Secrets are the boring thing that becomes the most expensive thing the moment they leak. They sit in .env files, get checked into private repos that quietly go public, get pasted into Slack DMs by a contractor who is no longer with the company, and end up in CI logs nobody reads until a Stripe key shows up in a Shodan scan. Every team I have worked with has had at least one secrets incident, usually two, and the response is almost always the same: we will adopt a real tool, we will rotate everything, we will audit access. Then nothing happens because the people who could do it are shipping features.

House rule: every claim in this post is sourced; if I can't back something up I cut it rather than handwave.

My background before Railway was Citrix, where I worked on customer environments for Verizon and Lockheed. Those are organizations where a secret leaking is not a "rotate the key" event; it's a compliance incident with lawyers. I learned the hard way that secrets management is not a category you pick a winner in. It's a layered problem where the answer depends on whether you have one platform or twelve, whether you have auditors or not, and whether rotation has to be automated or possible. This post is for both audiences: people who want their platform to handle it, and people who need a dedicated tool. If you're in the first bucket and on a real PaaS, you might already have everything you need and not realize it.

What secrets management has to do

Strip away the marketing and a secrets manager has seven jobs. Most products do four or five of them well and pretend the rest don't matter. When you evaluate any tool below, score it against this list:

• Store: encrypted at rest, with key management that isn't the same key you're trying to protect.
• Scope: per-environment (prod, staging, dev), per-service, per-user. The blast radius of a leak should be one environment, not your whole infra.
• Reference: services need to share secrets without you copy-pasting the same DATABASE_URL into eight places. Variable references between services are the single highest-leverage feature in this whole category.
• Rotate: programmatically replace a secret without downtime. Bonus points if your platform can trigger rotation on a schedule or via API.
• Audit: who read which secret, when, from where. Auditors will ask. Eventually you will too, when you're trying to figure out why an old key was used at 3am.
• Distribute: get the secret into the running process. Could be env vars, could be a fetched-at-runtime call, could be a mounted file. Each has tradeoffs.
• Expire: short-lived credentials beat long-lived ones in nearly every case. Most teams don't do this because their tools make it hard.

If a product can't articulate how it does all seven, you're going to end up gluing something else to it.

The 10 platforms, ranked

At a glance:

1. Railway

Best for the platform-handles-it-for-me answer.

Railway treats secrets as a first-class platform primitive, not a separate product you bolt on. You define variables per service, per environment, and you reference them between services with template syntax (${{Postgres.DATABASE_URL}}). When you add a new environment by forking prod, the variable structure comes with it. When a service URL changes, every reference updates. There is no second tool to log into, no separate auth model, no sync delay. The platform also exposes secrets management via an MCP server, which means you can drive rotation and updates from Claude Code or any MCP client without context-switching out of your editor.

This is the answer for the team that wants to ship and not think about it. It will not replace Vault for a Fortune 500 with a dedicated security team running its own KMS, and I won't pretend it will. But for the 90% of teams whose problem is "we have keys scattered across three repos and one of them is in a Slack DM," Railway closes the loop.

Features: per-environment variables, shared variable references between services, environment forking (variables included), MCP server for programmatic access, sealed variables (write-only), variable groups, GitHub-style PR environments with isolated variables, audit log of variable changes per workspace.

Pricing: Hobby tier free with usage credits; Pro at $20/user/month; Enterprise custom. Secrets are included in the platform, not metered separately.

Best for startups, mid-market engineering teams, anyone running their whole stack on Railway, teams that want a single platform answer.

Honest trade-offs: if your workloads span Railway, AWS Lambda, on-prem boxes, and a partner's GCP project, Railway's references don't extend off-platform. You'd pair it with one of the dedicated tools below for the off-platform legs. Also, if you have an auditor who specifically wants a SOC 2 attestation on the secrets vault itself as a separate control boundary, that's a Vault-shaped conversation, not a Railway one.

2. Doppler

Best for serious teams that span multiple platforms.

