# Alternatives to Bitwarden Secrets Manager Bitwarden Secrets Manager is an open-source, end-to-end encrypted secrets management tool for developers and DevOps to store, share, and inject secrets into apps and CI/CD. Bitwarden Secrets Manager ranks #6 of 7 in Secrets management, with an Alt Score of 76. It is licensed under AGPL-3.0 (server core); some parts under Bitwarden License v1.0 & the Bitwarden SDK License, freemium from $6/mo per user (Teams plan) and available on the web. 12 of 13 checklist rows are verified against a public source. Source: https://altcatalog.com/alternatives/bitwarden-secrets-manager/ Category: Secrets management ## Where Bitwarden Secrets Manager stands out - **Open source** — 3 of 7 apps with a verified answer have this ## Overview - **Who it's for**: Developers, DevOps, and cybersecurity teams who need to centrally store, manage, and deploy infrastructure secrets (API keys, database credentials, SSH keys, certificates) instead of hardcoding them in repos, .env files, or CI/CD logs — ranging from solo developers on the free tier to regulated enterprises that need self-hosting, SSO, and SCIM. - **What you get**: An end-to-end encrypted vault for secrets organized into projects, with scoped machine-account access tokens for applications and AI agents, a web app for administration, the open-source 'bws' CLI and multi-language SDKs (Rust, Go, Java, Python, JS, and more) for injecting secrets, a Kubernetes Operator that syncs secrets into cluster Secrets, native GitHub Actions/GitLab CI integrations, and (on paid plans) event/audit logs, user groups, and custom roles. - **How it works**: Admins create projects in the Secrets Manager web app, add secrets to them, and grant read or read/write access to people and machine accounts; applications and pipelines then authenticate with a machine account's access token via the CLI, SDK, GitHub Action, or Kubernetes Operator to retrieve secrets at runtime instead of storing them in plaintext. ## Profile - **License**: AGPL-3.0 (server core); some parts under Bitwarden License v1.0 & the Bitwarden SDK License (verified 2026-07-17) - **Pricing model**: Freemium (verified 2026-07-17) - **Starts at**: $6/mo per user (Teams plan) (verified 2026-07-17) - **Platforms**: Web - **Status**: active (verified 2026-07-17) ## Ranked alternatives | # | App | Alt Score | Licence | Platforms | |---|-----|-----------|---------|-----------| | 1 | [Infisical](https://altcatalog.com/alternatives/infisical.md) | 100 | MIT | Web | | 2 | [HashiCorp Vault](https://altcatalog.com/alternatives/hashicorp-vault.md) | 93 | BUSL-1.1 | Web | | 3 | [CyberArk Conjur](https://altcatalog.com/alternatives/cyberark-conjur.md) | 89 | LGPL-3.0 | Web | | 4 | [Akeyless](https://altcatalog.com/alternatives/akeyless.md) | 86 | Proprietary | ? | | 5 | [Doppler](https://altcatalog.com/alternatives/doppler.md) | 79 | Proprietary | Web | | 6 | [1Password Secrets Automation](https://altcatalog.com/alternatives/1password-secrets.md) | 68 | Proprietary (platform); Go/JS/Python SDKs & CLI shell-plugins are MIT | Web | Alt Score = Verified coverage (90%) + Visibility (10%). See https://altcatalog.com/how-alt-score-works/ ## Feature comparison Legend: Yes / No / Partial / ? (not verified). | Secrets management checklist | Bitwarden Secrets Manager | Infisical | HashiCorp Vault | CyberArk Conjur | Akeyless | Doppler | |---|---|---|---|---|---|---| | Pricing model | Freemium | OSS + paid hosting | OSS + paid hosting | OSS + paid hosting | Freemium | Freemium | | Starts at | $6/mo per user (Teams plan) | $18/month per identity | ? | Free | Free | $21/mo per user (Team plan) | | License | AGPL-3.0 (server core); some parts under Bitwarden License v1.0 & the Bitwarden SDK License | MIT | BUSL-1.1 | LGPL-3.0 | Proprietary | Proprietary | | Platforms | Web | Web | Web | Web | ? | Web | | Open source | Yes | Yes | Partial | Yes | No | No | | Self-hostable | Yes | Yes | Yes | Yes | Partial | Yes | | Managed / SaaS option | Yes | Yes | Yes | Yes | Yes | Yes | | Dynamic secrets | No | Yes | Yes | Yes | Yes | Yes | | Secret rotation | Partial | Yes | Yes | Yes | Yes | Yes | | Secret scanning / leak detection | ? | Yes | Partial | ? | Partial | No | | Kubernetes integration | Yes | Yes | Yes | Yes | Yes | Yes | | CI/CD integrations | Yes | Yes | Yes | Yes | Yes | Yes | | CLI | Yes | Yes | Yes | Yes | Yes | Yes | | Audit logs | Yes | Yes | Yes | Yes | Yes | Yes | | RBAC / fine-grained access | Yes | Yes | Yes | Yes | Yes | Yes | | PKI / certificate management | No | Yes | Yes | Partial | Yes | No | | SDKs & API | Yes | Yes | Yes | Yes | Yes | Yes | ## Sources Sources for Bitwarden Secrets Manager. Each alternative is sourced on its own page. - **License**: AGPL-3.0 (server core); some parts under Bitwarden License v1.0 & the Bitwarden SDK License — (verified 2026-07-17) - Note: bitwarden/server root LICENSE.txt is AGPL-3.0 by default with /bitwarden_license under Bitwarden License v1.0; the Secrets Manager SDK (bitwarden/sdk-sm) is under a non-OSI Bitwarden SDK License Agree - Quote: “Source code in this repository is covered by one of two licenses: (i) the GNU Affero General Public License (AGPL) v3.0 (ii) the Bitwarden License v1.0.” - **Pricing model**: Freemium — (verified 2026-07-17) - Note: Free plan (up to 2 users, 3 projects, 3 machine accounts) plus paid Teams ($6/mo/user) and Enterprise ($12/mo/user) tiers, alongside self-hostable, AGPL-3.0-licensed server code. - Quote: “Unlimited secrets, no matter your size. Get streamlined secrets management. Pick your plan.” - **Starts at**: $6/mo per user (Teams plan) — (verified 2026-07-17) - Note: A Free plan also exists (up to 2 users, 3 projects, 3 machine accounts); $6/user/month Teams is the cheapest paid tier, billed annually. - Quote: “Teams *For development teams that need more business capabilities.* **$6** *per month / per user*” - **Platforms**: Web — (verified 2026-07-17) - Note: Secrets Manager is administered via a web app; the bws CLI and SDKs are cross-platform binaries/libraries (Windows/macOS/Linux/Docker) treated as CLI/SDK access rather than distinct platform entries, - Quote: “Log in to the Bitwarden web app and select Secrets Manager from the product switcher in the navigation menu” - **Status**: active — (verified 2026-07-17) - Note: pushed_at": "2026-07-17T10:31:33Z", "archived": false" — bitwarden/server had a commit pushed the same day as this research (2026-07-17); bitwarden/sdk-sm (the Secrets Manager SDK repo) was also pushed to on 2026-07-17. - **Open source**: Yes — (verified 2026-07-17) - Note: Server code is AGPL-3.0 (see license fact); confirmed on github.com/bitwarden/server. - Quote: “Open source: All source code is hosted on GitHub and is free for anyone to review and audit. Third-party auditing firms and security researchers are paid to do so regularly.” - **Self-hostable**: Yes — (verified 2026-07-17) - Note: Self-hosting Secrets Manager requires an Enterprise plan per https://bitwarden.com/products/secrets-manager/#pricing ('Flexibility to self-host' listed under Enterprise). - Quote: “SM can be self-hosted. Bitwarden Secrets Manager can also be self-hosted.” - **Managed / SaaS option**: Yes — (verified 2026-07-17) - Note: The word 'also' confirms Bitwarden's own hosted cloud (bitwarden.com) is the default/primary deployment; Free and Teams plans sign up directly at bitwarden.com/go/start-secrets-free without any self-h - Quote: “SM can be self-hosted. Bitwarden Secrets Manager can also be self-hosted.” - **Dynamic