the unseal/root-key path, not each transmitted secret. Auto-unseal uses recovery keys differently.
- Transfer
- Authenticated API/CLI, agents, leases and dynamic credentials.
- Server dependence
- Reachable unsealed server and supporting storage/identity services.
- Outages & failover
- Active/standby HA with supported storage; Enterprise/HCP add replication and DR capabilities.
- Applications & agents
- CLI/API, agents and broad infrastructure integrations.
- Pricing
- CE has no software license fee; operations cost extra. HCP uses cluster-hour/client metering; Enterprise quote-based.
Official sources: Seal/unseal · HA · HCP billing
OpenBaoAvailable open-source server platform
- Storage
- Encrypted storage behind a cryptographic barrier.
- Key custody
- Unsealed server decrypts authorized operations; operator manages keys/seal configuration.
- Splitting & recovery
- Shamir unseal shares protect bootstrap/root-key access, not per-secret transport; auto-unseal has external dependencies.
- Transfer
- Authenticated server APIs, CLI and agent workflows.
- Server dependence
- Reachable server and supported storage backend.
- Outages & failover
- Active/standby HA with supported backends; replication/failover depends on configured topology and version.
- Applications & agents
- CLI, API, agent/proxy and dynamic-secret engines.
- Pricing
- Open-source software free; infrastructure and operation remain costs.
Official sources: Storage · Initialization · HA
AkeylessAvailable SaaS with optional customer Gateway
- Storage
- Service-managed encrypted secrets using distributed-fragment cryptography.
- Key custody
- Optional customer-held fragment makes customer participation necessary for protected operations.
- Splitting & recovery
- DFC computes through fragments/one-time derivations; not ordinary key wrapping or a claim that every plan has customer-held fragments.
- Transfer
- SaaS/Gateway API and integrations.
- Server dependence
- Selected Gateway mode needs reachable Gateway, SaaS paths and protected customer fragment.
- Outages & failover
- Cluster/cache capabilities vary; neither SLA nor internal caching establishes disconnected operation.
- Applications & agents
- CLI/API, machine identities, dynamic secrets and agent controls.
- Pricing
- Free tier with quotas; Enterprise pricing by quote.
Official sources: DFC · Customer-fragment prerequisites · Pricing
Pulumi ESCAvailable configuration/secrets control plane
- Storage
- Managed environment documents plus values resolved from connected secret providers.
- Key custody
- Delegated provider credentials and Pulumi Cloud controls; do not substitute IaC stack encryption details for an ESC custody guarantee.
- Splitting & recovery
- No ESC threshold scheme established in reviewed sources.
- Transfer
- Environment evaluation, CLI/API and provider imports.
- Server dependence
- Control-plane and selected provider availability for fresh evaluation.
- Outages & failover
- Resilience depends on cloud/provider paths; independent local peer failover not established.
- Applications & agents
- CLI/environment injection, dynamic provider credentials and IaC integrations.
- Pricing
- Basic ESC in free single-user plan; Essentials listed at $40/month with credits. Usage/features need plan review.
Official sources: Product · Environment evaluation · Pricing
Cloud secret services
AWS Secrets ManagerAvailable managed cloud service
- Storage
- Encrypted cloud secrets backed by AWS KMS.
- Key custody
- Service decrypts authorized retrievals; customer-managed KMS keys control access, not client-only decryption.
- Splitting & recovery
- Envelope encryption, not customer threshold secret delivery.
- Transfer
- AWS API/CLI/SDK and deployment integrations.
- Server dependence
- Cloud identity and network for fresh access; application caches are separate.
- Outages & failover
- Managed service availability and regional replication differ from local caches or client failover.
- Applications & agents
- AWS CLI/SDK, IAM and rotation integrations.
- Pricing
- Published examples: $0.40/secret/month + $0.05/10,000 API calls; region, KMS and related services can add costs.
Official sources: Pricing · Architecture/access · Rotation
Azure Key VaultAvailable managed cloud service
- Storage
- Managed encrypted secrets, keys and certificates; key and secret protections differ.
- Key custody
- Service returns plaintext secrets to authorized clients; HSM key features do not make ordinary secret delivery threshold-based.
- Splitting & recovery
- No customer threshold secret-delivery protocol established.
- Transfer
- Azure CLI/SDK/API under Azure identity policies.
- Server dependence
- Azure service and network for fresh retrieval.
