Secrets management tools, compared
Each provider is profiled from its own documentation, with the source recorded against every figure. Whether a store can issue a credential that expires on its own, rather than one you rotate by hand, is the question that separates a vault from an encrypted key-value store.
Secrets management
| Provider | Entry paid plan | Secret versioning | Dynamic secrets |
|---|---|---|---|
| AWS Secrets Manager | $0.40 per secret per month, plus $0.05 per 10,000 API calls. | Supported — rotating a secret automatically creates a new version, at no additional per-secret charge. | Not documented |
| Doppler | Team plan: $21/month per user, with a 14-day free trial. | Every version of a secret is retained for the lifetime of that secret; adding, updating and deleting secrets can be rolled back from the activity log. | Not included on Developer or Team. Available on Enterprise. |
| Infisical | Pro tier: $20/identity/month billed annually, or $23/identity/month billed monthly. | Not included on the free tier. Included from Pro: secret versioning and point-in-time recovery. | Not included on Free or Pro. Included from Advanced: dynamic secrets. |
Which to consider
Teams already deep in AWS IAM, Lambda and RDS — the integration is native rather than bolted on, and the per-secret price is simple to reason about.
Teams whose secrets access is dominated by CI/CD and service identities rather than human users — those ride free, so cost tracks headcount, not automation volume.
Teams that want per-identity pricing that treats a machine credential the same as a human one, or that value the option to self-host the same open-source engine the cloud product runs.
Comments are hosted by EchoThread, which sets cookies and offers social sign-in. Like the analytics on this site, it does not load until you accept — see the privacy page.