# Alternatives to Infisical Infisical is an open-source secrets management platform for syncing and managing secrets across teams and infrastructure, with secret scanning, rotation, and PKI; self-hostable or cloud. Infisical ranks #1 of 7 in Secrets management, with an Alt Score of 100. It is licensed under MIT, open source with paid hosting from $18/month per identity and available on the web. 13 of 13 checklist rows are verified against a public source. Source: https://altcatalog.com/alternatives/infisical/ Category: Secrets management ## Where Infisical stands out - **Secret scanning / leak detection** — 1 of 5 apps with a verified answer have this - **Open source** — 3 of 7 apps with a verified answer have this - **PKI / certificate management** — 3 of 7 apps with a verified answer have this ## Overview - **Who it's for**: Engineering, platform, and security teams who need to centralize secrets, certificates, and privileged access across cloud infrastructure — from individual developers and startups on the free tier to enterprises that need SSO, dynamic secrets, custom RBAC, and compliance-grade audit logging. - **What you get**: A secrets management platform with a web dashboard, CLI, SDKs (Node, Python, Java, .NET, Go, Rust, C++, PHP, Ruby), and API for storing and syncing secrets across projects and environments, plus secret versioning, secret rotation, dynamic secrets, secret scanning/leak prevention, a Kubernetes Operator, CI/CD integrations, PKI/certificate management, a KMS, and privileged access management — deployable as Infisical Cloud or self-hosted. - **How it works**: Teams create organizations, projects, and environments in Infisical, then store or import secrets through the dashboard, CLI, or SDKs; human and machine identities authenticate via built-in or custom RBAC roles and pull secrets at runtime into applications, Kubernetes workloads, or CI/CD pipelines instead of hardcoding them, with rotation, on-demand dynamic secret generation, and audit logging applied on top. ## Profile - **License**: MIT (verified 2026-07-17) - **Pricing model**: OSS + paid hosting (verified 2026-07-17) - **Starts at**: $18/month per identity (verified 2026-07-17) - **Platforms**: Web - **Status**: active (verified 2026-07-17) ## Ranked alternatives | # | App | Alt Score | Licence | Platforms | |---|-----|-----------|---------|-----------| | 1 | [HashiCorp Vault](https://altcatalog.com/alternatives/hashicorp-vault.md) | 93 | BUSL-1.1 | Web | | 2 | [CyberArk Conjur](https://altcatalog.com/alternatives/cyberark-conjur.md) | 89 | LGPL-3.0 | Web | | 3 | [Akeyless](https://altcatalog.com/alternatives/akeyless.md) | 86 | Proprietary | ? | | 4 | [Doppler](https://altcatalog.com/alternatives/doppler.md) | 79 | Proprietary | Web | | 5 | [Bitwarden Secrets Manager](https://altcatalog.com/alternatives/bitwarden-secrets-manager.md) | 76 | AGPL-3.0 (server core); some parts under Bitwarden License v1.0 & the Bitwarden SDK License | Web | | 6 | [1Password Secrets Automation](https://altcatalog.com/alternatives/1password-secrets.md) | 68 | Proprietary (platform); Go/JS/Python SDKs & CLI shell-plugins are MIT | Web | Alt Score = Verified coverage (90%) + Visibility (10%). See https://altcatalog.com/how-alt-score-works/ ## Feature comparison Legend: Yes / No / Partial / ? (not verified). | Secrets management checklist | Infisical | HashiCorp Vault | CyberArk Conjur | Akeyless | Doppler | Bitwarden Secrets Manager | |---|---|---|---|---|---|---| | Pricing model | OSS + paid hosting | OSS + paid hosting | OSS + paid hosting | Freemium | Freemium | Freemium | | Starts at | $18/month per identity | ? | Free | Free | $21/mo per user (Team plan) | $6/mo per user (Teams plan) | | License | MIT | BUSL-1.1 | LGPL-3.0 | Proprietary | Proprietary | AGPL-3.0 (server core); some parts under Bitwarden License v1.0 & the Bitwarden SDK License | | Platforms | Web | Web | Web | ? | Web | Web | | Open source | Yes | Partial | Yes | No | No | Yes | | Self-hostable | Yes | Yes | Yes | Partial | Yes | Yes | | Managed / SaaS option | Yes | Yes | Yes | Yes | Yes | Yes | | Dynamic secrets | Yes | Yes | Yes | Yes | Yes | No | | Secret rotation | Yes | Yes | Yes | Yes | Yes | Partial | | Secret scanning / leak detection | Yes | Partial | ? | Partial | No | ? | | Kubernetes integration | Yes | Yes | Yes | Yes | Yes | Yes | | CI/CD integrations | Yes | Yes | Yes | Yes | Yes | Yes | | CLI | Yes | Yes | Yes | Yes | Yes | Yes | | Audit logs | Yes | Yes | Yes | Yes | Yes | Yes | | RBAC / fine-grained access | Yes | Yes | Yes | Yes | Yes | Yes | | PKI / certificate management | Yes | Yes | Partial | Yes | No | No | | SDKs & API | Yes | Yes | Yes | Yes | Yes | Yes | ## Sources Sources for Infisical. Each alternative is sourced on its own page. - **License**: MIT — (verified 