Best Secrets Manager for Indie Developers (2026 Prices)

Short answer: If you share .env files over Slack or email today, move to Doppler (free for 3 users) or Infisical (free for 5 identities, MIT-licensed and self-hostable). If you would rather not add a vendor, encrypt the file with dotenvx or SOPS and commit it. If your app already runs inside AWS or Google Cloud, their native secret managers cost a few dollars a month at most at indie scale.

Prices come from vendor pages checked on 12 Nov 2026. "Our read" marks opinion.

TL;DR#

• Doppler: free for 3 users, then $8/mo per extra user (pricing).
• Infisical: free for 5 identities; Pro $23 per identity monthly; MIT core (pricing).
• Bitwarden Secrets Manager: free for 2 users; Teams $6 per user per month, annual (Bitwarden).
• 1Password: service accounts included with a subscription (1Password).
• AWS / Google Cloud: $0.40 per secret per month vs $0.06 per active version per month.
• No vendor: dotenvx and SOPS, both free and open source.

Disclosure: ZeroRaised publishes this guide and is a launch site for bootstrapped products. We have no commercial relationship with any vendor named here and earn nothing if you sign up. Facts come from the linked sources as checked on 12 Nov 2026.

Why bother: the .env problem in numbers#

A .env file is fine until it gets copied into a Slack DM, an old laptop, and one day a commit. GitGuardian's 2026 State of Secrets Sprawl report counted 28,649,024 "new secrets detected in public GitHub commits in 2025", and says that of the valid secrets it tracked from 2022, 64% "are still active and exploitable" four years later (GitGuardian 2026).

GitHub catches some of this for you. On public repositories, "secret scanning runs automatically for free" (GitHub secret scanning), and push protection for users "is enabled by default" and "stops you from pushing secrets to public repositories on GitHub". Push protection for repositories, though, "is disabled by default" (GitHub push protection). Turn it on. Scanning catches mistakes; a secrets manager prevents them.

If a key has already leaked, stop reading and follow our guide on how to rotate API keys without downtime first.

Comparison table#

Each figure is cited in the sections below.

The tools, one by one#

Doppler: the easiest hosted option#

Doppler's Developer plan is "Free for 3 users" and then "$8/mo per additional user", with 10 projects, 4 environments, 5 config syncs and 3 days of activity logs; its comparison table lists 25 users as the Developer limit. Team is "Free for 14 days", then "$21/mo per user", with 250 projects, 100 config syncs and 90 days of activity logs (Doppler pricing).

The CLI is the selling point: doppler setup ties a folder to a config, and doppler run -- injects secrets into your start command (Doppler CLI docs).

Our read: the 3-day activity log on the free plan is short. If you need to know who changed a key last month, that is a Team-plan feature.

Infisical: open source, priced per identity#

Infisical bills secrets management "per identity", meaning "human users plus machine identities". The free tier covers 5 identities, unlimited projects, 3 environments and 10 secret syncs. Pro is $20 per identity per month on annual billing or $23 monthly, with 6 environments per project and 30-day audit retention; Advanced is $40 or $46 and adds dynamic secrets (Infisical pricing).

Infisical's repository says the code is "available under the MIT expat license", with the exception of the ee directories, "which contain premium enterprise features requiring an Infisical license" (Infisical on GitHub). The pricing page adds: "The core platform is MIT licensed and free to self-host." We covered the company's recent raise and its agent product in Infisical's $40M round.

Our read: watch the unit. A CI runner and a production server each count as an identity, so a solo developer with two machine identities uses 3 of the 5 free slots. On Pro, every human and machine is billed.

Bitwarden Secrets Manager: cheapest per seat#

Bitwarden's free plan covers "Up to 2 users", "Up to 3 projects" and "Up to 3 machine accounts", with unlimited secret storage. Teams is $6 per user per month and Enterprise $12, both "Based on annual plan". Teams includes up to 20 machine accounts and Enterprise up to 50, each with "$1 per additional machine account" (Bitwarden Secrets Manager). Self-hosting is listed on Enterprise only.

