If you were planning to buy Vault as a managed service on a small budget, that option closed last month. HCP Vault Secrets went end of sale on June 30, 2025, and remaining contract customers hit end of life on whichever came first, their contract expiry or July 1, 2026. HashiCorp points you at HCP Vault Dedicated instead, which is hosted Vault Enterprise: a different product with a different bill.
Two weeks before that cutoff, Vault jumped from 1.21 to 2.0. No rewrite happened. The number now tracks IBM's versioning and its Support Cycle-2 policy, which retires HashiCorp's long-term support labels. At the same time, the fork that appeared when Vault left open source has been shipping features Vault charges for. I published a longer version of this comparison on DevToolLab, Best Secrets Management Tools in 2026, with the full pricing tables and a migration checklist. This is the condensed pass.
The Job, and the Two Jobs Next to It
A secrets manager stores credentials, hands them to workloads that can prove identity, and takes them back. Two adjacent categories get confused with it constantly. Secrets scanning hunts for credentials already sitting in your git history. Non-human identity management decides which machine identities should exist and what they may touch. Neither one is this. This is the storage and distribution layer between them.
The question that actually sorts these tools is whether you need dynamic secrets: credentials minted on request with a lease attached, so a leaked one dies on its own. That single capability is why Vault exists and why it costs more to run than a key-value store behind an API.
Four Shapes, Not Eight Products
Everything in this category collapses into four operating models.
Run your own engine (Vault, OpenBao) and you get dynamic secrets, PKI and encryption as a service, plus a cluster to keep alive at 3am. Buy a SaaS platform (Infisical, Doppler) and you get a solid CLI, environment sync and a bill that meters either seats or identities. Use whatever your cloud already ships (AWS Secrets Manager, Google Secret Manager, Azure Key Vault) and it inherits your existing IAM and audit trail, charged per secret or per call. Or skip servers entirely with SOPS plus age, encrypting values inside files you commit.
| Tool | Shape | License | Dynamic secrets | Cost |
|---|---|---|---|---|
| Vault | Self-hosted engine | BUSL 1.1 | Yes | Community free, Enterprise quoted |
| OpenBao | Self-hosted engine | MPL 2.0 | Yes | Free, 8 vendors sell support |
| Infisical | SaaS + self-host | MIT core | Advanced tier | Free 5 identities, $20-$40/identity/mo |
| Doppler | SaaS | Proprietary | Enterprise tier | Free 3 users, Team $21/user/mo |
| AWS Secrets Manager | Cloud native | Proprietary | Rotation Lambdas | $0.40/secret/mo + $0.05/10k calls |
| Google Secret Manager | Cloud native | Proprietary | No | $0.06/version/mo + $0.03/10k ops |
| SOPS + age | Encrypted in git | MPL 2.0 / BSD | No | Free |
| External Secrets Operator | Kubernetes glue | Apache 2.0 | Passes through | Free |
Two of these shapes in one org is the normal outcome, not a failure. Choosing the boundary on purpose is the part teams skip.
Vault Is Now an IBM Product
Vault stays the deepest toolbox here and has not been open source since the Business Source License 1.1 switch in August 2023. Enterprise 2.0 arrived April 13, 2026 carrying workload identity federation for secret distribution, credential rotation targeting RHEL and Ubuntu hosts, envelope encryption for large payloads, a SPIFFE engine that issues JWT SVIDs, public CA support, and SCIM in beta.
The release cadence changed more than the feature list did. Self-managed Enterprise now ships two feature releases a year, spring and fall, with monthly security patches, and IBM's SC2 policy guarantees at least two years of standard support per release with extended cover reaching year six. The HashiCorp support portal itself folds into IBM's on August 21, 2026.
Community Edition remains free and still mints dynamic secrets. Skipping Enterprise costs you namespaces, DR replication, HSM auto-unseal and the compliance surface, and buys you a cluster to operate.
OpenBao Ships What Vault Bills For
OpenBao branched off Vault's final MPL 2.0 release and now lives under the Linux Foundation with OpenSSF governance. It is maintained, not archived: 2.6.0 landed July 14, 2026 and 2.6.1 followed on July 22.
