OpenBao is the best open source secrets management tool for most teams that want a full Vault-style server with no license fee, while Infisical is the best hosted open-core option for small teams and Bitwarden Secrets Manager is the best choice for teams already using Bitwarden. Prices run from $0 for the self-hosted projects to $20 per identity per month for Infisical Pro, $10 per user per month for Phase Pro, and $6 per user per month for Bitwarden Secrets Manager Teams. The billing unit matters more than the headline price: Infisical charges for every identity, human or machine, once you move to Pro, while Phase charges only for human users.
Pick by how you run software. A self-hosted server gives you full control and a $0 license, but you run the cluster, backups, and upgrades. A hosted open-core service costs money per user or per identity, but it removes the operations work. A file-based tool costs nothing and adds no server, but it gives you no central access control or audit log. Every price below comes from an official vendor page opened 2026-11-12.
On this page
Best open source secrets management tools: comparison table
Swipe the table sideways on a phone to see every column.
| # | Name | Best for | Starting price | Free plan / trial | Link |
|---|---|---|---|---|---|
| 1 | OpenBao | Vault-style server with no license fee | $0 | Yes | Visit |
| 2 | Infisical | Small teams that want hosted secrets | $20 per identity/month | Yes | Visit |
| 3 | HashiCorp Vault | Large teams that need dynamic secrets and PKI | $0.62 per cluster/hour | Yes | Visit |
| 4 | Bitwarden Secrets Manager | Bitwarden users who need machine secrets | $6 per user/month | Yes | Visit |
| 5 | Phase | Small teams that want end-to-end encryption | $10 per user/month | Yes | Visit |
| 6 | SOPS | GitOps teams that encrypt secrets in files | $0 | Yes | Visit |
| 7 | CyberArk Conjur | Regulated teams that need strict machine identity | quote only | Yes | Visit |
| 8 | Sealed Secrets | Kubernetes teams that store secrets in Git | $0 | Yes | Visit |
The 8 best best open source secrets management tools, in detail
OpenBao
Best for: Vault-style server with no license fee
OpenBao is the community fork of HashiCorp Vault, started after Vault moved to the Business Source License in August 2023. It keeps the MPL-2.0 license Vault used before the change, under Linux Foundation governance. A team can run a full Vault-style server, with dynamic secrets, PKI, and encryption as a service, without a vendor license or a per-client meter.
- One limit: OpenBao is self-hosted only, with no first-party hosted service or listed hosted price, so you run the servers, backups, and upgrades.
- The project also removed some Vault cloud secrets engines and cloud IAM auth methods from its core, so check the docs for your exact engine first.
- Choose OpenBao for Vault capability with open governance and no license fee.
- Skip it when you want a managed service.
Pros
- MPL-2.0 license with open governance
- namespaces and control groups included at no charge
- API compatible with HashiCorp Vault
Cons
- No first-party hosted service
- smaller ecosystem than Vault, so some cloud secrets engines are missing from the core
Infisical
Best for: Small teams that want hosted secrets
Infisical is an open-core platform with an MIT-licensed core, a free cloud plan, and hosted Pro and Advanced plans. The free plan covers 5 identities, 3 projects, and 10 integrations. Pro costs $20 per identity per month when billed annually and adds secret versioning, point-in-time recovery, role-based access controls, rotation, SAML SSO, IP allowlisting, and 30-day audit logs.
- The trade-off: an identity is any human or machine that authenticates, so 10 developers and 20 machine identities cost $600 per month on Pro.
- The free 5 identities are part of the Free plan only, so they do not reduce the Pro bill.
- Choose Infisical for a hosted console, a real free tier, and the option to self-host the MIT core.
- Skip it when your machine identity count is high.
Pros
- MIT-licensed core that self-hosts free
- free cloud plan covers 5 identities
- secret rotation and versioning on Pro
Cons
- Pro charges for every identity once you upgrade, and the 5 free identities do not carry over
- dynamic secrets need the Advanced plan at $40 per identity per month
HashiCorp Vault
Best for: Large teams that need dynamic secrets and PKI
HashiCorp Vault is the original product that OpenBao forked, and it still has the deepest feature set here. It issues short-lived dynamic credentials, runs a full PKI engine, offers encryption as a service, and supports namespaces, control groups, and audit logs. The managed route is HCP Vault Dedicated, a single-tenant managed cluster, and the Development edition starts at $0.62 per cluster per hour for an extra-small cluster, about $450 per month for a cluster that runs all month, with no production service level agreement.
- The Essentials small cluster starts at $1.58 per cluster per hour, and the Standard small cluster starts at $1.84 per cluster per hour, with $72.92 pe
- Choose Vault for dynamic secrets and PKI at scale; skip it when the OpenBao fork would do.
