Phase

B tier on Secrets Management ToolsScore 7.1 · #4 of 39

Android app: Not listed
Free plan: Yes
Paid plans from: $10/mo
Runs on: api, Linux, Mac, self-hosted, Web, Windows

phase.dev

Summary

Phase is an open-source platform for managing application secrets from development through production. It supports managed Cloud deployment or self-hosting, including in air-gapped environments, and is available for Linux, macOS, Windows, web, API, and self-hosted use. Phase says end-to-end encryption is on by default, with servers holding only ciphertext in that mode. Its CLI caches secrets encrypted locally and can inject them while offline. Teams can set managed or custom roles by app and environment, apply IP allow-lists, review records of access and changes, and use point-in-time rollback. Listed connections include AWS, Azure, HashiCorp Vault, Docker, Kubernetes, Cloudflare, GitHub, GitLab, Vercel, and Railway. The CLI also installs skills for Claude Code, Codex, Cursor, OpenCode, and VS Code Copilot to manage secrets through natural-language instructions. The Free plan supports up to 5 users or service accounts, 3 apps, and 3 environments. Pro is $10/user/mo, with a 14-day trial.

Who it is for

Phase suits teams that need to manage application secrets across development and production, with a choice of managed or self-hosted deployment. Its Free plan is sized for up to 5 users or service accounts, 3 apps, and 3 environments.

What is good

Self-hosting supports air-gapped environments.
CLI can inject locally encrypted secrets offline.
Roles can be scoped by app and environment.
Integrates with Kubernetes, GitHub, and other listed tools.

What to know first

Free plan caps users or service accounts at 5.
Free plan is limited to 3 apps and 3 environments.
Pro is $10/user/mo.

Verdict

Phase combines secret management, access controls, audit records, and recovery features across managed and self-hosted deployments. The Free plan has defined limits; Pro adds broader capacity and features at $10/user/mo.

Phase plans and pricing

All plans

Free Free Up to 5 Users or Service Accounts · Up to 3 Apps · 3 Environments · OAuth SSO · AI Agent Integration · Phase Agents Relay phase.dev · 30 Sept 2026

Pro $10/mo $120 billed annually ($144 shown) Unlimited Users & Service Accounts · Unlimited Apps · 10 Custom Environments · Teams · Custom Roles · Network Access Policies · Point-in-time Recovery · Automated Secret Rotation · 90-day Audit Logs · 14 days free trial phase.dev · 30 Sept 2026

Enterprise $25/mo $300 billed annually ($360 shown) Unlimited Custom Environments · OIDC SSO · SCIM Provisioning · Dynamic Secrets · Global Network Access Policies · Third-party KMS · Audit Log Forwarding · SIEM Integration · SOC 2 Type 2 Audit Report · External Penetration Testing Reports · 14 days free trial phase.dev · 30 Sept 2026

Compared on secrets management tools

Free plan: Yesphase.dev
Secret rotation: Yesphase.dev
Dynamic secrets: Yesphase.dev
CI/CD injection: Yesphase.dev
Kubernetes integration: Yesphase.dev
Deployment model: bothphase.dev
Audit logs: Yesphase.dev

Facts

Product: Phase is an open source platform to securely access, manage and deploy application secrets from development to production.phase.dev · 30 Sept 2026
AI agents: The Phase CLI installs skills that let Claude Code, Codex, Cursor, OpenCode and VS Code Copilot manage secrets using natural language.phase.dev · 30 Sept 2026
Integrations: Listed integrations include AWS, Azure, HashiCorp Vault, Docker, Kubernetes, Cloudflare, GitHub, GitLab, Vercel and Railway.phase.dev · 30 Sept 2026
Security: Phase says end-to-end encryption is enabled by default and its servers store only ciphertext in that mode.phase.dev · 30 Sept 2026
Security audit: Phase says it is independently audited under SOC 2 Type 2 and penetration tested by Oneleet.phase.dev · 30 Sept 2026
Deployment: Phase can run as fully managed Cloud or self-hosted on your own infrastructure, including air-gapped environments.phase.dev · 30 Sept 2026
Access control: Phase offers managed and custom RBAC roles, scoped per app and environment, plus IP allow-lists for users and service accounts.phase.dev · 30 Sept 2026
Audit and recovery: Phase records access, changes and grants, and its home page describes point-in-time rollback for any secret.phase.dev · 30 Sept 2026
Offline mode: The CLI caches secrets locally encrypted at rest and supports injecting them while offline.phase.dev · 30 Sept 2026
Support: Pricing lists community, email and Slack support, with dedicated live support and SLAs as an optional add-on.phase.dev · 30 Sept 2026
Notable limits: The Free plan allows up to 5 users or service accounts, 3 apps and 3 environments.phase.dev · 30 Sept 2026
Company: The site identifies the company as Phi Security Inc. and lists its address in Dover, Delaware, United States.phase.dev · 30 Sept 2026