The 2.6 line introduced namespace sealing, giving each namespace its own Shamir key material so a single tenant can be sealed off independently. Auto-unseal moved out into external kms plugin binaries that restart themselves, a sys/workflows API arrived for wrapping the standard API in simpler interfaces, the old unauthenticated root token generation endpoint was replaced with an authenticated one, and a distroless container image shipped. Version 2.5 had already added horizontal read scaling.
Compare that list against the Vault price sheet: namespaces and read scaling are Enterprise line items, free here. GitLab, SAP, Proton, Fermilab, ControlPlane and Adfinis sponsor the project, NVIDIA shows up as an adopter, and eight companies sell commercial support.
The real cost is gravity. Vault has more tutorials, more answered Stack Overflow questions and more engineers who have already survived an outage with it. API compatibility carries most of that knowledge across, but you are the one signing off.
SaaS: Read the Meter, Not the Feature List
Infisical and Doppler are both polished, both have a CLI that injects secrets into a running process, both sync into CI and cloud providers, and both self-host on paid tiers. Their feature grids will not decide anything for you. Their billing units will.
Infisical is MIT at the core with 27,000 GitHub stars and charges per identity. Free covers 5 identities, 3 environments and 10 syncs. Pro runs $20 per identity per month annually ($23 monthly) with access controls, rotation, SAML SSO and 30-day audit logs. Advanced doubles that to $40 and unlocks dynamic secrets, honey tokens, custom roles and 90-day logs. Enterprise adds approvals, LDAP, SCIM, KMIP and self-hosting.
Doppler charges per human instead. Developer is free up to 3 users, then $8 a month each. Team is $21 per user per month with change requests, SAML SSO, RBAC, 90-day logs and automatic rotation. Enterprise adds dynamic secrets and log forwarding. Doppler states plainly that AI agents and non-human identities are free and never consume a seat.
Put a shape to it. Eight engineers running 150 services and agents costs roughly $168 a month on Doppler Team; the same estate on Infisical Pro, if each of those 150 identities bills, lands in four figures. Invert it, three engineers with 10 identities, and Infisical is cheap while both are affordable. So count your machine identities before you open either pricing page. That number is outgrowing your headcount and it is the widest cost gap in the category.
The Cloud Manager You Are Already Paying For
Living in one cloud makes the native manager the least work available. It already sits inside your IAM policies, already lands in CloudTrail, and needs no cluster.
AWS Secrets Manager bills $0.40 per secret per month plus $0.05 per 10,000 API calls. Google Secret Manager bills $0.06 per active version per location per month plus $0.03 per 10,000 access operations, with rotation notifications at $0.05 and destroyed versions free. Azure Key Vault meters per 10,000 operations rather than per stored secret.
Volume is where this bites. 500 secrets on AWS is $200 a month before anything reads them, and per-secret pricing nudges teams into cramming many values into one JSON blob, which silently deletes per-secret access control. At that scale, Google's per-version rate or your own engine costs less. Anything that is configuration rather than a credential belongs in AWS Systems Manager Parameter Store standard parameters, which are free.
SOPS and age: Encryption Without a Server
SOPS is a CNCF sandbox project that encrypts only the values in YAML, JSON or .env files, leaving keys in the clear so an encrypted file still diffs meaningfully in git. Pair it with age and no cloud KMS is involved at all.
