TL;DR
Exposed secrets are the most common root cause of serious cloud breaches. API keys in GitHub repositories, database passwords in CI/CD pipelines, tokens in Docker images — these are the real-world vectors that kill companies. Secrets management tools exist to solve all three: centralised encrypted storage, fine-grained access policy, and automatic rotation. This list covers the ten tools that matter in 2026.
Why secrets in env files is a 2012 solution
The .env file pattern was designed to prevent secrets from appearing in source code — an improvement over hardcoding. It was never designed for security. The credential still exists in plaintext on the deployment machine, visible in process listings, and copy-pasted into every CI/CD pipeline. The 2024 Verizon DBIR found that credentials are the leading initial access vector in breaches. In the 2023 CircleCI incident, a GitHub and registry credential stored in a CI runner was exfiltrated via a compromised employee laptop — a canonical illustration of the static-credential problem.
The proper model:
- Applications authenticate with an ephemeral platform identity (IAM role, Kubernetes service account, Vault AppRole).
- The secrets manager verifies the identity, evaluates the access policy, and issues a scoped credential.
- The credential has a TTL. After expiry, the application re-authenticates.
- Every access is logged.
None of this is possible with an .env file.
1. HashiCorp Vault
Category. Open-source secrets management platform (with enterprise edition).
Architecture. Vault runs as a standalone service. Applications authenticate via one of many auth methods — AWS IAM, Kubernetes service accounts, LDAP, OIDC, AppRole, GitHub, certificates. After authentication, they receive a scoped Vault token which they use to read secrets via the API. Vault stores secrets encrypted at rest in a configurable backend: Consul, DynamoDB, Raft (built-in HA), or others.
Key capabilities.
- Dynamic secrets: database credential generation, AWS IAM role tokens, SSH certificate signing, PKI certificate issuance. Each is generated on demand and expires automatically.
- Fine-grained policy with HCL: path-based ACL policies control which identities can read, write, list, or delete at any path.
- Secret engines: KV (static secrets), database, PKI, SSH, transit (encryption as a service), AWS, GCP, Azure, and more.
- Leasing and renewal: all secrets have a TTL. Clients must renew before expiry or receive a new credential.
- Audit devices: write structured logs to file, syslog, or socket. Every request/response is logged.
Strengths. Most comprehensive feature set of any secrets manager. Dynamic secrets for databases is a game-changer for eliminating shared static database credentials. Strong community and ecosystem.
Limitations. Operationally complex. Running a HA Vault cluster with proper seal/unseal management, raft storage upgrades, and DR replication requires dedicated operational expertise. HashiCorp changed the licence to BUSL in August 2023 — the community fork OpenBao is worth tracking for those avoiding BUSL.
Best fit. Engineering-led organisations capable of operating the service themselves. The right choice when feature depth and control outweigh operational overhead. Essential for organisations that need dynamic database credentials.
2. AWS Secrets Manager
Category. Cloud-native managed secrets management for AWS workloads.
Architecture. Secrets Manager is a fully-managed AWS service. Secrets are stored encrypted with KMS. Applications running in AWS authenticate via their IAM role and access secrets via the SDK. Rotation is performed by a Lambda function — AWS provides built-in rotation templates for RDS, Redshift, DocumentDB, and custom Lambda for other services.
Key capabilities.
- Automatic rotation using Lambda. Rotation schedules are configurable down to hours.
- Fine-grained IAM policies control access per secret, per IAM principal.
- Cross-account access via resource-based policies.
- Secret versioning — previous versions retained across rotation for zero-downtime transitions.
- Native CloudTrail integration for every API call.
- Replication across multiple regions.
Strengths. Zero operational overhead for AWS users. No service to run or maintain. IAM-based access means no separate identity system — applications running in AWS already have an IAM role. Pricing is simple: $0.40 per secret per month, plus $0.05 per 10,000 API calls.
Limitations. AWS-centric. Multi-cloud or on-premises applications require the AWS SDK and an IAM principal, which is manageable but non-trivial outside AWS. Lambda-based rotation is more complex to customise than Vault’s database secrets engine.
Best fit. AWS-only or AWS-primary workloads. The pragmatic default choice for AWS shops that do not have the operational capacity for Vault.
3. GCP Secret Manager
Category. Cloud-native managed secrets for Google Cloud workloads.
