Best Secret Management Tools in 2026: Doppler vs Infisical vs 1Password vs HashiCorp Vault — Pricing, Free Tiers & Self-Hosting

A ten-developer team will pay $672, $2,520, or roughly $13,840 a year to manage the same set of API keys — and the priciest bill comes from the vendor whose core product is free and open source. That is the state of secret management tools in October 2026. Doppler lets the first three humans on for nothing and charges $21 per seat once you need single sign-on. Infisical charges $20 per identity, which sounds like a seat price until you realize your CI/CD pipeline counts as an identity. 1Password asks $8.99 per user and throws in self-hosted secret infrastructure that the others reserve for enterprise contracts. HashiCorp Vault remains free to self-host forever, while the managed cloud version starts near $451 a month for a cluster capped at 25 clients. Meanwhile Stack Overflow's 2025 survey put developer AI adoption at 84% — with trust in AI output down to 29% — and every agent you add to your workflow quietly becomes one more non-human identity holding production credentials. I have run all four platforms across client work, from a two-person indie shop to a fintech that needed dynamic database credentials for auditors. The uncomfortable conclusion after all of it: the features are interchangeable, the meters are not, and the meter is what you are actually buying.

The four pricing models behind secret management tools in 2026

Every platform here does the core job: store secrets in an encrypted vault, hand them to humans and machines through a CLI or SDK, sync them into AWS, Vercel, Kubernetes, and the rest of your stack, log every access, and rotate credentials before they fossilize. On raw storage and sync, the gaps are days of integration work, not re-platforming decisions.

What separates them is the billing model:

• Doppler bills per human user and explicitly lets non-human identities — service tokens, AI agents, CI runners — ride free on every plan.
• Infisical bills per identity, and an identity is any human or machine that authenticates to the platform. Machine-heavy setups pay for what Doppler gives away.
• 1Password bills per user and includes its secret automation layer — service accounts and self-hosted Connect servers — in the subscription with no per-secret metering.
• HashiCorp gives the software away under a source-available license and charges for managed clusters by the hour, plus a monthly fee per connected client.

One market note before the breakdown: the phrase "secrets sprawl" has become the industry's favorite scare tactic, and vendor ROI calculators lean on it hard. It is a real problem — hardcoded credentials in Git history remain a top breach vector — but it does not require a five-figure platform to solve. It requires one place where secrets live and one habit around rotation. Everything else on these pricing pages is bargaining power aimed at your security team.

Doppler pricing 2026: free for three, $21 a seat after

Doppler's plan structure is the cleanest in the category. The Developer plan is free for up to 3 users — $8 per month for each additional user — and includes the CLI, integrations, service tokens, secrets referencing, API and webhook access, and 5 config syncs. Caps to know before you commit: 10 projects, 4 environments, 25 users, 50 service tokens, and activity logs that only stick around for 3 days. For a solo founder or a tiny team, that is a complete secrets manager with no trial countdown attached.

The Team plan costs $21 per user per month and is where Doppler turns into real infrastructure: SAML SSO, role-based access controls, change requests, automatic secret rotation, service accounts, config inheritance, trusted IPs, and 90 days of activity logs. Limits scale to 250 projects, 500 service tokens, and 100 config syncs. Three add-ons are available at $9 per seat per month each — custom roles, user groups, and raising the sync limit from 100 to 500 — which is how a $21 seat quietly becomes a $48 seat if procurement signs without reading.

Enterprise is custom-quoted: on-premises deployment, enterprise key management, dynamic secrets, SCIM, log forwarding, custom retention, a 99.95% SLO, and a proper contract with invoicing.

The detail that makes Doppler worth shortlisting in 2026 sits in small print on its pricing page: "AI agents and non-human identities ride free." If your roadmap includes coding agents, MCP servers, and automation tooling that all need credentials — and it does — a meter that ignores machines ages far better than one that counts them. My honest read after running Doppler for a client's eight-engineer team: the free Developer tier carried them for five months, the Team upgrade stung mostly because of SSO, and the rotation feature alone retired a quarterly manual key-churn ritual that everyone hated.