Our read: if you already use Bitwarden for passwords, this is the cheapest team option here.

1Password service accounts: if you already pay for 1Password#

1Password's developer docs describe service accounts as a way "to automate secrets management in your applications and infrastructure without the need to deploy additional services", and list them as "Included with 1Password subscription" (1Password Secrets Automation). Rate limits depend on plan: on Teams, a token gets 1,000 reads per hour and the account 5,000 requests per 24 hours; Business gets 10,000 and 50,000 (1Password rate limits).

Pricing: Teams Starter Pack "costs $24.95 per month when billed annually" and "includes 10 members"; Business is "$8.99 per user per month when billed annually" (1Password business pricing).

Our read: good if your team already uses 1Password, not worth buying just for secrets. On Teams, fetch secrets at deploy or boot, not per request, to stay inside the rate limits.

AWS Secrets Manager and Google Cloud Secret Manager#

AWS charges $0.40 per secret per month and $0.05 per 10,000 API calls, and notes "You are not charged for creating new versions" when you rotate. New AWS customers get up to $200 in Free Tier credits that can go toward Secrets Manager (AWS pricing).

Google Cloud charges $0.06 per active secret version per month, with 6 active versions free; access operations are free up to 10,000 and then $0.03 per 10,000; rotation notifications are free up to 3, then $0.05 each (Google Cloud pricing). Note that the unit is the secret version: old versions you never destroy keep costing money.

Our read: only pick these if your code already runs there, where IAM roles mean no token to manage. They do little for your laptop or Vercel project without extra glue.

HashiCorp Vault: powerful, probably too much#

You can run Vault Community Edition yourself, but Vault 1.15.0 and later is licensed under the "Business Source License 1.1" (Vault LICENSE). HCP Vault Dedicated is "a hosted version of Vault Enterprise operated by Hashicorp on your behalf" (HashiCorp docs); we could not verify its current list price, so check HashiCorp's pricing page yourself.

Our read: skip it unless you need dynamic database credentials and already run infrastructure. Infisical's Advanced tier and SOPS cover most indie needs with far less to operate.

SOPS and dotenvx: encrypted files, no vendor#

SOPS is "an editor of encrypted files that supports YAML, JSON, ENV, INI and BINARY formats", with keys from age, PGP, AWS KMS, GCP KMS, Azure Key Vault and more. It is MPL-2.0 licensed and was "donated to the CNCF as a Sandbox project in 2023" (SOPS on GitHub, getsops.io).

dotenvx comes "from the creator of dotenv". It encrypts each value in your .env, so "only your private key can unlock them", and you "Set DOTENV_PRIVATE_KEY where your app runs" (dotenvx). The CLI is BSD-3-Clause and free (dotenvx on GitHub); dotenvx.com also lists paid plans from $5/mo, which we did not test.

Our read: dotenvx is the smallest upgrade for a solo developer: same workflow, no plaintext file. You still guard one private key, with no audit log.

Platform env vars: fine for one app#

Vercel and GitHub Actions both store secrets well. On Vercel, "Secret values are write-only after saving", and all variables share a limit of 64 KB per deployment (Vercel docs). GitHub Actions allows "up to 1,000 organization secrets, 100 repository secrets, and 100 environment secrets", each limited to 48 KB (GitHub Actions secrets).

Our read: one app on one host, working alone? Platform variables may be enough. The pain starts when the same Stripe key lives in Vercel, GitHub, a VPS worker and your laptop, and a rotation means four edits. That is the moment for a manager.

Worked example: what it costs (ours)#

Illustrative, using the list prices above. Assume one SaaS, 30 secrets, 3 environments, one CI runner and one production server.

Our read: at indie scale, cost barely separates the hosted tools, so pick on workflow. Note the Infisical cliff past 5 identities.