Architecture. Similar to AWS Secrets Manager but native to Google Cloud. Secrets stored encrypted by Cloud KMS. Applications authenticate via Workload Identity (service accounts). Full Cloud Audit Logging integration.
Key capabilities.
- Automatic rotation via Pub/Sub notifications and Cloud Functions. More event-driven than AWS’s scheduled Lambda approach.
- Regional or global replication with customer-managed encryption keys.
- Secret labels and annotations for organising large secret inventories.
- Granular IAM: secretmanager.secretAccessor, secretmanager.secretVersionAdder, secretmanager.secretAdmin.
Strengths. Near-identical philosophy to AWS Secrets Manager with Google Cloud-native identity via Workload Identity Federation. Workload Identity Federation also allows federating non-GCP workloads (AWS, Azure, on-premises with OIDC issued identity) without static GCP service account keys.
Limitations. GCP-specific. Less feature depth than Vault for dynamic credentials and non-GCP backends.
Best fit. GCP-primary workloads.
4. Azure Key Vault
Category. Cloud-native secrets, keys, and certificate management for Azure.
Architecture. Azure Key Vault manages three types of objects: secrets (arbitrary key-value with versioning), keys (cryptographic material for encryption operations), and certificates (X.509 lifecycle management with automatic renewal via DigiCert or Let’s Encrypt). Authentication via Azure Managed Identities or service principals.
Key capabilities.
- Full PKI certificate lifecycle: issuance, renewal, revocation, monitoring expiry.
- Hardware Security Module (HSM) backed storage available — Premium tier uses dedicated FIPS 140-2 Level 2 HSMs.
- Managed Identity integration eliminates static credentials for Azure-hosted applications.
- Soft delete and purge protection prevents accidental or malicious deletion.
- Azure Monitor integration for access logs and alerting on unusual access patterns.
Strengths. If certificate management is a significant part of your secrets workload, Key Vault’s native certificate management with auto-renewal is better than anything in Vault or AWS Secrets Manager out of the box.
Limitations. Azure-specific. Secrets rotation for non-Azure resources requires custom Function implementations.
Best fit. Azure-centric workloads; teams with significant certificate management needs.
5. CyberArk Conjur / Secrets Hub
Category. Enterprise secrets management with PAM integration.
Architecture. Conjur is CyberArk’s developer-oriented secrets management platform. It integrates with CyberArk’s broader Privileged Access Management (PAM) suite. Secrets are stored in the CyberArk vault. Workloads authenticate via Conjur-issued machine identities. CyberArk Secrets Hub syncs secrets into AWS Secrets Manager and Azure Key Vault, allowing applications to use native cloud APIs while CyberArk manages the rotation lifecycle.
Key capabilities.
- Machine identity at scale: Kubernetes, OpenShift, CI/CD, cloud workload support.
- CyberArk Conjur’s policy-as-code approach stores access policies in YAML committed to version control.
- Secrets Hub model — CyberArk becomes the source of truth, syncing to cloud-native stores for application access. Applications do not need to learn CyberArk APIs.
- Full integration with CyberArk PVWA (web interface) and EPM (endpoint privilege management).
Strengths. CyberArk is the enterprise PAM leader. Organisations that already use CyberArk for Privileged Access Management can extend the same vault to hold application secrets. Secrets Hub is a genuinely clever architecture for bridging CyberArk and cloud-native tools.
Limitations. Enterprise pricing and complexity. CyberArk is not a developer SaaS product; it requires CyberArk’s implementation team or deeply experienced internal operators.
Best fit. Regulated enterprises (financial services, healthcare, government) with an existing CyberArk deployment.
6. Doppler
Category. Developer-friendly SaaS secrets management.
Architecture. Doppler is a cloud-hosted secrets manager with a strong workflow for managing secrets across environments — development, staging, production. Applications use the Doppler CLI or SDK to read secrets at startup; the Doppler agent can be used as a sidecar. Doppler also syncs bi-directionally with AWS Secrets Manager, GCP Secret Manager, Azure Key Vault, GitHub Actions, and other CI/CD tools.
Key capabilities.
- Project/environment/config hierarchy. Secrets can be shared across environments or overridden per environment.
- Sync integrations: push secrets into AWS SM, GCP SM, Azure KV, GitHub Secrets, Vercel, Netlify, Heroku — eliminating environment duplication.
- Automatic rotation for supported service providers.
