The best secrets management tool depends on where your apps run: a cloud provider's own service suits apps on one cloud, a dedicated platform suits teams across several environments, and an open source manager suits teams that self-host. Eleven options follow in no particular order.
Secrets are the passwords, API keys, tokens and certificates your software uses to talk to other systems. Left in code, chat messages or config files, they're one of the easiest ways in for an attacker.
The eleven tools below are listed alphabetically and in no particular order, from cloud services to open source vaults and leak scanners. Every description comes from the vendor's own site, read this week. If you're comparing password managers for people rather than machines, my review asking whether Bitwarden is safe is a good place to start.
Secrets managers at a glance
In the free plan column, Yes means the tool's own site names a free plan, a free version, a free tool or an open source edition. Trial only means a time-limited trial. Not stated means the pages I read named neither, even where there's a button inviting you to try it.
| Tool | Type | Good for | Free plan |
|---|---|---|---|
| Akeyless | Secrets and machine identity platform | Secrets for AI agents and machines | Not stated |
| AWS Secrets Manager | Managed secrets service on AWS | Apps running on AWS | Not stated |
| Azure Key Vault | Keys and secrets service on Azure | Apps running on Azure | Not stated |
| Bitwarden Secrets Manager | Open source secrets manager | Teams already using Bitwarden | Yes |
| Doppler | Secrets platform for people and agents | Replacing shared env files | Not stated |
| GitGuardian | Secret leak detection | Catching leaked keys before they ship | Yes |
| Google Secret Manager | Managed secrets service on Google Cloud | Apps running on Google Cloud | Not stated |
| HashiCorp Vault | Secrets and encryption platform | Large estates with strict access control | Not stated |
| Infisical | Developer security platform | Giving agents scoped access to tools | Not stated |
| OpenBao | Open source fork of Vault | A community-run secrets manager | Yes |
| SOPS | Encrypted config file tool | Keeping secrets in Git safely | Not stated |
Eleven secrets management tools worth comparing
Akeyless
Best for: Security teams that want secrets management and runtime control over what machines and AI agents are allowed to do.
AWS Secrets Manager
Best for: Teams on Amazon Web Services that want database passwords and API keys stored and rotated inside their existing cloud.
Azure Key Vault
Best for: Microsoft Azure users who want keys, secrets and certificates kept in a managed vault next to their other services.
Bitwarden Secrets Manager
Best for: Developers who want an open source, third-party audited secrets manager from the same company as a popular password manager.
Doppler
Best for: Engineering teams that want one place for every secret used by people, workflows and AI agents, on-prem or in the cloud.
GitGuardian
Best for: Organisations that want leaked keys caught in commits, laptops and AI coding tools, with free tools such as a leak checker.
Google Secret Manager
Best for: Google Cloud users who want API keys, passwords and certificates stored in a managed service in the same console.
HashiCorp Vault
Best for: Larger organisations that want to tightly control access to tokens, passwords, certificates and encryption keys through a UI, CLI or API.
Infisical
Best for: Developer teams that want secrets managed for apps and AI agents without handing those agents raw credentials.
OpenBao
Best for: Anyone who wants an open source, community-driven secrets manager forked from Vault and run under the Linux Foundation.
SOPS
Best for: Small teams who want secrets kept inside encrypted config files in Git, with access managed through identities.
Want AI doing the heavy lifting in your marketing?
I build the systems that handle the boring 80 percent, so you get your week back. Done properly, with the human kept in.
Vaults, cloud services or leak scanners?
Vaults store secrets centrally, control who can read them and rotate them on a schedule. Cloud secret services do the same inside one provider's platform. Leak scanners solve a different problem: they find secrets that have already slipped into code, commits or logs.
Most teams need a store and a scanner. The store keeps secrets out of code; the scanner catches the times someone pastes one in anyway.
What the NCSC says about secrets in code
The NCSC advises logically separating secret credentials from source code, with a carefully defined injection process, to help prevent them leaking. It also suggests key rotation and automatic scanning of code repositories for secret keys.
In practice that means apps fetch secrets when they run, nobody copies them into files, and a scan runs on every commit. AI agents need the same treatment: give them scoped, short-lived access rather than a master key.
Questions to ask before you choose
- Where do our apps run: one cloud, several or on our own servers?
- Can secrets rotate automatically?
- How do developers get secrets onto their laptops?
- Can AI agents and pipelines get scoped, short-lived access?
- Is every read of a secret logged?
- Does it include leak scanning, or will we add a separate tool?
Signs your secrets are sprawling
- Keys live in env files shared by chat. Anyone with the message has the key.
- Nobody knows when a key last changed. Rotation isn't happening.
- Leavers still know production passwords. Shared secrets never got replaced.
- Pipeline logs show tokens. They're exposed to anyone with log access.
Do you make a secrets management tool? Tool makers can ask to be considered for a featured place on this list.
My plain advice on managing secrets
Start with an audit: search your repositories and chat history for keys, rotate anything you find and move it into one store. That single exercise usually finds more than anyone expects.
Then make the safe path the easy one. If fetching a secret the safe way takes longer than pasting it, people will paste. The story of the LastPass breach is a reminder that how secrets are stored, and who can reach them, matters as much as the brand on the box.
Frequently asked questions
What is secrets management?
It's storing, controlling access to and rotating the passwords, keys, tokens and certificates that software uses, instead of keeping them in code or files.
Is a password manager the same as a secrets manager?
Not quite. Password managers are built for people. Secrets managers are built for apps, pipelines and machines, with APIs, rotation and audit logs.
What is secret rotation?
It's replacing a secret with a new one on a schedule or after a leak, so an old copy stops working.
What should I do if a key leaks into Git?
Revoke and replace it straight away. Deleting the commit isn't enough, because copies may already exist.
Are there open source secrets managers?
Yes. Some tools in the table name an open source edition on their own site. Check the free plan column.
Do AI coding agents need secrets management?
Yes. Agents that call APIs need credentials, and they should get scoped, short-lived access rather than long-lived keys.