Pros
- Deepest feature set in this list, with dynamic secrets, PKI, and encryption as a service
- Community Edition is free to self-host
Cons
- Enterprise pricing is not listed, so it is quote only
- HCP Vault Dedicated adds $72.92 per client per month on Essentials and Standard tiers
Bitwarden Secrets Manager
Best for: Bitwarden users who need machine secrets
Bitwarden Secrets Manager is the machine-secrets product from the team behind the open-source Bitwarden password manager. It stores API keys, tokens, and other infrastructure secrets in projects and injects them through a CLI and SDKs, with machine accounts for pipelines and agents. The free plan covers 2 users, 3 projects, and 3 machine accounts with unlimited secrets.
- Teams costs $6 per user per month when billed annually and adds unlimited secrets and projects, up to 20 machine accounts, event logs, and user groups
- Enterprise costs $12 per user per month when billed annually and adds up to 50 machine accounts, granular access control, SCIM provisioning, passwordl
- Choose Bitwarden Secrets Manager when your team already uses Bitwarden, or when you want a low per-user price with machine accounts priced separately.
- Skip it when you need dynamic secrets.
Pros
- Free plan covers 2 users, 3 projects, and 3 machine accounts
- Teams includes 20 machine accounts and event logs
- end-to-end encryption
Cons
- Enterprise plan at $12 per user per month is needed for SCIM and self-hosting
- extra machine accounts cost $1 each per month beyond the included count
Phase
Best for: Small teams that want end-to-end encryption
Phase is an open-core secrets manager with end-to-end encryption, a free cloud plan, and a free self-hosted edition. The free cloud plan covers 5 users or service accounts, 3 applications, 3 environments, and 120 API requests per minute, with 24-hour audit logs. Pro costs $10 per user per month, or $120 per user when billed annually, and adds unlimited apps, rotation, custom roles, network access policies, 90-day audit logs, and 240 requests per minute.
- Phase charges only for human users.
- Service accounts used for machine access are free and unlimited on every plan, so a team with many pipelines and agents does not see its bill grow wit
- Choose Phase for end-to-end encryption, a free self-hosted option, and a bill that tracks humans.
- Skip it when you need dynamic secrets without moving to Enterprise.
Pros
- Only human users are charged, and service accounts are free
- free plan covers 5 users or service accounts, 3 apps, and 3 environments
- self-hosted edition is free and open source
Cons
- Free plan keeps audit logs for 24 hours only
- dynamic secrets need the Enterprise plan at $25 per user per month
SOPS
Best for: GitOps teams that encrypt secrets in files
SOPS, short for Secrets OPerationS, is a command-line editor for encrypted files, started at Mozilla and now a Cloud Native Computing Foundation sandbox project under the Mozilla Public License 2.0. It encrypts the values inside YAML, JSON, ENV, INI, and binary files while leaving the keys readable, so a Git diff still shows which setting changed without showing the secret. It delegates key protection to age, PGP, AWS KMS, GCP KMS, Azure Key Vault, or HuaweiCloud KMS.
- One limit: SOPS is a tool, not a vault.
- It has no central server, no web console, no per-user access control, no audit log, and no dynamic secrets.
- It works best inside a GitOps flow, where Flux or Argo CD decrypts at deploy time.
- Choose SOPS when your secrets already live in Git and you want the lightest possible fix.
Pros
- Free and open source under the Mozilla Public License 2.0
- encrypts values while keys stay readable in Git diffs
- works with age, PGP, and cloud key services
Cons
- No server, no access control, and no audit log
- key management and rotation are your job
CyberArk Conjur
Best for: Regulated teams that need strict machine identity
CyberArk Conjur is a secrets manager built for machine identity in DevOps and container platforms. It stores secrets behind a policy engine, issues credentials to applications, pods, and CI runners based on their identity rather than a shared password, and records access in audit logs. Conjur Open Source is free to self-host, with a REST API, a CLI, and plugins for Kubernetes and the major clouds.
- The trade-off: commercial pricing is not listed anywhere, so the starting price is quote only, and professional services are often part of the total c
- In May 2026, after Palo Alto Networks completed its purchase of CyberArk, the portfolio moved under the Idira brand, and the open-source edition has s
- Choose Conjur when you already run CyberArk for privileged access.
- Skip it when you want transparent pricing or a fast-moving open-source community.
Pros
- Conjur Open Source is free to self-host under Apache-2.0
- policy-based access built for containers and CI pipelines
- strong audit and role controls
Cons
- Enterprise pricing is not listed, so budgeting needs a sales quote
- the open-source edition has seen few meaningful updates since the Idira rebrand
Sealed Secrets
Best for: Kubernetes teams that store secrets in Git
Sealed Secrets, from Bitnami, solves one narrow problem well: getting a Kubernetes Secret into Git without putting the plaintext in the repo. The kubeseal CLI encrypts a normal Secret manifest with the sealing key of the controller running in your cluster, producing a SealedSecret object. That object is safe to commit to Git, because only the controller holding the matching private key can decrypt it.