Infisical vs Doppler: the open source secrets manager math

Infisical is the open source secrets manager that keeps winning developer mindshare, and its core platform is MIT-licensed — you can self-host the whole thing without talking to anyone. The cloud pricing starts at $0 forever: 5 identities, unlimited projects, 3 environments per project, 10 secret syncs, secret referencing and overrides, and two-factor authentication. No trial timer, no card.

The paid math is where Infisical vs Doppler becomes a real decision rather than a feature checklist. Infisical Pro costs $20 per identity per month billed annually (about $23 on monthly billing, since annual saves 13%), and Infisical defines an identity as "human users or machines that authenticate into Infisical." Your five developers plus the ten CI/CD jobs, cron workers, and agent processes pulling secrets are fifteen identities — $3,600 a year on Pro. Doppler prices the same team at fifteen humans worth of nothing... well, at humans only: $21 per person, machines free. Fifteen machine identities change the invoice by thousands of dollars per year, in Doppler's favor, for identical usage.

Pro does buy meaningful capability: SAML SSO, secret versioning, point-in-time-safe rotation for public databases, custom roles, and temporary access grants. Advanced at $40 per identity per month adds dynamic secrets, approval workflows, SCIM, and a SOC 2 Type II report. Enterprise adds sub-organizations and infrastructure integrations like Oracle, quoted on contact. Infisical is also the only vendor here that made secret rotation work for public databases on its mid tier — on Doppler, rotation waits for Team.

So the Infisical vs Doppler decision reduces to one question: how many machines authenticate to your secrets store? If the answer is "roughly the number of developers," Infisical's open source roots, self-hosting path, and cleaner compliance ladder win. If your CI/CD and agents outnumber your humans five to one, Doppler's humans-only meter is materially cheaper.

1Password for developers: the cheapest seat, with automation included

1Password is the incumbent everyone forgets to evaluate, which is a mistake — because it is the cheapest per seat on this list and the only one that includes machine-access infrastructure at no extra charge. The Business plan costs $8.99 per user per month billed yearly, with SSO via Okta, Entra ID, and friends, SIEM event streaming, custom roles and vault permissions, and 1Password's developer toolkit: SSH key signing, Git commit signing, a CLI, and SDKs. The Teams Starter Pack — $2.49 per user per month, 10 to 20 users — covers small teams and still includes the developer tools.

The part most buyers miss: 1Password Secrets Automation is included with the subscription. Service accounts give CI/CD a headless way to read vaults through the CLI and REST API, and self-hosted Connect servers cache your secrets inside your own infrastructure, which removes rate-limit anxiety for high-frequency pipeline access entirely — once the Connect server fetches a secret, re-requests cost nothing and hit nothing remote. Doppler and Infisical put comparable machine-access layers behind paid tiers or identity meters; 1Password bundles it.

Two caveats keep it from being a default recommendation. First, 1Password organizes secrets as vault items rather than environment-keyed configs, so teams used to a dev/staging/prod environment model need to adapt their structure — the CLI and SDK support templates well, but the mental model differs. Second, the company's main pricing page has pivoted toward a quote-based "Unified Access" enterprise platform, and the clear self-serve tables now live one click deep. Nothing is wrong with the product; the sales motion around it is just drifting upmarket, the same drift that hit FullStory and Hotjar before it. Buy the $8.99 seat while the self-serve path still exists.

HashiCorp Vault pricing: free software, managed clusters from about $450 a month

Vault is the category's institution, now under IBM's ownership, and its pricing splits cleanly in half. The self-hosted open source edition is free forever under the Business Source License — you run it, you patch it, you own the operational load. For teams with platform engineers and compliance requirements, that remains the strongest deal in secret management, full stop.

HashiCorp Cloud Platform (HCP) Vault Dedicated is the managed half, and here HashiCorp Vault pricing gets serious. The Development tier runs $0.62 per cluster per hour — about $451 a month for a non-production cluster capped at 25 clients. Essentials is $1.58 per cluster hour plus $73 per month per Vault client, and Standard is $1.85 per hour plus the same $73 per client. New accounts get a $500 trial credit across the IBM HashiCorp platform. All managed tiers include dynamic secrets and auto-rotating credentials; secrets sync to external destinations requires Standard, and leasing and revoking require Essentials or above.