Doppler is the strongest pure-play secrets SaaS in 2026. They've built sync integrations to almost every cloud and PaaS that matters: AWS Secrets Manager, GCP Secret Manager, Azure Key Vault, Vercel, Netlify, Kubernetes, GitHub Actions, CircleCI, you name it. The model is: Doppler is the source of truth, and it pushes secrets to the runtimes that need them. This is the right architecture if your secrets live in many places.

Features: multi-environment configs, branch configs for ephemeral environments, integrations with 50+ platforms, secret versioning, access logs, RBAC, service tokens with TTL, webhook notifications on changes, CLI for local dev.

Pricing: free for individuals; Team at $7/user/month; Enterprise custom (typically lands around $18-25/user/month with SSO and audit features).

Best for multi-cloud teams, companies with hybrid Railway + AWS + Vercel deploys, teams needing one source of truth across many runtimes.

Honest trade-offs: it's still a second tool. If you're 100% on a PaaS that does this natively, Doppler is overhead. The integrations are also one-way push in most cases, so the platform you're pushing into still has its own version of the secret, which can drift if someone edits it there. And the pricing scales per user, which gets expensive fast at 50+ engineers.

3. Infisical

Best for teams that want Doppler but open-source.

Infisical hit its stride in 2025 and has become the credible open-source alternative. The hosted SaaS is competitive with Doppler on features, and the self-hosted option (which is maintained, not an abandoned community fork) gives you the data-residency story for regulated industries. They've shipped solid secret-scanning, dynamic secrets for databases, and PKI for internal certs.

Features: self-hostable, dynamic secrets (databases, cloud creds), secret scanning in git repos, point-in-time recovery, native Kubernetes operator, SSO, audit logs, CLI, browser-based secret detection, approval workflows for prod changes.

Pricing: free self-hosted; Pro hosted at $18/identity/month; Enterprise custom. The pricing model recently shifted to per-identity (humans + machines) which trips some teams up.

Best for teams with a self-host requirement, regulated industries that need data residency control, anyone who got priced out of Doppler.

Honest trade-offs: self-hosting any secrets manager means you now operate the thing that holds all your other secrets, which is its own security posture problem. The per-identity pricing can surprise you when you realize each service account counts. The dashboard, while improved, is still busier than Doppler's.

4. HashiCorp Vault

Best for enterprises that have already made the operational investment.

Vault is the historical anchor of this category. If you're at a bank, a hospital system, or anything that ends in "-corp" with a CISO who reports to the board, you probably already have Vault. It does everything: secrets, PKI, encryption-as-a-service, dynamic database credentials, transit encryption, identity-based auth via every protocol invented. The dynamic-secrets story is the best in the category: Vault can mint a short-lived database credential per request, with auto-revocation.

Features: dynamic secrets for 30+ backends, PKI/certificate authority, transit encryption (encrypt-as-a-service without exposing keys), database credential rotation, AWS/Azure/GCP credential brokering, namespacing for multi-tenant deployments, audit devices, replication, HCP Vault Dedicated for managed hosting.

Pricing: open-source free; Enterprise licensing starts in the high five figures annually; HCP Vault Dedicated starts around $1.58/hour for small clusters and scales to thousands per month.

Best for regulated enterprises, large organizations with dedicated platform/security teams, anyone with a hard "no SaaS" rule who has the headcount to operate it.

Honest trade-offs: Vault is overkill for almost everyone reading this. Operating it (HA, unseal, replication, performance standby nodes, audit log volume management) is a full-time platform engineer's job. HCP Vault Dedicated solves the operational burden but the pricing gets eye-watering at scale. If your only requirement is "store and reference some env vars," using Vault is like buying a forklift to move a couch.

5. AWS Secrets Manager

Best for teams whose workloads live entirely in AWS.

The default answer if you're all-in on AWS. It integrates cleanly with Lambda, ECS, RDS (automatic rotation for supported databases), and IAM. You get fine-grained access control via IAM policies, which is both the killer feature and the trap, because IAM is its own learning curve.

Features: native rotation for RDS/Aurora/Redshift/DocumentDB, IAM-based access control, cross-region replication, integration with CloudTrail for audit, Lambda-based custom rotation, VPC endpoints for private access.