- Outages & failover
- Zone/region reliability features and configured recovery; not disconnected local access.
- Applications & agents
- CLI/SDK and Azure workload identities.
- Pricing
- Operation-based meters per 10,000 transactions; exact rendered rates vary by region/offer and were not reliably captured.
Official sources: Overview · Reliability · Pricing
Google Secret ManagerAvailable managed cloud service
- Storage
- Encrypted active secret versions with provider-managed or configured replication.
- Key custody
- Google service decrypts authorized access; optional customer-managed Cloud KMS keys change key control.
- Splitting & recovery
- CMEK/envelope wrapping is not threshold secret sharing.
- Transfer
- gcloud/API/SDK retrieval under IAM.
- Server dependence
- Cloud endpoint for fresh retrieval.
- Outages & failover
- Automatic or user-managed regional replication; this is different from a local offline store.
- Applications & agents
- CLI/SDK and workload identities.
- Pricing
- Free: 6 active versions + 10,000 accesses/month per billing account. Then about $0.06/version/month and $0.03/10,000 accesses; other meters apply.
Official sources: Pricing · Overview · Replication
Delivery adapters and deployment tools
TellerAvailable open-source multi-provider CLI
- Storage
- Uses configured providers/files rather than providing one independent vault model.
- Key custody
- Provider credentials and each backend determine decryptability and custody.
- Splitting & recovery
- No standalone threshold scheme; inherits provider behavior.
- Transfer
- Provider reads/writes/copies and local process environment delivery.
- Server dependence
- Depends on selected providers; a local dotenv provider differs from a cloud vault.
- Outages & failover
- Provider-dependent; copy/sync commands are not automatic peer or relay failover.
- Applications & agents
- Developer CLI and environment injection.
- Pricing
- CLI free/open source; backend services can charge.
Official sources: Project and provider behavior
ChamberAvailable open-source AWS-oriented CLI
- Storage
- Defaults to AWS SSM Parameter Store; optional AWS Secrets Manager and other documented backends.
- Key custody
- AWS identity/KMS and backend permissions determine key control.
- Splitting & recovery
- No independent threshold mechanism; inherits backend cryptography.
- Transfer
- Fetches backend values and supplies commands with environment variables.
- Server dependence
- Authenticated AWS environment and reachable backend for normal reads.
- Outages & failover
- Backend resilience; not a standalone peer mesh or client failover service.
- Applications & agents
- CLI exec/export and deployment workflows.
- Pricing
- CLI free/open source; AWS service charges can apply.
Official sources: Project and backends
Sealed SecretsAvailable Kubernetes controller; adjacent deployment workflow
- Storage
- Encrypted SealedSecret manifests; controller creates ordinary Kubernetes Secrets.
- Key custody
- Controller private key stays in the cluster; plaintext Kubernetes Secrets have their own at-rest/access requirements.
- Splitting & recovery
- Public-key sealing, not documented threshold secret transport.
- Transfer
- kubeseal, GitOps and Kubernetes reconciliation.
- Server dependence
- Cluster/controller needed to unseal new objects; not a local workstation vault.
- Outages & failover
- Controller-key backups and Kubernetes availability; not LAN peer failover.
- Applications & agents
- Kubernetes secret deployment, not turnkey desktop agent injection.
- Pricing
- Free/open source; cluster costs apply.
Official sources: Project and threat boundaries
dotenv-vault / .env.vaultDocumented hosted/file workflow; current commercial availability unconfirmed; distinguish from dotenvx
- Storage
- Encrypted deployment .env.vault files plus a hosted synchronization workflow.
- Key custody
- DOTENV_KEY decrypts deployment files; hosted collaboration has separate service trust.
- Splitting & recovery
- No threshold model established by reviewed docs.
- Transfer
- CLI push/pull/build and distributed encrypted deployment files.
- Server dependence
- Hosted operations need the service; built files plus deployment keys can be decrypted locally.
- Outages & failover
- Built-file availability differs from live synchronization; failover commitments not established.
- Applications & agents
- Dotenv ecosystem and deployment/runtime loading.
- Pricing
- Current hosted/add-on price not established; do not reuse historical pricing.
Official sources: Security and formats · CLI workflow
Historical or changed offerings
EnvKeyCloud shutdown announced; self-hosted code remains
- Storage
- End-to-end encrypted app configuration in the documented client/server model.
- Key custody
- Client cryptographic access and device keys; self-hosting changes service ownership.
