Secrets Management Tools (2026): Vault, OpenBao, Infisical, SOPS

What Is Secrets Management?

4 entries

Secrets management is the practice and tooling for storing, distributing, rotating and auditing credentials such as API keys, passwords, tokens and certificates, so they do not live in source code, images or chat. Typical capabilities are central storage with access control, short-lived or dynamically generated credentials, automatic rotation, audit logs and integrations with CI/CD, Kubernetes and cloud platforms. It is closely related to encryption key management and privileged access management.

01Encryption Key Management SoftwareKey management and vault vendors, on this site. 02Privileged Access Management (PAM) ProductsPAM vendors, on this site. 03DevSecOps ToolsDevSecOps tools including secret scanners, on this site. 04Software Supply Chain SecuritySBOM, SLSA and Sigstore, on this site.

Secrets Vaults and Platforms

8 entries

Self-hosted and managed platforms for storing and brokering secrets. Release facts are from each repository's GitHub page, and vendor descriptions follow the vendors' own pages.

05HashiCorp VaultSecrets management and encryption platform. HashiCorp is part of IBM, and GitHub lists v2.2.1 as the latest release, from 22 October 2026. GitHub does not identify the licence as open source, so check the current terms. 06OpenBaoCommunity fork of Vault to manage, store and distribute sensitive data (MPL-2.0); GitHub lists v2.7.2 as the latest release, from 26 October 2026. 07InfisicalPlatform for secrets, certificates and identity security that its site says targets developers, machines and AI agents; GitHub lists v0.167.4 as the latest release, from 26 October 2026. 08DopplerSecrets management platform that its site says helps teams secure, sync and automate secrets across cloud and on-premises environments. 09AkeylessPlatform that its site says secures machines, AI agents and humans on a cloud-native, zero-knowledge architecture. 10Bitwarden Secrets ManagerSecrets storage and deployment product for developers and DevOps teams from Bitwarden. 111Password Secrets AutomationService accounts and Connect server for securing and orchestrating infrastructure secrets with 1Password. 12CyberArk Conjur (Palo Alto Networks)Secrets management for hybrid and multicloud environments. The conjur.org site now redirects to Palo Alto Networks, which completed its CyberArk acquisition in February 2026; the open-source repository lists v1.27.0 (June 2026) as its latest release.

Cloud Secret Managers

3 entries

Managed secret and key services from the major clouds, described from each provider's own pages.

13AWS Secrets ManagerAWS says it lets you rotate, manage and retrieve database credentials, API keys and other secrets through their lifecycle. 14Azure Key VaultMicrosoft describes it as securing passwords, cryptographic keys and secrets for cloud apps. 15Google Cloud Secret ManagerGoogle describes storing API keys, passwords, certificates and other sensitive data.

Kubernetes and GitOps Secrets

4 entries

Tools that bring external secrets into clusters or keep encrypted secrets in Git.

16External Secrets OperatorKubernetes operator that reads information from third-party secret stores and creates Kubernetes secrets (Apache-2.0); active in October 2026. 17Secrets Store CSI DriverKubernetes SIG driver that mounts secrets from external stores into pods (Apache-2.0); GitHub lists v1.6.1 as the latest release, from 9 September 2026. 18Sealed SecretsKubernetes controller and tool for one-way encrypted Secrets that are safe to store in Git (Apache-2.0); GitHub lists v0.41.2 as the latest release, from 26 October 2026. 19SOPSTool for editing and managing encrypted files with keys from KMS services (MPL-2.0); GitHub lists v3.13.3 as the latest release, from 23 July 2026.

Secret Scanning

3 entries

Tools that find credentials that have leaked into code, history or logs.

20GitleaksOpen-source tool that finds secrets in git repositories (MIT); GitHub lists v8.30.1 as the latest release, from March 2026. 21TruffleHogFinds, verifies and analyzes leaked credentials (AGPL-3.0); GitHub lists v3.99.7 as the latest release, from 24 October 2026. 22GitHub secret scanningGitHub documentation on detecting exposed credentials before they can be exploited.

Frequently Asked Questions

What is secrets management?

Storing, distributing, rotating and auditing credentials such as API keys, passwords, tokens and certificates in a central, access-controlled system instead of in code or configuration files.

What is the difference between secrets management and key management?

Secrets managers store and broker credentials for applications, while key management systems create and protect cryptographic keys, often in hardware. Many products cover both. See the Encryption Key Management page on this site.

Why not store secrets in environment variables or Git?

Environment variables and repositories are easy to leak through logs, images and history, and they cannot be rotated or audited centrally. Use a secrets manager, or encrypted files with SOPS or Sealed Secrets, and scan repositories for leaks.

How do secrets reach Kubernetes workloads?

Common approaches are External Secrets Operator or the Secrets Store CSI Driver, which sync or mount secrets from an external store, and Sealed Secrets or SOPS, which keep encrypted secrets in Git.

Is OpenBao the same as Vault?

OpenBao is a community fork of Vault under the MPL-2.0 licence. The two projects have diverged, so check feature and API compatibility before migrating.

How current is this page?

Links were checked on 31 October 2026. Release facts are from GitHub, the Conjur address redirects to Palo Alto Networks, and vendor descriptions follow each vendor's own pages and are not independent evaluations.