Secrets management · Comparison
AWS Secrets Manager vs Doppler vs Infisical
3 products compared side by side: what you pay for with each one first, then the five access facts, entry prices, recorded plan limits and the bottom line of each review. The evidence note under the table says how each product was checked.
Side by side
| Metric | AWS Secrets Manager | Doppler | Infisical |
|---|---|---|---|
| What you're paying for | Compliance includedSecrets stored and rotated inside your AWS account, under AWS’s compliance programs, IAM controls and CloudTrail audit trail. | Saves engineering timeOne place to store, sync and rotate app secrets across environments, billed per engineer with machine identities free. | Saves engineering timeAn open-source secrets platform with syncs, rotation and dynamic secrets that you can use in its cloud or run yourself. |
| Overall score | 7.0 | 7.3Best | 6.8 |
| Free option | Free trial | Free plan | Free plan |
| Card to start | –Not measured | No card needed | No card needed |
| Getting access | Self-serve | Self-serve | Self-serve |
| Starter priceCheapest paid plan | $0.40/secret/mo | $21/user/mo | $20/identity/mo |
| Pricing model | Usage-based | Per seat | Per seat |
| Pricing page | Public prices | Public prices | Public prices |
| Billing unit | Per secret per month and per 10,000 API calls | Per human user per month; no secret, API or usage fees | Per identity (human or machine) per month |
| Free option | No free tier of its own; up to $200 of AWS Free Tier credit for new accounts | Developer: 3 users free, $8 per additional user up to 25; 14-day Team trial, no card | Free: 5 identities, 10 syncs; 30-day trial of paid plans, no card |
| Reference scenario (monthly) | $85 (200 × $0.40 + 100 × $0.05), computed | $210 on Team (10 × $21), computed | $300 on Pro (15 × $20, annual), computed |
| Machine identities | IAM roles and users, not billed | Free; service accounts from Team | Billed like users; machines with identical permissions can share one |
| Audit log retention | CloudTrail event history, 90 days; trails to S3 for longer | 3 days on Developer, 90 days on Team, custom on Enterprise | None on Free, 30 days on Pro, 90 on Advanced, custom on Enterprise |
| Dynamic secrets | Not offered | Enterprise (AWS IAM, Azure Service Principal) | Advanced ($40 per identity) |
| Database rotation | Managed rotation for RDS, Aurora, DocumentDB and Redshift | Team for GCP Cloud SQL via API; proxied AWS databases on Enterprise | Pro for public databases; full rotation on Advanced |
| Kubernetes | Secrets Store CSI provider (ASCP), EKS add-on | Doppler Kubernetes Operator and External Secrets provider, all plans | Operator, Agent Injector and CSI provider; External Secrets provider |
| SAML SSO / SCIM | IAM Identity Center, no extra charge | SAML on Team; SCIM on Enterprise | SAML on Pro; SCIM on Enterprise |
| SOC 2 / ISO 27001 | SOC 1, 2, 3; ISO 27001, 27017, 27018 | SOC 2 Type II; ISO 27001 | SOC 2 Type II; no ISO 27001 stated |
| HIPAA BAA | HIPAA-eligible under a BAA with AWS | Not described | HIPAA compliance stated; BAA by agreement, plan not stated |
| EU data storage | Any EU region you choose | No EU region; GCP us-central1 | EU cloud region (eu.infisical.com) |
| Self-hosting | Not offered | Doppler On-prem, Enterprise only | MIT-licensed core free; enterprise features need a license |
| Secret export | One secret, or up to 20 per batch call | CLI and API download as JSON, .env or YAML | CLI export as dotenv, CSV, JSON or YAML |
| Bottom line | From its public pages, AWS Secrets Manager is a low-cost, widely certified secrets store for AWS workloads, at $85 a month for our scenario with native database rotation. It has no free tier of its own, no dynamic secrets and no push syncs beyond AWS. | From its public pages, Doppler is a simple seat-priced secrets platform: machine identities are free, and Team at $21 a user adds SSO, rotation and 90-day logs. Dynamic secrets, SCIM, SIEM forwarding and customer-managed keys need Enterprise, and the cloud runs in the US only. | From its public pages, Infisical pairs broad rotation, syncs and dynamic secrets on self-serve plans with an MIT core to self-host and an EU region. Every identity is billed, audit logs start on Pro with 30 days, and SCIM and SIEM streaming need Enterprise. |
Evidence: AWS Secrets Manager: facts checked 2026-10-16 from its public sign-up and pricing pages, no completed hands-on run; Doppler: facts checked 2026-10-16 from its public sign-up and pricing pages, no completed hands-on run; Infisical: facts checked 2026-10-16 from its public sign-up and pricing pages, no completed hands-on run. Prices in USD as listed, excluding tax. "–" means not recorded.