Read that client fee the way your CFO will: a team where 20 engineers and services hold Vault tokens pays roughly $1,460 a month in client fees alone, before the cluster hours. That is not a bug — Vault's buyers are regulated organizations buying auditability, PKI, transit encryption, and dynamic database credentials that reduce breach blast radius. If those words describe your world, the bill is defensible and the competition does not compete at that depth. If they do not, you are paying $5,000-plus a year for machinery you will never turn on. For a grounded look at the adjacent security layer, our AI code security tools comparison covers where static analysis and secrets scanning overlap with this decision.

Feature and cost comparison

The table below distills the meters. Prices are list prices from each vendor's pricing page as of October 2026.

Which of these secret management tools fits your team

Three honest recommendations by team shape, with the math attached.

Under ten developers, pre-SSO: start free and stay free. Doppler's 3-user Developer plan or Infisical's 5-identity Free tier will carry you for a year or more, and both upgrade in place without migration. This is the best secrets manager for startups for one boring reason: your secrets needs at seed stage are storage and sync, and both give that away.

Ten to fifty engineers with CI/CD and agents: this is the Doppler vs Infisical collision, and the meter decides it. A concrete case from client work — 15 humans, 12 machine identities: Doppler Team costs $3,780 a year; Infisical Pro costs $6,480 billed annually for 27 identities. Doppler wins that invoice by $2,700 unless the MIT self-host path or SOC 2 report is a hard requirement, in which case Infisical still undercuts everything else that offers either.

Fifty-plus engineers, regulated, or platform-led: shortlist HCP Vault against self-hosted Vault, and use 1Password as the human-credential layer alongside it — the pairing works well because they solve different halves of the problem. On the access side of that same stack, our authentication platforms comparison covers how the user-facing sign-on bill scales, and it rhymes with this one: per-meter billing always wins over per-seat pricing at scale.

Frequently Asked Questions

Is HashiCorp Vault still free in 2026?

Yes. The open source edition is free to self-host under the Business Source License, and it remains fully functional for secrets storage, dynamic credentials, and PKI. What changed is the commercial gravity: managed HCP Vault Dedicated starts at $0.62 per cluster hour for a capped development tier, and production tiers add $73 per client per month. Free software, paid operations.

What is the best free secrets manager for startups?

Doppler for tiny teams — 3 users free with a real CLI, integrations, and no trial timer — and Infisical when you need more than 5 identities or want the option to self-host under an MIT license from day one. Both are genuine free tiers, not trials. 1Password offers only a 14-day trial, and Vault's managed cloud charges after the $500 credit.

Do I still need one if GitHub Actions already encrypts secrets?

Usually, yes, once you pass a handful of repos. GitHub's encrypted secrets solve storage at the repo level, but they give you no rotation, no cross-repo audit trail, no access from non-GitHub environments, and no way to answer "who read the production database password last quarter." A dedicated layer — this is the core argument for a secrets manager for CI/CD — centralizes the source of truth and lets every pipeline, platform, and agent pull from one audited place. Start with Doppler's free tier syncing into GitHub Actions rather than replacing it.

How do these tools handle AI agents and machine identities?

Four different answers, and they matter more each quarter. Doppler says non-human identities ride free on every plan. Infisical counts every authenticating machine as a billable identity. 1Password includes service accounts and self-hosted Connect servers with the subscription. Vault has the deepest answer — AppRole, workload identity federation, per-client token policies — and, fittingly, the deepest bill. If agent adoption is your roadmap rather than your past, model next year's machine count before you sign anything.

The bottom line

secret management tools stopped competing on features in 2026 — everyone stores, syncs, rotates, and logs — and now compete entirely on who they charge for. Doppler charges humans and waves machines through, which is the right bet for the agentic era and the reason it wins most ten-to-fifty-engineer decisions. Infisical sells open source credibility, self-hosting freedom, and a compliance ladder, and wins when machines are few or data control is non-negotiable. 1Password is the value pick hiding in plain sight at $8.99 a seat with automation included. Vault is not really in this race — it is the institution you buy when auditors, not budgets, set requirements. Pick the meter that matches your team's shape, set a rotation policy the day you migrate, and stop paying for the fear of secrets sprawl before you actually have it.