Alternatives to CyberArk Conjur
Open-source secrets management for DevOps, by CyberArk.
CyberArk Conjur ranks #3 of 7 in Secrets management, with an Alt Score of 89. It is licensed under LGPL-3.0, open source with paid hosting from Free and available on the web. 12 of 13 checklist rows are verified against a public source.
Conjur is CyberArk open-source secrets management solution for securing machine identities and secrets in DevOps pipelines and cloud-native applications.
CyberArk Conjur is built for DevOps, platform, and security teams who need to remove hard-coded credentials from applications, scripts, containers, and CI/CD pipelines across cloud-native and hybrid infrastructure.
A free, open-source (LGPL-3.0) secrets management server with a policy-as-code RBAC model, automatic secret rotation, a REST API, CLI, and client libraries, plus native integrations for Kubernetes/OpenShift, Jenkins, Ansible, and other DevOps tooling; a commercial self-hosted or SaaS edition (now branded Secrets Manager under CyberArk/Idira, following Palo Alto Networks' February 2026 acquisition of CyberArk) adds dynamic secrets and enterprise support.
Secrets and access rules are declared as YAML policy files loaded into the Conjur server, which authenticates workloads (via API key, Kubernetes service account, JWT, or client certificate) and grants secret access based on role-based permissions; a rotation engine periodically regenerates credentials on both Conjur and the target system, and sidecar/init-container Secrets Providers sync those secrets into platforms like Kubernetes Secrets.
Where CyberArk Conjur stands out
Verified capabilities most alternatives don't have.
Why people leave CyberArk Conjur
Dashed reasons are sourced facts; the rest are opinions. Vendors can dispute.
Sign in to add a reason — new reasons go through moderation before appearing.
Ranked alternatives
Ordered by Alt Score. Click any score to see the breakdown.
Infisical is an open-source secrets management platform for syncing and managing secrets across teams and infrastructure, with secret scanning, rotation, and PKI; self-hostable or cloud.
HashiCorp Vault is a platform for secrets management, encryption as a service, dynamic secrets, and PKI, with fine-grained access control and audit logging; self-hosted or HCP Vault cloud.
Akeyless is a SaaS platform for secrets management, dynamic secrets, encryption, and machine identity, built on a distributed fragments cryptography model.
Doppler is a SecretOps platform that centralizes application secrets and configuration and syncs them across environments, services, and CI/CD.
Bitwarden Secrets Manager is an open-source, end-to-end encrypted secrets management tool for developers and DevOps to store, share, and inject secrets into apps and CI/CD.
1Password developer tools provide secrets automation for injecting and managing secrets in code, CI/CD, and infrastructure, backed by the 1Password vault.
Feature comparison
Rows come from the Secrets management checklist (17 rows). Human-verified cells only. ? means the value has not been verified.
+ Add app
| Secrets management checklist | CyberArk Conjur | Infisical | HashiCorp Vault | Akeyless | Doppler | Bitwarden Secrets Manager |
|---|---|---|---|---|---|---|
| Pricing model | ||||||
| Starts at | ||||||
| License | ||||||
| Platforms | ||||||
| Open source | ||||||
| Self-hostable | ||||||
| Managed / SaaS option | ||||||
| Dynamic secrets | ||||||
| Secret rotation | ||||||
| Secret scanning / leak detection | ||||||
| Kubernetes integration | ||||||
| CI/CD integrations | ||||||
| CLI | ||||||
| Audit logs | ||||||
| RBAC / fine-grained access | ||||||
| PKI / certificate management | ||||||
| SDKs & API |
Every fact and feature listed for CyberArk Conjur is verified against its own pages. Each alternative is sourced on its own page.
-
License LGPL-3.0 verified 2026-07-17
Conjur OSS server code (this repo) is licensed under LGPL-3.0. README.md confirms: "The Conjur server (as in, the code within this repository) is licensed under the Free Software Foundation's GNU LGPL
GNU Lesser General Public License ... Version 3, 29 June 2007
https://raw.githubusercontent.com/cyberark/conjur/master/LICENSE.md -
Pricing model OSS + paid hosting verified 2026-07-17
Conjur Open Source (this GitHub project, conjur.org) is free/LGPL-3.0. The commercial successor products - Secrets Manager, Self-Hosted (formerly Conjur Enterprise) and Secrets Manager, SaaS (formerly
Conjur Secrets Manager Enterprise is now Secrets Manager, Self-Hosted.
https://www.cyberark.com/products/secrets-manager-self-hosted/ -
Starts at Free verified 2026-07-17
Conjur Open Source is free to self-host. No public pricing is disclosed for the paid Secrets Manager Self-Hosted/SaaS tiers; the CyberArk product page only offers "Request a Demo", i.e. contact-sales.