- The controller then turns each SealedSecret back into a native Kubernetes Secret.
- One limit: the encryption is one-way, so even the person who sealed the secret cannot read it back without the controller, and a SealedSecret is bound
- There is no rotation or per-user access control, and the private key never leaves the cluster, so losing it means re-sealing every secret.
- Choose Sealed Secrets when you run Kubernetes with GitOps.
Pros
- Free and open source from Bitnami
- sealed secrets are safe to commit to Git, even an open repo
- one-way encryption means only the cluster controller can decrypt
Cons
- Kubernetes only, with no support for other platforms
- no rotation, no access control, and no audit log of its own
How we chose
We qualified tools that store, encrypt, and deliver machine secrets, with an open-source core or a free open-source edition and a listed price or a clear quote-only status. Prices and plan limits come from official vendor pricing pages and docs opened on 2026-11-12. We did not test any tool hands-on, and we did not use customer counts, awards, or review scores to rank the list. Where a vendor hid the price, we wrote quote only. The unique angle is the billing-unit split: Infisical charges per identity, human or machine, while Phase charges only for human users, so the same team can cost $100 or $600 per month.
Which tool fits your team size and budget
| Situation | Pick | Monthly cost at the stated size |
|---|---|---|
| Small team, 10 humans on a hosted plan | Phase Pro | $100 per month |
| Small team, 10 humans and 20 machines | Phase Pro | $100 per month, since service accounts are free |
| Small team, 10 humans and 20 machines | Infisical Pro | $600 per month, since all 30 identities are charged |
| Team already on Bitwarden, 10 users | Bitwarden Secrets Manager Teams | $60 per month, billed annually |
| Large team that needs dynamic secrets | HashiCorp Vault, or OpenBao self-hosted | $0 for the software on OpenBao, or $0.62 per cluster per hour for a Vault Development cluster |
Frequently asked questions
What is the best open source secrets management tool for most teams?
OpenBao is the best pick for most teams that want a full server with no license fee, with Vault-style dynamic secrets, PKI, and namespaces under the MPL-2.0 license. Infisical is the better pick for a hosted service with no server to run, and Bitwarden Secrets Manager is the better pick when your team already uses Bitwarden.
How much do open source secrets management tools cost?
The self-hosted projects cost $0 for the software: OpenBao, SOPS, and Sealed Secrets charge nothing, and Conjur Open Source is free to run. Hosted plans start at $6 per user per month for Bitwarden Teams, $10 per user per month for Phase Pro, and $20 per identity per month for Infisical Pro, all billed annually.
Is HashiCorp Vault still open source?
No. HashiCorp moved Vault from the MPL 2.0 license to the Business Source License in August 2023, so it is no longer open source in the OSI sense, though Community Edition remains free to self-host. OpenBao is the community fork that kept the MPL-2.0 license and open governance under the Linux Foundation.
Which tool is cheapest for a team with many machine identities?
Phase is the cheapest hosted option for machine-heavy teams, because it charges only for human users at $10 per user per month, while service accounts are free. Infisical Pro charges $20 for every identity, so 20 machine identities add $400 per month. SOPS and Sealed Secrets cost $0, but they give no central access control.
Do I need a server to use an open source secrets manager?
It depends on the tool. OpenBao, Conjur Open Source, and Vault Community Edition need a server you run, with backups and upgrades. Infisical, Phase, and Bitwarden Secrets Manager offer hosted plans with no server to run. SOPS and Sealed Secrets need no server at all, since they encrypt files and manifests instead of running a vault.
Can I store Kubernetes secrets in Git safely?
Yes, with the right tool. SOPS encrypts secret values inside YAML, JSON, and ENV files while keeping the keys readable in Git diffs, and Sealed Secrets encrypts a Kubernetes Secret into a SealedSecret that only the controller in your cluster can decrypt. Neither tool gives you access control or an audit log on its own, so use them inside a GitOps flow.
Sources
- https://openbao.org
- https://infisical.com
- https://infisical.com/pricing
- https://www.hashicorp.com
- https://bitwarden.com/products/secrets-manager/
- https://phase.dev
- https://phase.dev/pricing/
- https://github.com/getsops/sops
- https://github.com/bitnami-labs/sealed-secrets
- https://www.conjur.org
Prices and features were read on each company’s own website in November 2026. They change often, so confirm the current offer on the official site before you sign up or buy.