The entire setup, on sops 3.13.3 and age 1.3.1:
age-keygen -o key.txt # prints the public key to stderr
cat > .sops.yaml <<'YAML'
creation_rules:
- path_regex: \.yaml$
age: age1v0hwa90c72kq737nmldg25kragalsez390fefpahyu9y8n5tsdcsukz20r
YAML
sops --encrypt --in-place secrets.yaml
What gets committed keeps every structural key and loses every value:
database:
host: ENC[AES256_GCM,data:VR2SjbbqDZ4tQgE=,iv:p6Vh3yvG1i7hDZVok16lnU5ekraECwG6nA/OSrEKcmM=,tag:cT71TttqKRWcuKkEAY+wtw==,type:str]
password: ENC[AES256_GCM,data:fyaQknjAvt2gYR+Ebfr2B64=,iv:1t+3u5JEBvt7B9z9PyrzrkBa4cKX30ALTmiT4MJH+ls=,tag:sLeVLckj0U//drSKrq+10Q==,type:str]
stripe:
secret_key: ENC[AES256_GCM,data:EYm3G333nlxQzRPJrrQD4YFdBotUADQ/d7rH,iv:d4us0HydwkJMzrevJw38Rb0J7Bge736ZiG2FvabuwZU=,tag:HB+hnnJJ8pKLf+QSOsfwPA==,type:str]
Confirming the round trip actually works, against that same file:
$ grep -c 'database:\|stripe:\|password:\|secret_key:' secrets.yaml
4
$ grep -c 'hunter2\|sk_live_51H' secrets.yaml
0
$ SOPS_AGE_KEY_FILE=key.txt sops --decrypt secrets.yaml
database:
host: db.internal
password: hunter2-but-worse
stripe:
secret_key: sk_live_51Hxxxxxxxxxxxxxxxx
Four keys readable, zero plaintext values, decrypt returns the originals. Missing from this picture: rotation, leases, dynamic secrets and any audit log, and the age key is now your distribution problem. For a homelab, a three-person team or the manifests in a GitOps repo, that is frequently the right trade.
Make the Decision Reversible First
External Secrets Operator, another CNCF sandbox project, matters no matter which shape you pick. It runs inside your cluster, pulls from Vault, OpenBao, AWS, Google, Azure, Infisical or Doppler, and turns a declarative ExternalSecret into a native Kubernetes Secret.
That layer of indirection is the whole point. Your applications read an ordinary Secret, the operator holds the provider integration, and swapping AWS Secrets Manager for OpenBao edits one resource instead of every deployment. On Kubernetes, install it before you commit to any provider.
Picking One
Need dynamic database credentials or internal PKI? OpenBao when license terms or budget block you, Vault when you want the vendor relationship and the ecosystem. Both deliver; one carries a BUSL.
Single cloud with tens of secrets? Use the native manager and stop there. Bolting a secrets platform onto an estate that already has IAM buys nothing at that size.
More services and agents than engineers? Price Doppler per seat against Infisical per identity using your real numbers.
Want self-hosting with a modern UI? Infisical, MIT at the core, unless leases and dynamic secrets outrank the interface, in which case OpenBao.
Small team on GitOps with no server budget? SOPS with age, and be honest with yourself that you picked encryption over rotation.
Getting Out of .env Files
Gather every .env, CI variable and shared credential note first. A diff across environments catches the variable that somehow only exists in production, and DevToolLab's Env File Diff Checker does that in the browser. Lint those files before migrating them, because duplicate keys and unquoted values with spaces surface later as bugs that look like secret-manager failures.
Treat every value that ever touched git as public and rotate it. Then pick one boundary, write down which system owns application credentials and which owns infrastructure credentials, and hand workloads an identity rather than a token: OIDC federation in CI, IRSA or workload identity in Kubernetes, so short-lived credentials replace static ones.
Verify what actually landed. A base64 round trip is where mismatched values usually show themselves, and the Kubernetes Secret Decoder will tell you what the cluster is really holding. Delete the originals last, then add scanning so they cannot creep back. The full guide on DevToolLab walks through each of those steps with the specific tooling.
Conclusion
What changed in 2026 is that the open options stopped being compromises, so the license became the deciding variable instead of the capability. OpenBao ships namespaces and horizontal read scaling under MPL 2.0. Infisical is MIT at the core. SOPS costs nothing and runs no server. External Secrets Operator keeps the whole decision reversible. Vault is still the most capable thing here and is now an IBM product on an IBM cadence with no budget SaaS door. Count your non-human identities, settle whether dynamic secrets are genuinely required, and then choose the meter you can live with.
Prices and versions move fast. Check each vendor's page before committing.
Top comments (0)