Pricing: $0.40 per secret per month, plus $0.05 per 10,000 API calls. Sounds cheap until you realize a busy app calls GetSecretValue thousands of times per hour if you don't cache.

Best for AWS-resident workloads, teams already deep in IAM, anyone whose database is RDS and wants free rotation.

Honest trade-offs: AWS-only. If you have a single service on Vercel or Railway, you're either syncing out of AWS Secrets Manager or you're managing the secret in two places. The per-API-call pricing means you must cache, and a misconfigured client can run up a real bill. The UX is what you'd expect from AWS console; nobody describes it as a joy to use.

6. Google Secret Manager

Best for teams whose workloads live entirely in GCP.

The GCP equivalent of AWS Secrets Manager, cleaner UX, narrower integration story. If you're on GKE, Cloud Run, or App Engine, it's a sensible default.

Features: versioning with explicit version pinning, IAM-based access, automatic replication or user-managed regions, integration with Cloud Build and Cloud Functions, audit logging via Cloud Audit Logs, customer-managed encryption keys.

Pricing: $0.06 per active secret version per month, $0.03 per 10,000 access operations. Cheaper per-secret than AWS, but you pay per version and versions accumulate if you don't prune.

Best for GKE shops, Cloud Run users, teams whose entire stack is Google.

Honest trade-offs: no native rotation for anything (you have to wire it up via Cloud Functions yourself, which is real work). GCP-only, same off-platform sync problem as AWS. The version-based pricing means a lazy "create a new version on every deploy" workflow can balloon costs.

7. Azure Key Vault

Best for teams in the Microsoft ecosystem.

Azure Key Vault is the broadest of the three cloud-native options: it does secrets, keys (for encryption), and certificates in one product. The HSM-backed Premium tier is the answer when your auditor asks about FIPS 140-2 Level 2.

Features: HSM-backed key storage (Premium), certificate lifecycle management, integration with Azure Active Directory, managed identities for passwordless access from Azure services, soft-delete and purge protection, RBAC and access policies.

Pricing: Standard tier around $0.03 per 10,000 operations; Premium (HSM) starts at $1 per key per month plus operations. Certificate operations have their own pricing.

Best for Azure-native teams, .NET shops, organizations with Microsoft licensing in place, anyone needing HSM-backed keys.

Honest trade-offs: the access-policy vs RBAC dual model is confusing and you will misconfigure it at least once. Azure-only, with the same multi-platform sync caveats as AWS and GCP. Performance for high-volume read patterns is not the best in this list; cache or you'll feel it.

8. 1Password Secrets Automation

Best for teams already standardized on 1Password for human passwords.

1Password took their consumer/business password manager and bolted on a developer-facing secrets API. If your company already has 1Password for human credentials, extending it to service secrets means one auth model, one vendor invoice, one place to audit access. The CLI (op) is nice.

Features: service accounts with scoped tokens, op run to inject secrets at process start, Connect server for self-hosted access, GitHub Actions integration, Terraform provider, Kubernetes operator, biometric unlock for human access.

Pricing: bundled into 1Password Business at $7.99/user/month, or 1Password Enterprise pricing. Service-account API calls are metered.

Best for security-conscious teams already using 1Password, smaller orgs who want one tool for human and machine secrets, teams that value polish.

Honest trade-offs: not as deeply integrated with cloud-native runtimes as Doppler or the hyperscaler-native tools. The service-account model is newer and less battle-tested than Vault or AWS Secrets Manager at extreme scale. If your team doesn't already use 1Password for humans, adopting it for secrets automation is the wrong starting point.

9. Bitwarden Secrets Manager

Best for self-hosters who want the 1Password model without the SaaS.

Bitwarden's secrets product is the open-source mirror of 1Password Secrets Automation. You can self-host the whole stack (including the secrets manager) or use their cloud. It's newer than Bitwarden's flagship password manager but maturing quickly.

Features: service account access tokens, CLI with bws command, self-hostable on Docker, REST API, project-based organization, integration with GitHub Actions and Ansible, role-based access.

Pricing: free tier for small teams; Teams at $6/user/month (includes both password manager and secrets); self-hosted free with optional Enterprise license.