2026-07-17) - Note: MIT Expat" license as defined below." — Core repo is MIT ("MIT Expat"). Content under any ee/ directory is licensed separately under ee/LICENSE (Infisical's enterprise license, not MIT) per the same LICENSE file: 'All content that resides u - Quote: “Content outside of the above mentioned directories or restrictions above is available under the ” - **Pricing model**: OSS + paid hosting — (verified 2026-07-17) - Note: Core platform is free/open-source and self-hostable; paid Pro/Enterprise tiers (Infisical Cloud or self-hosted with license) unlock additional features per infisical.com/pricing. - Quote: “This repo available under the [MIT expat license](https://github.com/Infisical/infisical/blob/main/LICENSE), with the exception of the `ee` directory which will contain premium enterprise features req” - **Starts at**: $18/month per identity — (verified 2026-07-17) - Note: Cheapest paid cloud tier is Pro at $18/month per identity (Free tier is $0/month, up to 5 identities). - Quote: “$18 /mo for 1 identity” - **Platforms**: Web — (verified 2026-07-17) - Note: Infisical is accessed via a web dashboard (app.infisical.com or self-hosted), plus CLI/SDK/API; no native desktop or mobile app or browser extension found in docs. - Quote: “Dashboard UI, API, CLI, SDKs” - **Status**: active — (verified 2026-07-17) - Note: pushed_at": "2026-07-17T10:44:21Z"" — GitHub API shows a push on the same day as this research (2026-07-17); repo is not archived and has 28k+ stars. - **Open source**: Yes — (verified 2026-07-17) - Quote: “The open-source secret management platform: Sync secrets/configs across your team/infrastructure and prevent secret leaks.” - **Self-hostable**: Yes — (verified 2026-07-17) - Quote: “Self-hosting Infisical lets you retain data on your own infrastructure and network. Many organizations choose self-hosting for benefits in compliance and flexibility.” - **Managed / SaaS option**: Yes — (verified 2026-07-17) - Quote: “The fastest and most reliable way to get started with Infisical is signing up for free to Infisical Cloud.” - **Dynamic secrets**: Yes — (verified 2026-07-17) - Note: Gated to paid tiers: 'If you're using Infisical Cloud, then it is available under the Enterprise Tier. If you're self-hosting Infisical, then you should contact sales@infisical.com to purchase an ente - Quote: “dynamic secrets are generated on-demand upon access” - **Secret rotation**: Yes — (verified 2026-07-17) - Quote: “Secret rotation is a security best practice that involves systematically updating credentials and access tokens at regular intervals to minimize the risk of compromise.” - **Secret scanning / leak detection**: Yes — (verified 2026-07-17) - Quote: “Infisical Secret Scanning helps teams detect leaked credentials — such as API keys, database passwords, and tokens — across source code and developer systems.” - **Kubernetes integration**: Yes — (verified 2026-07-17) - Quote: “**Infisical Kubernetes Operator**: Deliver secrets to your Kubernetes workloads and automatically reload deployments.” - **CI/CD integrations**: Yes — (verified 2026-07-17) - Note: Dedicated CI/CD integration docs also exist for GitHub Actions, GitLab CI/CD, Jenkins, Bitbucket, AWS Amplify, etc. (infisical.com/docs/integrations/cicd/*). - Quote: “You can use it across various environments, whether it's local development, CI/CD, staging, or production.” - **CLI**: Yes — (verified 2026-07-17) - Quote: “The Infisical CLI is a powerful command line tool that can be used to retrieve, modify, export and inject secrets into any process or application as environment variables.” - **Audit logs**: Yes — (verified 2026-07-17) - Note: Gated to paid tiers: 'Note that Audit Logs is a paid feature. If you're using Infisical Cloud, then it is available under the Pro, and Enterprise Tier with varying retention periods.' Per policy, paid - Quote: “Infisical provides audit logs for security and compliance teams to monitor information access.” - **RBAC / fine-grained access**: Yes — (verified 2026-07-17) - Quote: “Infisical's Role-based Access Controls (RBAC) enable the usage of predefined and custom roles that define a set of permissions for user and machine identities.” - **PKI / certificate management**: Yes — (verified 2026-07-17) - Quote: “Run a complete private PKI: issue, manage, and monitor X.509 certificates from a centralized platform.” - **SDKs & API**: Yes — (verified 2026-07-17) - Note: SDKs available for Node.js, Python, Java, .NET, C++, Rust, Go, PHP, Ruby; full REST API also documented at infisical.com/docs/api-reference. - Quote: “From local development to production, Infisical SDKs provide the easiest way for your app to fetch back secrets from Infisical on demand.” --- Ranked by verified data, never by who paid. https://altcatalog.com/trust/