- Activity log of every access, change, and rotation.
- Access management by team member and service token.
Strengths. Best developer experience of any tool in this list. CLI is clean; onboarding is hours not days. The sync model elegantly solves the multi-cloud problem without replacing existing native tools.
Limitations. Cloud-hosted SaaS — your secrets are stored with Doppler. For highly regulated workloads where secrets cannot leave a private cloud, Doppler is a compliance risk.
- Rotation support is limited to built-in integrations. Custom rotation workflows require webhooks.
- No dynamic secrets; secrets are static key-value pairs with versioning. No database credential generation.
Best fit. Developer teams wanting a fast start without Vault operational complexity. Excellent for startup to mid-market. Not appropriate for workloads with strict data residency or regulatory requirements that prohibit third-party-hosted credential storage.
7. Infisical
Category. Open-source, self-hostable secrets management (GitHub-native workflow).
Architecture. Infisical is an open-source alternative to Doppler. It can be self-hosted (Docker, Kubernetes) or used as a SaaS. The workflow model (projects, environments, folders) is similar to Doppler. It supports native integration with GitHub Actions, GitLab CI, CircleCI, and other CI/CD platforms.
Key capabilities.
- Self-hosted option addresses data residency concerns.
- Native GitHub secret scanning integration — Infisical can detect secrets committed to repositories.
- Dynamic secrets support (database credentials, AWS IAM, GCP).
- Secret versioning and point-in-time rollback.
- SCIM provisioning for team access management.
Strengths. Open-source with a path to self-hosting makes it appropriate for organisations that cannot use SaaS for secrets. Growing Vault-like feature set with a significantly better developer experience.
Limitations. As an open-source project, operational responsibility falls to the user for self-hosted deployments. Still maturing — some enterprise features (dynamic secrets, complex RBAC) available but less battle-tested than Vault at scale.
Best fit. Teams that want Doppler’s developer experience with the option to self-host. Good for Europe-based organisations with GDPR data residency concerns.
8. 1Password Secrets Automation
Category. Team password manager with developer secrets management features.
Architecture. 1Password Secrets Automation extends the consumer/business 1Password vault into a developer secrets management tool via Service Accounts, the 1Password CLI (op), the Connect Server (self-hosted), and direct integrations with Kubernetes (External Secrets Operator), Terraform, Ansible, CI/CD pipelines, and VS Code.
Key capabilities.
- Unified storage for both human-facing credentials (1Password vaults employees already use) and application secrets.
- 1Password Service Accounts allow programmatic access to specific vaults.
- 1Password CLI in CI/CD pipelines injects secrets as environment variables without them touching disk.
- External Secrets Operator integration synchronises 1Password with Kubernetes Secrets.
Strengths. If your team is already paying for 1Password Business, Secrets Automation is included. The developer CLI is excellent. For teams where the secret store needs to serve both employees AND automation, 1Password’s unified model eliminates a separate system.
Limitations. No dynamic secrets. No broad multi-auth-method machine identity — Service Account tokens are static credentials that must themselves be protected. Audit logs are not as detailed as Vault or cloud-native tools.
Best fit. Small to mid-market development teams already on 1Password Business.
9. Akeyless Vault
Category. Cloud-hosted SaaS vault with DKE (Distributed Key Encryption).
Architecture. Akeyless is a cloud-hosted secrets management platform with a differentiating architectural feature: Distributed Key Encryption (DKE). Your encryption key is split between Akeyless and a component you hold, meaning Akeyless cannot decrypt your secrets unilaterally. This addresses the “SaaS holds my keys” concern without fully self-hosting.
Key capabilities.
- Dynamic secrets for databases, cloud accounts, SSH, and PKI.
- Zero-knowledge architecture via DKE.
- Gateway component for on-premises integration — applications on private networks access secrets through a self-hosted gateway without internet-bound API calls.
- Native Kubernetes support, CI/CD integrations, Terraform provider.
Strengths. The DKE architecture closes the trust gap with pure SaaS tools — Akeyless cannot exfiltrate your plaintext secrets even if compromised. Fills the gap between “run Vault yourself” and “fully trust a SaaS vendor.”
Limitations. Less widely adopted than Vault or AWS SM. Smaller ecosystem and less community knowledge.
Best fit. Organisations unwilling to self-host Vault but hesitant to fully trust secrets to a third-party SaaS. DKE is a genuine architectural differentiation.
