# Secrets Management Tools Compared: Five Scored Side by Side

Source: https://startwithidentity.com/rankings/best-secrets-management-tools/
Last updated: 2026-10-16
License: content by Start with Identity. Cite the source URL.

---

This is a side-by-side scorecard rather than a shopping list. Five [secrets management](https://startwithidentity.com/guides/fundamentals/what-is-secrets-management/) platforms scored against one rubric.

## Where this category splits

The real question is how much operational burden you are willing to own.

**Broad platforms you operate** (HashiCorp Vault, CyberArk Conjur) offer the widest capability, dynamic secrets, PKI and encryption as a service, and expect skilled platform engineers to run them. Vault documents 26 secrets engines, 21 auth methods and 23 storage backends; that breadth is exactly what you pay for in complexity.

**Cloud-native single-cloud** (AWS Secrets Manager) is the lowest-effort option if you are genuinely single-cloud, and a poor fit the moment you are not.

**Managed developer-first** (Doppler, Infisical) trade breadth for a much lower operational floor. Check the billing unit carefully: Infisical bills per identity, and an identity is any principal that authenticates, human or machine, so cost tracks workload count rather than headcount.

## What has changed in the market

Licensing moved more than capability. Vault has been source-available under BUSL 1.1 since 2023, not open source, which triggered the OpenBao fork now governed under the Linux Foundation and shipping post-quantum support ahead of upstream. Vault itself now sits inside IBM. Conjur is sold as Idira Secrets Manager following Palo Alto Networks' acquisition and rebrand of CyberArk. If licensing posture is part of your decision, it has changed for three of these five.

## How to read these scores

Every vendor here is scored on the same [10-dimension rubric](https://startwithidentity.com/methodology/). Scores are comparative within the category, not absolute: a 4.5 means strong relative to peers solving the same problem.

Three things the scores deliberately do not capture. They do not price your deployment, because most vendors in this category quote rather than publish. They do not measure fit with your existing stack, which is usually what actually decides it. And they do not predict vendor stability, which in identity has mattered more than features lately given the pace of consolidation.

Use this to narrow a field to two or three candidates on capability, then pilot against your worst case rather than the vendor's reference architecture.

## Where to go next

For the full field, see [top 8 secrets management tools](https://startwithidentity.com/articles/top-8-secrets-management-tools/). For self-hosted and open-source options, see [top 6 open-source secrets management tools](https://startwithidentity.com/articles/top-6-open-source-secrets-management/). To browse every profile, see the [secrets management vendor directory](https://startwithidentity.com/vendors/secrets/).