The best secrets management tool for a startup is usually the one built into the cloud you already run: AWS Secrets Manager, Azure Key Vault or Google Secret Manager. Pick Vault for dynamic secrets and self-hosting control, or Doppler, Infisical or 1Password when developer workflow and multiple clouds matter. Prices are as of 19 October 2026.
Safeguard publishes this guide and sells a competing product, so we describe other tools only from their own documentation.
Key takeaways
- Start with your cloud's native store if you run mostly on one cloud.
- Choose a developer-focused tool when you span clouds, run local development, or need syncs into CI and hosting platforms.
- Compare pricing units: per secret, per user or identity, or per request.
- Whichever you choose, centralize, rotate, limit access and keep an audit log, as OWASP recommends.
What does a secrets manager do?
A secrets manager stores API keys, passwords, tokens and certificates in one controlled place, so they stay out of code and config files. The OWASP Secrets Management Cheat Sheet says to centralize storage, provisioning, auditing, rotation and management of secrets.
Which secrets management tools should I compare?
The table uses each vendor's own pages as of 19 October 2026.
| Tool | Hosting | What the vendor says | Pricing as stated |
|---|---|---|---|
| AWS Secrets Manager | AWS managed | Pay for secrets stored and API calls; no upfront costs | $0.40 per secret per month; $0.05 per 10,000 API calls; up to $200 in Free Tier credits for new customers |
| Azure Key Vault | Azure managed | Stores secrets, keys and certificates; Entra ID authentication; Azure RBAC; Standard and Premium tiers with HSM-protected keys | Pricing on a separate page not read |
| Google Secret Manager | Google Cloud managed | Billed on active secret versions and access operations, with a free tier | Rates not confirmed from the page we read |
| HashiCorp Vault | Self-managed Community or Enterprise; managed HCP Vault Dedicated | Centralized secrets and privileged access; policies, audit logging; database secret plugins for dynamic credentials | Community is free; Enterprise needs a license |
| Doppler | SaaS | Developer plans with environments, config syncs, service tokens | Developer free for 3 users, then $8 per additional user per month; Team $21 per user per month |
| Infisical | SaaS or self-hosted | Secrets, certificates, privileged access | Free: 5 identities; Pro $20 per identity per month annual; Advanced $40 adds dynamic secrets; core MIT licensed |
| 1Password Secrets Automation | SaaS, optional self-hosted Connect server | Service accounts or Connect servers, SDKs and CLI, Kubernetes and CI/CD support | Included with a 1Password subscription; price not read |
Should I use my cloud provider's secret manager?
Yes, if most of your workloads run in one cloud. Native stores plug into IAM roles, so apps fetch secrets with temporary credentials instead of a stored key. AWS recommends roles with temporary credentials for workloads, and Azure Key Vault authenticates through Entra ID.
The cost is lock-in and a weaker local development story. Multi-cloud teams often feel that first.
When does HashiCorp Vault make sense?
When you need dynamic secrets, self-hosting control or one tool across clouds and on-premises systems. The Vault page describes database secret plugins that manage dynamic credentials, and OWASP recommends dynamic, short-lived secrets where possible.
The cost is operations: you run and secure the cluster unless you choose the managed HCP offering.
When do Doppler, Infisical or 1Password fit?
Choose them when developer workflow is the pain: sharing secrets across teammates, syncing to hosting and CI, and one place for local, staging and production.
Doppler and Infisical publish plan limits per user or identity, which helps you forecast cost. Infisical says its core is MIT licensed and free to self-host. 1Password says Secrets Automation is included with a subscription, and service accounts are suited to shared environments because authentication is not tied to a person, with rate limits. Connect servers cache data in your infrastructure.
How do I choose?
- Where do your workloads run? One cloud points to its native store.
- How many people and machines need secrets? Match to per-secret, per-user or per-request pricing.
- Do you need dynamic secrets or automatic rotation? Check the tier, since some features sit in higher plans.
- Do you need self-hosting or an air-gapped option?
- Can the tool log who read what, and can you export that log?
- How will apps authenticate to the store, without a long-lived key?
- How will you get existing secrets out of code and chat first?
How do I find leaked secrets before I migrate?
Scan repositories and history first. A manager does not help if old keys still sit in a commit. Try the secrets scanning demo.
Click through it at your own pace, or open it full screen.
Related: service account security best practices.
Frequently asked questions
What is the cheapest way to manage secrets?
Depends on scale. Vault Community and Infisical's self-hosted core are free software but cost operations time. AWS lists $0.40 per secret per month.
Is an environment file a secrets manager?
No. It has no access control or audit trail. Use it only locally, never in a repository.
Do I need to rotate secrets?
OWASP recommends regular rotation, automated where possible, so stolen credentials work only for a short time.
Should I store service account keys in a secret manager?
Google's key guidance says not to store service account keys in Secret Manager or other cloud stores, and to avoid keys where alternatives exist.
Can I use more than one tool?
Yes. Many teams use a native store for production and a developer tool for local work, but keep one system of record.
Sources
- AWS Secrets Manager pricing
- Azure Key Vault overview
- Google Cloud Secret Manager pricing
- HashiCorp Vault, what is Vault
- Doppler pricing
- Infisical pricing
- 1Password Secrets Automation
- OWASP Secrets Management Cheat Sheet
- Google Cloud, best practices for managing service account keys
Last reviewed: 19 October 2026.