- Splitting & recovery
- No threshold delivery scheme established; backups/recovery require separate review.
- Transfer
- envkey-source and service-distributed environment configuration.
- Server dependence
- Old Cloud plans must not be treated as available subscriptions.
- Outages & failover
- Current hosted availability not verified; repository repeats Cloud shutdown date February 1, 2025.
- Applications & agents
- CLI/application environment integration in the published project.
- Pricing
- Community self-hosted software listed free. Historical Cloud plan prices are excluded.
Official sources: Repository shutdown notice · Pricing page with shutdown notice
OnboardbaseCurrent product availability unresolved
- Storage
- Historical secrets-management offering; current custody architecture not re-established.
- Key custody
- Unknown for a current offering; do not infer from old reviews.
- Splitting & recovery
- Unknown.
- Transfer
- Current root domain redirects to the Treadie GitHub organization.
- Server dependence
- Current service dependency not established.
- Outages & failover
- No current service/failover claim established.
- Applications & agents
- Historical capability references are not treated as current product evidence.
- Pricing
- No current verified price; excluded from purchasable-plan comparison.
Official sources: Observed current destination · Redirect target
No matching entries. Try a broader term or another category.
Comparison notes & official sources
The matrix compares the listed product families and named plans, not identical packages. Two RSS connections are different from two human seats, two machine accounts, or two stored secrets. Other providers’ free tiers may fit your deployment.
- Secrets Kit: Pricing, Security & Privacy, and the production documentation. LAN peer synchronization refers to the supported encrypted SQLite workflow. Organization audit logs are different from local transaction history.
- Bitwarden: Plans and machine-account allowances, CLI application injection, and organization features and self-hosting. The free plan also limits projects; Enterprise is required for Secrets Manager self-hosting.
- Doppler: Plan features and prices, CLI guide, and encrypted offline fallback files. Offline fallback does not turn a hosted service into native peer-to-peer synchronization.
- Infisical: Pricing, identities, and plan boundaries and the official CLI. Both humans and machines count as identities. Self-hosting has separate pricing terms.
- AWS: Pricing examples, application access and permissions, rotation, and CloudTrail logging. Rotation and logging may involve additional services or configuration; check regional prices and eligible account credits.
Which approach fits your workflow?
Where each approach fits
Secrets Kit: a good fit when you want credentials stored locally, application injection from the command line, and free encrypted synchronization between unlimited authorized peers on the same LAN segment. Hosted forwarding across networks is optional and priced separately. Compare the administration, recovery, and support features you need; this offer does not include independent security certification, organization-wide access governance, or an enterprise service-level agreement.
Bitwarden Secrets Manager: worth evaluating for a shared team secrets manager with human users and machine-account access. Its paid plans include team administration features; the Enterprise plan lists self-hosting. Those are meaningful capabilities when the team needs centralized management. See the official feature comparison.
Doppler: worth evaluating when your workflow benefits from centralized configuration and integrations. Its published Team plan includes access controls, SAML single sign-on, and secret rotation. Its free tier and lack of additional agent-seat fees matter when estimating the cost of an agent-heavy setup. See Doppler’s pricing and feature table.
Infisical: worth evaluating when you need a broader secrets-management platform and centralized access features. Its Pro plan lists access controls, rotation, and SAML single sign-on; identity-based pricing means machines belong in the estimate too. Check the current plan boundaries, especially when you need dynamic secrets or self-hosting.
AWS Secrets Manager: worth evaluating for applications already operating inside AWS. Its secret-and-API pricing can suit a different usage pattern from connection or seat subscriptions. Include the AWS identity, permissions, application integration, and related operational work in your assessment. Use the official pricing examples rather than treating an API price as the entire deployment cost.
What about keeping my .env files?
A .env file can be a straightforward way to configure one trusted application. The difficulty grows when values are copied across repositories, backups, machines, and agent conversations. File permissions, exclusions from version control, and the application’s behavior still need attention.
Secrets Kit gives you a local store and selected process injection, reducing the need for those copies. It does not automatically rewrite applications that require a password file, remove old .env files, or stop a process from exposing values it receives. Migration should preserve the original configuration until you have verified the replacement source and approved the cutover.
Decide with a small trial
Choose one application and disposable credentials. Check the setup effort, actual access boundaries, recovery path, and cost for your own users and machines. Get Started links to the installation instructions. Security & Privacy explains what Secrets Kit does and does not protect.