Member-only story
Top 10 Secrets Management Tools
Hi everyone, welcome back. Today, I will be going over the top 10 secrets management tools — Vault and OpenBao, SOPS and age, Sealed Secrets, External Secrets Operator, the cloud providers’ own managers, Infisical, Doppler, and the scanners that find credentials you already leaked.
If you are newer to this, here is the vocabulary first. A secret is any value whose possession grants access: a database password, an API key, a TLS private key. What makes it a secret is that holding it is authorization. Rotation means replacing a secret and invalidating the old one, so a copy someone took last month stops working. A KMS is a Key Management Service — a managed vault for cryptographic keys, like AWS KMS, that encrypts and decrypts on your behalf without handing you the key material. Envelope encryption is the pattern it makes cheap: encrypt your payload locally with a random data key, have the KMS encrypt that small data key, and store the two together. A dynamic secret is a credential that does not exist until something asks for it, carries a short expiry, and is revoked when that expiry passes.
Nearly every comparison of these tools is a feature list, and feature lists are not how you choose. Three questions decide it. First, where does the secret live — in git as ciphertext, in a cluster, in a managed service, in a server you run? Second, how does it reach the process — environment variable, mounted file, a network call at startup, a sidecar? Third, who can read it — which humans, which machine identities, under what audit trail…