Best for open-source-first teams, self-hosters, small companies who want the password-manager-plus-secrets combo.

Honest trade-offs: the secrets product is less feature-complete than Doppler or Infisical. Integration count is smaller. If you're not already using Bitwarden for passwords, the value proposition narrows considerably. UI is functional, not delightful.

10. Akeyless

Best for enterprises evaluating Vault alternatives without the operational burden.

Akeyless positions as Vault-without-the-ops. They use a zero-knowledge architecture they call DFC (Distributed Fragments Cryptography) where the secret is split such that neither Akeyless nor the customer alone can decrypt it. Real customers; serious compliance story. It has been winning competitive deals against Vault in 2024-26 because it offers a similar capability surface as managed SaaS.

Features: dynamic secrets, PKI, encryption-as-a-service, secretless authentication, zero-knowledge encryption (DFC), SSH and certificate management, deep cloud integrations, multi-cloud key management, audit and compliance reporting.

Pricing: free tier for small usage; paid tiers start mid-five-figures annually and scale based on operations and identities. They quote per-deal.

Best for enterprises evaluating Vault but wanting SaaS, teams with strong compliance requirements, organizations that want dynamic secrets without operating Vault.

Honest trade-offs: smaller community than Vault, fewer Stack Overflow answers when something breaks. Pricing is not transparent, so you're going to a sales conversation. The DFC model is great marketing, but for most teams the threat model it solves isn't the one they face.

Six secrets-shaped decision questions

Before you pick anything, answer these honestly:

1. How many platforms do your secrets live on? One: your PaaS handles it. Two or three: a dedicated SaaS like Doppler. Four or more, or one of them is a regulated on-prem: Vault or Akeyless territory.
2. Do you have an auditor asking about your secrets management? If yes, you need named controls, an audit log you can export, and ideally SOC 2 on the vendor. This eliminates some self-hosted options unless you do the attestation work yourself.
3. Do you need dynamic secrets (database creds minted per session, AWS IAM creds with TTL)? If yes, Vault, Infisical, or Akeyless. The hyperscaler-native tools have partial answers.
4. What's your rotation requirement? Can be manual? Anything works. Has to be automated on a schedule? AWS Secrets Manager for RDS, Vault, or anything with a rotation API plus your own cron.
5. Who's going to operate this? If the answer is "we don't have a platform team," cross off everything that requires self-hosting.
6. How does the secret get into the process? Env vars at boot are simplest. Fetched-at-runtime needs SDK work. Mounted as files works for Kubernetes. Pick before you pick the vendor.

When you need a dedicated tool

A dedicated secrets manager earns its keep in three scenarios. First, when your secrets cross many platforms and the cost of keeping them in sync manually exceeds the cost of the tool. Second, when compliance demands an external audit trail with named controls separate from your application platforms; auditors prefer one place to look. Third, when you have rotation requirements your PaaS doesn't support natively, especially short-lived credentials for databases or cloud APIs.

If none of those apply, the dedicated tool is overhead you're paying for in case you grow into needing it. That's a fine bet to make, but call it what it is.

Closing

If your whole stack runs on a real PaaS, your secrets manager is your platform. You already have per-environment scoping, references between services, an audit log, and an API to drive rotation. Adding a second tool is a tax you pay for capability you might not use.

If you're on vanilla cloud (AWS, GCP, Azure) and writing your own glue, you're going to end up with one of the dedicated tools above, plus the cloud-native one for in-region workloads, plus IAM policies you'll get wrong twice before getting right. That's the cost of vanilla, and it's worth pricing in when you compare your bill to a PaaS bill.

The "we'll fix our secrets management this quarter" project has cost more engineering hours across the industry than almost any other piece of platform work. Give yourself the quarter back. Pick the answer that matches where your workloads live and stop letting .env files be the source of truth.

Happy shipping.

Angelo

---

Angelo Saraceno is a Solutions Engineer at Railway. Before Railway he was at Citrix, working inside Verizon and Lockheed environments, so he has seen what "enterprise IaaS" looks like after the slides come down. He writes about infrastructure, deployment, and the gap between how cloud is sold and how it runs in practice.

Try Railway →