When to pick each
In the words of each review, with the date its facts were checked.
From our AWS Secrets Manager review
Checked Oct 16, 2026- Pick AWS Secrets Manager when
- You want AWS’s compliance programs and KMS keys at $85 a month for the scenario.
- Pick Doppler when
- You want push syncs to GitHub Actions, Vercel and other clouds, and environments for every project in one UI.
From our AWS Secrets Manager review
Checked Oct 16, 2026- Pick AWS Secrets Manager when
- You want one service per AWS account with IAM controls and no per-identity fee.
- Pick Infisical when
- You want dynamic secrets, syncs across clouds and an MIT core you can self-host.
From our Doppler review
Checked Oct 16, 2026- Pick Doppler when
- You run many machine identities and want them free, with 90 days of logs on the $21 plan.
- Pick Infisical when
- You want an MIT-licensed core you can self-host, an EU cloud region, or dynamic secrets on a self-serve plan.
From our Doppler review
Checked Oct 16, 2026- Pick Doppler when
- You want one place for secrets across clouds and hosting, synced to GitHub Actions, Vercel and others.
- Pick AWS Secrets Manager when
- Your workloads run on AWS and you want $85 a month for the scenario, a HIPAA BAA and customer-managed KMS keys.
From our Infisical review
Checked Oct 16, 2026- Pick Infisical when
- You want an EU region, an open-source self-host path, or dynamic secrets without an Enterprise contract.
- Pick Doppler when
- You run many machines and want them free, with 90-day logs on the $21 seat plan.
From our Infisical review
Checked Oct 16, 2026- Pick Infisical when
- Your apps span several clouds and hosting platforms and you want syncs and environments in one UI.
- Pick AWS Secrets Manager when
- Your workloads are on AWS and you want $85 a month for the scenario, with ISO 27001 and FedRAMP.
Entry price
Baseline: each product's cheapest paid plan, per month. Included usage differs, so read the line under each price.
- AWS Secrets ManagerPay as you go$0.40/secret/moPlus $0.05 per 10,000 API calls; prorated by the hour; replicas billed as secrets
- Managed rotation for RDS, Aurora, DocumentDB and Redshift
- New versions free; AWS managed KMS key free
- No charge for secrets scheduled for deletion
- Volume pricing through AWS sales
- DopplerTeam$21/user/moBilled per seat per month, prorated; 14-day trial, no card; machine identities free
- SAML SSO and role-based access per project and environment
- Automatic secret rotation and 100 config syncs
- 90 days of activity logs
- Add-ons at $9/seat/mo: custom roles, user groups, 500 syncs
- InfisicalLowest pricePro$20/identity/moBilled annually; $23 billed monthly; 30-day trial, no card
- SAML SSO and folder-level access control
- Point-in-time recovery and IP allowlisting
- Rotation for public databases; 25 syncs, 6 environments
- 30 days of audit logs
Prices as listed on each pricing page, in USD per month, excluding tax. Observed: AWS Secrets Manager 2026-10-16, Doppler 2026-10-16, Infisical 2026-10-16.
Which one fits
- If you need to start today without a sales call
- DopplerSelf-serve sign-up, no card needed; the highest score of the 3 self-serve products here (7.3/10).
- If you want to try it without entering a card
- DopplerFree plan, no card needed, and the highest score of the 2 that skip the card (7.3/10).
- Lowest starter price
- AWS Secrets Manager$0.40/secret/mo for the Pay as you go (plus $0.05 per 10,000 API calls) plan.
- Highest overall score
- Doppler7.3/10 (Good). The review shows the score breakdown and the run behind it.
Picked by fixed rules from the table above, not by hand. How we score
Full reviews
Add a product
Search by product name or by what it does, such as “email” or “feature flags”. 1 more fits in this comparison.