Request a Demo
https://www.cyberark.com/products/secrets-manager-self-hosted/ -
Platforms Web verified 2026-07-17
Conjur is a server/API product: self-hosted via Docker containers (README: "Conjur is designed to run in a Docker container(s)") plus a SaaS offering. Accessed via REST API/CLI/web console rather than
Secrets Manager - SaaS is a SaaS-based cloud-agnostic solution for secrets management.
https://docs.cyberark.com/secrets-manager-saas/latest/en/content/conjurcloud/cl_conjurcloudoverview.htm -
Status acquired verified 2026-07-17
Acquisition completed Feb 11, 2026. CyberArk's product line was rebranded to "Idira" in May 2026 (docs.cyberark.com now shows "Idira Docs" branding and Conjur Cloud is renamed Secrets Manager SaaS). T
Palo Alto Networks (NASDAQ: PANW), the global cybersecurity leader, today announced the completion of its acquisition of CyberArk, establishing Identity Security as a core pillar of its platformizatio
https://www.paloaltonetworks.com/company/press/2026/palo-alto-networks-completes-acquisition-of-cyberark-to-secure-the-ai-era -
Open source Yes verified 2026-07-17
The Conjur server (as in, the code within this repository) is licensed under the Free Software Foundation's GNU LGPL v3.0.
https://raw.githubusercontent.com/cyberark/conjur/master/README.md -
Self-hostable Yes verified 2026-07-17
Conjur is designed to run in a Docker container(s), using PostgreSQL as the backing data store.
https://raw.githubusercontent.com/cyberark/conjur/master/README.md -
Managed / SaaS option Yes verified 2026-07-17
This SaaS product was formerly branded "Conjur Cloud"; the docs page itself notes: "Conjur Cloud Secrets Manager is now Idira Secrets Manager, SaaS."
Secrets Manager - SaaS is a SaaS-based cloud-agnostic solution for secrets management.
https://docs.cyberark.com/secrets-manager-saas/latest/en/content/conjurcloud/cl_conjurcloudoverview.htm -
Dynamic secrets Yes verified 2026-07-17
Dynamic secrets (e.g. AWS secrets engine) are documented for Secrets Manager Self-Hosted and Secrets Manager SaaS (paid tiers). This page returns 404 under the conjur-open-source docs path, so it appe
The AWS secrets engine generates AWS access credentials dynamically based on IAM policies. These secrets are generated just in time (JIT), on demand and are short-lived, which follows the principle of
https://docs.cyberark.com/secrets-manager-sh/latest/en/content/operations/dynamic-secrets-aws.htm -
Secret rotation Yes verified 2026-07-17
The Conjur rotation feature meets this requirement by automatically generating and rotating the secrets used to access an underlying system.
https://docs.cyberark.com/conjur-open-source/latest/en/content/operations/services/rotation-secrets.html -
Kubernetes integration Yes verified 2026-07-17
This topic describes how to set up Secrets Provider for Kubernetes as an init container or sidecar, cyberark-secrets-provider-for-k8s, to populate Kubernetes Secrets with secrets stored in Conjur.
https://docs.cyberark.com/conjur-open-source/latest/en/content/integrations/k8s-ocp/cjr-k8s-secrets-provider-ic.htm -
CI/CD integrations Yes verified 2026-07-17
Conjur OSS also ships an Ansible integration (docs.cyberark.com/conjur-open-source/.../integrations/ansible.html) and its GitHub README lists CI/CD tools (Ansible, Jenkins, Puppet, Terraform) among th
The Conjur Secrets plugin enables Jenkins to authenticate to Conjur and retrieve secrets for use in Jenkins pipeline code or Freestyle projects.
https://docs.cyberark.com/conjur-open-source/latest/en/content/integrations/jenkins.htm -
CLI Yes verified 2026-07-17
The Secrets Manager CLI implements the Conjur REST API, providing an alternate interface for managing Conjur resources, including roles, privileges, policy, and secrets.
https://docs.cyberark.com/conjur-open-source/latest/en/content/developer/cli/cli-setup.htm -
Audit logs Yes verified 2026-07-17
Audit logging is core to the OSS server itself (app/models/audit.rb and app/models/audit/ in the cyberark/conjur repo); the CHANGELOG documents ongoing additions of audit events across API endpoints.
Password changes (`PUT /authn/:account/password`) now produce audit events with message ID `password`.
https://raw.githubusercontent.com/cyberark/conjur/master/CHANGELOG.md -
RBAC / fine-grained access Yes verified 2026-07-17
Conjur implements role-based access control (RBAC) to provide role management and permission checking.
https://docs.cyberark.com/conjur-open-source/latest/en/content/operations/policy/policy-basic-concepts.htm -
PKI / certificate management Partial verified 2026-07-17
Conjur supports certificate-based authentication (creating/using a root CA to authenticate workloads) and can store/rotate TLS certificates as secrets, but full PKI certificate-authority issuance inte
This guide describes how to create, configure, and use a Certificate Authenticator in Conjur Secrets Manager, including secret retrieval.
https://raw.githubusercontent.com/cyberark/conjur/master/CERTIFICATE_AUTH.md -
SDKs & API Yes verified 2026-07-17
We provide the following API libraries to help integrate Conjur into your development environments.
https://docs.cyberark.com/conjur-open-source/latest/en/content/developer/lp_api_opensource.htm
FAQ
Yes. Akeyless, Doppler and Bitwarden Secrets Manager have a free tier or are fully free. Free-tier limits in the comparison table are verified and dated.
Infisical, HashiCorp Vault and Bitwarden Secrets Manager — every license claim links its source.