secrets**: No — (verified 2026-07-17) - Note: Secrets Manager stores static, user-supplied key-value secrets rather than generating short-lived, on-demand credentials (the Vault/Doppler sense of 'dynamic secrets'). A Bitwarden blog post about the - Quote: “Secrets are sensitive key-value pairs that your organization needs securely stored and should never be exposed in plain code or transmitted over unencrypted channels” - **Secret rotation**: Partial — (verified 2026-07-17) - Note: Bitwarden markets 'secret rotation' as a benefit of centralizing secrets, but this refers to manually updating a secret's value in Secrets Manager and having it propagate to consumers (CLI, SDK, Kuber - Quote: “Secret rotation and revocation: Secure and simplified secret rotation and revocation.” - **Kubernetes integration**: Yes — (verified 2026-07-17) - Note: The sm-operator registers a BitwardenSecret Custom Resource Definition and syncs Bitwarden secrets into native Kubernetes Secrets on a configurable interval. - Quote: “The Bitwarden Secrets Manager Kubernetes Operator will allow teams to integrate Secrets Manager into Kubernetes workflows securely and efficiently. Using the operator, which is deployed using Helm pac” - **CI/CD integrations**: Yes — (verified 2026-07-17) - Note: GitLab CI/CD injection via the Secrets Manager CLI is also documented at https://bitwarden.com/help/llms-full.txt ('Bitwarden provides a way to inject secrets into your GitLab CI/CD pipelines using th - Quote: “Bitwarden provides an integration with GitHub Actions to retrieve secrets from Secrets Manager and inject them into GitHub Actions workflows.” - **CLI**: Yes — (verified 2026-07-17) - Note: The CLI binary is named 'bws' and is also distributed as a Docker image. - Quote: “The Secrets Manager CLI is your primary vehicle for injecting secrets into your applications and infrastructure through an authenticated machine account.” - **Audit logs**: Yes — (verified 2026-07-17) - Note: Event/audit logs are a Teams+/Enterprise feature (not included in Free) per the plan comparison table on the same page; per catalog policy, paid-tier-gated features still count as yes. Machine account - Quote: “Audit-ready event logs: Every secret access, user log in, and administrative change is timestamped and logged. Export to CSV or pipe into your SIEM. Ready for your next audit.” - **RBAC / fine-grained access**: Yes — (verified 2026-07-17) - Note: Machine accounts get per-project 'Can read' or 'Can read, write' permissions (https://bitwarden.com/help/machine-accounts/), and Enterprise adds Custom roles (https://bitwarden.com/products/secrets-ma - Quote: “Role-based access controls: IT controls who can create projects, manage machine accounts, and access secrets, ensuring compliance with least-privilege access.” - **PKI / certificate management**: No — (verified 2026-07-17) - Note: Secrets Manager can store an existing SSL/TLS certificate as an opaque secret value, but has no certificate authority, issuance, renewal, or PKI lifecycle-management capability (unlike e.g. HashiCorp - Quote: “Examples of secrets are: - SSH keys - Database passwords - SSL or TLS certificates - Private encryption keys - API keys - One-time password devices” - **SDKs & API**: Yes — (verified 2026-07-17) - Note: Public REST API access is also listed as a Teams/Enterprise feature: 'All features offered to Teams organizations, like event logs and API access' (https://bitwarden.com/help/secrets-manager-plans/). - Quote: “The core SDK, found here, is written in Rust and provides Rust API, CLI, and Node-API bindings... Language wrappers can be used for the following languages: C++, C#, Go, Java, JS, PHP, Python, Ruby” --- Ranked by verified data, never by who paid. https://altcatalog.com/trust/