Secrets management

A secrets manager keeps an engineering team's API keys, database passwords, tokens and environment variables in one encrypted place, controls who and what can read them, and delivers them to where code runs: developer laptops, CI pipelines, servers and Kubernetes. Teams use one to stop passing .env files around, to rotate credentials without redeploying, and to answer an auditor's question about who read a secret and when. They differ in how they bill (per engineer, per identity including machines, per secret and API call, or per cluster-hour and client), whether they push secrets to CI and hosting platforms or are read where they live, whether they rotate or generate credentials for you, and where single sign-on, SCIM, long audit logs and a HIPAA agreement sit.

We compare them on the same six indicators, read from each vendor's pricing, trust, legal and documentation pages:

• Pricing clarity: whether the plan you need has a published price, can be bought online and month to month, whether usage past the limits is priced, and whether the pages leave prices out or contradict each other.
• Free tier and trial: a permanent free tier a real project can use, with several users, enough secrets, an audit log and an integration; otherwise the length of the trial and whether it needs a card; and whether a free self-hosted edition exists.
• Price for the reference scenario: the monthly cost for 10 engineers and 5 machine identities managing 200 secrets across 3 environments, with 1,000,000 reads a month and a 30-day audit log, with the arithmetic shown; 0 when the pages cannot price it.
• Secret lifecycle and delivery: database rotation, dynamic secrets, versioning with rollback, syncs or integrations to CI and hosting, and Kubernetes delivery, and on which plan each one sits.
• Compliance and trust: the vendor's own SOC 2 Type II and ISO 27001, a HIPAA agreement, storing secrets in the EU, and FIPS-validated crypto or keys you manage.
• Access control and exit: SAML single sign-on, SCIM, audit log retention and streaming, per-environment roles, a bulk export of your secrets, and a way to run it yourself.

How fast or how reliably a service answers depends on where and how it runs, so we do not score it. Each review says which pages it was written from and when. Where we have run a product hands-on, the evidence is on its page.