Which to pick#

• Solo, want it done in 30 minutes: Doppler Developer.
• Solo, want no vendor: dotenvx (or SOPS if you already use age or a cloud KMS).
• Small team, care about open source or future self-hosting: Infisical.
• Small team, tightest budget per seat: Bitwarden Secrets Manager.
• Team already on 1Password: 1Password service accounts.
• Everything runs on AWS or Google Cloud: the native manager, read through IAM.
• You need dynamic database credentials and run your own infra: Vault or Infisical Advanced.

30-minute migration from .env to a manager#

The steps are the same for any hosted tool. Commands below are from Doppler's and Infisical's own docs.

1. Inventory every place a secret lives, including chat. Our vibe coded app security checklist has a fuller pre-launch list.
2. Create one project with dev, staging and prod environments.
3. Import your existing file. Doppler: doppler secrets upload sample.env (Doppler docs). Infisical: infisical secrets-manager secrets create --file=./.env (Infisical CLI reference).
4. Run locally through the CLI. Doppler: doppler setup once, then doppler run -- npm run dev. Infisical: infisical init, then infisical secrets-manager run -- npm run dev.
5. Connect production and CI. Use the tool's sync to your host, or a machine token or identity stored as the one secret in your CI.
6. Delete the plaintext from laptops, drives and old Slack messages; keep .env in .gitignore.
7. Rotate anything ever shared in chat. Our rotation guide covers doing this without downtime.

For the no-vendor route, dotenvx's quickstart is shorter: dotenvx encrypt, commit the encrypted .env, keep .env.keys out of git, and run dotenvx run -- node index.js (dotenvx quickstart).

Frequently asked questions#

What is the best free secrets manager for a solo developer?#

For a hosted tool, Doppler's Developer plan (free for 3 users) and Infisical's free tier (5 identities) both cover a solo developer with CI and a production server. If you want no new vendor at all, dotenvx encrypts your .env file so it can live in git, with the private key stored in your host's settings.

Is Infisical really open source?#

Infisical's repository says it is available under the MIT Expat licence, with the exception of the ee directories, which contain enterprise features that need an Infisical licence. Its pricing page says the core platform is MIT licensed and free to self-host.

Do I need a secrets manager if I use Vercel or GitHub Actions secrets?#

Not on day one. Platform environment variables are fine for one app on one host. A secrets manager starts to pay off when the same keys live in several places (laptop, CI, hosting, a worker) or when a second person joins, because you change a value once and every target syncs.

Is AWS Secrets Manager cheap for small projects?#

It is cheap but not free. AWS charges $0.40 per secret per month plus $0.05 per 10,000 API calls, so 30 secrets cost about $12 a month before API calls. Google Cloud Secret Manager is cheaper per secret at $0.06 per active version per month after a small free allowance.

Can I still use HashiCorp Vault as an indie developer?#

You can run Vault Community Edition yourself, but Vault 1.15.0 and later is under the Business Source License 1.1, and you take on running, unsealing and upgrading a security-critical server. For most indie developers a hosted manager or encrypted .env is less work.

Ship it safely, then launch it#

Locking down secrets is one line on our product launch checklist for bootstrapped makers. When the rest is ticked, submit your product to ZeroRaised for free. For more tool comparisons with verified prices, join the ZeroRaised newsletter.

Sources#

All last checked 12 Nov 2026.

• Doppler pricing
• Doppler CLI docs and setting secrets
• Infisical pricing
• Infisical GitHub repository and licence
• Infisical CLI reference
• Bitwarden Secrets Manager and Bitwarden business pricing
• 1Password business pricing
• 1Password Secrets Automation and service account rate limits
• AWS Secrets Manager pricing
• Google Cloud Secret Manager pricing
• HashiCorp Vault LICENSE and HCP Vault Dedicated docs
• SOPS on GitHub and getsops.io
• dotenvx, dotenvx pricing, dotenvx quickstart, dotenvx on GitHub
• Vercel environment variables
• GitHub Actions secrets reference
• GitHub secret scanning and push protection
• GitGuardian State of Secrets Sprawl 2026