17.6
Envshed manages encrypted secrets and environment settings for small teams, with a CLI built for monorepos.
Free planWebAPILinux
Best Secrets Management Tools in 2026
Envshed leads this chart of 46 (7.6/10, free plan). Keyway is next (7.1/10, free plan), and Infisical is the next highest-placed with a free plan (7.0/10). Secrets management tools store and control access to sensitive values such as application secrets; deployment model and the features you need help decide which one fits. Compare secret rotation, dynamic secrets, CI/CD injection, Kubernetes integration, audit logs, and free secret limits. If you need to manage secrets from an Android device, check for Android app support directly; the platform details here do not…
27.1
Keyway injects secrets into processes so they are not stored in project .env files.
Free planWebAPILinux
37.0
Infisical manages and audits application secrets across environments, with role-based access controls.
Free planWebAPILinux
- 4
Oracle Cloud Infrastructure Secret Management
Oracle Cloud Infrastructure Secret Management provides web and API access to cloud secrets.
Free planWebAPI7.0Free plan - 5
secr
secr injects secrets into processes and supports separate development, staging and production environments.
Free planWebAPIExtensionLinux7.0From $6 a month - 6
SikkerKey
SikkerKey manages application and infrastructure credentials, including leased, certificate and TTL secrets.
Free planWebAPILinuxmacOS7.0From $29 a month - 7
KeyEnv
KeyEnv manages environment variables and can rotate PostgreSQL and MySQL credentials on a schedule.
Free planWebAPILinuxmacOS6.9From $40 a year - 8
Phase
Phase manages and deploys application secrets, with integrations for cloud, CI/CD and container tools.
Free planWebAPILinuxmacOS6.9From $10 a month - 9
Doppler
Doppler stores and manages application secrets through a dashboard, API, and command-line tool.
WebAPIExtensionLinux6.7From $8 a month - 10
dotenvx
dotenvx encrypts secrets in .env files and decrypts them at application runtime.
Free planLinuxmacOSSelf-hostedWindows6.7From $5 a month - 11
Keyshade
Keyshade syncs secrets across environments and scans codebases for exposed credentials.
Free planWebAPISelf-hosted6.7From $7.99 a month - 12
Secrets Manager
Secrets Manager is a self-hosted system for editing, versioning and injecting application secrets.
Free planWebAPILinuxmacOS6.7Free plan - 13
AWS Secrets Manager
AWS Secrets Manager stores application credentials and controls access with IAM and resource policies.
Free planWebAPI6.6$0.40 usage-based - 14
Google Cloud Secret Manager
Free planWeb6.5From $0.02 a month - 15
OpenBao
OpenBao stores and controls access to secrets, with a UI, CLI and HTTP API.
Free planWebAPILinuxmacOS6.4Free plan - 16
PX Secrets
PX Secrets stores an encrypted local vault and offers a web UI, CLI and local API.
Free planWebAPILinuxmacOS6.4Free plan - 17
SAP Extended Enterprise Content Management by OpenText
AndroidiOSWebLinux6.4 - 18
VMware Secrets Manager
VMware Secrets Manager delivers secrets to workloads dynamically and runs only on Kubernetes.
Free planAPILinuxSelf-hosted6.4Free plan - 19
Stashbase
Stashbase manages project secrets and governs coding agents' access to credentials, tools and files.
Free planWebAPILinuxmacOS6.2Free plan - 20
Chamber
Chamber keeps passwords, API keys, certificates and notes in encrypted local SQLite vault files.
Free planAPILinuxmacOSSelf-hosted6.1Free plan - 21
OpenStack Barbican
OpenStack Barbican stores and manages secrets through an OpenStack-native REST API.
Free planAPILinuxSelf-hosted6.1Free plan - 22
Shelve
Shelve manages team environment variables and secrets across development, preview, and production.
Free planWebAPISelf-hosted6.1Free plan - 23
Teller
Teller connects to cloud and other secret providers and supplies their values to commands and Docker.
Free planLinuxmacOSWindows6.1Free plan - 24
Vibr8Vault
WebAPILinuxmacOS6.1 - 25
Keyorix
Keyorix manages secrets, keys, and certificates on-premises, including in air-gapped environments.
WebAPILinuxmacOS6.0
Choosing well
Which deployment model fits your setup?
Choose a deployment model that matches how you plan to run the tool.
The comparison covers deployment model and platforms such as web, API, Linux, and self-hosted. Check the product details for the environments you need.
Which secret management features do you need?
Start with the features your workflows require.
Compare secret rotation, dynamic secrets, CI/CD injection, Kubernetes integration, and audit logs. A feature listed in the comparison does not by itself establish how it works for your setup.
Can you start with a free plan?
Check whether a free plan is available and whether its secret limit fits your needs.
Compare the paid starting price and trial terms as well. For example, Envshed lists a free plan, paid plans from $5 per user per month, and a 14-day trial.
Which platforms should you check?
Check the platforms you need before choosing a tool.
The platform comparison includes web, API, Linux, self-hosted, macOS, and Windows. If Android access matters, verify it with the maker; Android support is not established by these platform details.
Questions people ask
What does a secrets management tool do?
It stores and controls access to secrets. Compare the features and deployment model against the needs of your setup.
Do secrets management tools have Android apps?
Android app support is not established by the platform details here. Check with the maker if you need to manage secrets from an Android device.
What features should I compare in a secrets manager?
Compare secret rotation, dynamic secrets, CI/CD injection, Kubernetes integration, audit logs, and the free secret limit.
Can I use a secrets management tool for free?
Free plans and free secret limits are part of the comparison. Check the maker's current plan details to see whether a free option fits.
Can I self-host a secrets management tool?
Self-hosted deployment is included in the platform comparison. Check individual product details to confirm the deployment options you need.