10. QuickZTNA Secrets Vault
Category. Built-in secrets vault in the ZTNA platform (Workforce tier).
Architecture. QuickZTNA’s Secrets Vault feature provides a KV secrets store inside the QuickZTNA platform. Applications and users accessing resources through the ZTNA tunnel can retrieve secrets gated behind the same identity layer that controls network access. Secrets access inherits the user’s ZTNA session identity — no separate authentication for the secrets store.
Key capabilities.
- Unified identity: the same identity assertion that grants access to the network resource controls access to secrets for that resource. If a developer’s device posture check fails, both the network access and the secrets access are denied simultaneously.
- Audit integration: secrets access events appear in the same immutable audit log as all ZTNA access events, simplifying compliance reporting.
- Per-resource scoping: secrets are associated with resources in the ZTNA resource catalogue. Access is implicitly scoped to users authorised for that resource.
- Works alongside external vaults: QuickZTNA does not replace Vault or AWS SM for dynamic database credentials. It complements them by gating access to the primary vault through the ZTNA identity layer.
Strengths. Eliminates a separate authentication flow for secrets in the context of ZTNA-mediated access. Posture-based access extends naturally to secrets — an unmanaged device that fails a posture check cannot retrieve credentials even if it has valid identity.
Limitations. Scoped to secrets relevant to ZTNA-protected resources. Not a general-purpose secrets management platform for all application workloads. Dynamic secrets and certificate issuance require a dedicated tool like Vault.
Best fit. Organisations using QuickZTNA for ZTNA who want secrets access integrated with ZTNA posture and identity, without a separate secrets access policy to manage.
Comparison table
| Tool | Hosted/Self-hosted | Dynamic secrets | Audit logs | BYOK/DKE | Developer UX | Compliance (FedRAMP, SOC2) |
|---|---|---|---|---|---|---|
| HashiCorp Vault | Self-hosted | ✅ Full | ✅ | BYOK supported | Medium | Vault Enterprise |
| AWS Secrets Manager | Hosted (AWS) | ✅ Lambda | ✅ CloudTrail | ✅ CMK | High | ✅ FedRAMP |
| GCP Secret Manager | Hosted (GCP) | Limited | ✅ | ✅ CMEK | High | ✅ |
| Azure Key Vault | Hosted (Azure) | PKI/certs | ✅ | ✅ BYOK | High | ✅ FedRAMP |
| CyberArk Conjur | Both | ✅ | ✅ | ✅ | Low | ✅ Enterprise |
| Doppler | Hosted SaaS | ❌ | ✅ | ❌ | Excellent | SOC 2 |
| Infisical | Both | ✅ Growing | ✅ | Self-hosted option | Excellent | Growing |
| 1Password SA | Hosted SaaS | ❌ | Partial | ❌ | Excellent | SOC 2 |
| Akeyless | Hosted + Gateway | ✅ | ✅ | ✅ DKE | Good | SOC 2 |
| QuickZTNA Vault | Hosted SaaS | No | ✅ | — | Good | SOC 2 (via ZTNA) |
How to choose
Start with your cloud. If you are AWS-primary, AWS SM is the pragmatic, zero-operational-overhead answer. Same for GCP and Azure. Cloud-native tools solve 80% of the problem with zero operational complexity.
Add Vault for dynamic credentials. If you have shared database credentials that are never rotated, Vault’s database secrets engine is the fastest path to eliminating them. The risk reduction per hour of implementation time is excellent.
Add a developer workflow layer. Doppler or Infisical on top of your cloud-native store handles the developer workflow problem: environment hierarchy, CI/CD injection, cross-cloud sync. Your cloud store holds the authoritative encrypted values; the workflow layer makes them usable without copy-pasting.
If you are running QuickZTNA Workforce. Use QuickZTNA Secrets Vault for resource-scoped secrets that need to inherit ZTNA posture checks. Keep Vault or AWS SM for the broader secrets estate.
Related reading
- Device Posture Checks That Actually Work
- ZTNA vs VPN: 8 Real Differences
- Zero Trust on a Budget: Free Tier Options
Try QuickZTNA Secrets Vault
QuickZTNA Workforce includes a built-in Secrets Vault that gates credential access behind ZTNA identity and device posture — no separate secrets management product to evaluate. Request a Workforce trial to see the integration in action.