Secrets management used to be a niche DevOps concern. In 2026 it is a baseline requirement: every API key, database password, and cloud credential that touches your infrastructure needs a home that is more secure than a `.env` file in a repo. HashiCorp Vault, AWS Secrets Manager, and Doppler approach that problem from three different directions — self-hosted (or hybrid-managed) platform, AWS-native managed service, and developer-first SaaS. Here is how they actually compare on deployment model, pricing, and core capability, based on each vendor’s own documentation.
At a Glance
| Tool | Starting Price | Free Plan | Best For |
|---|---|---|---|
| HashiCorp Vault | Free to self-host (BSL-licensed Community edition); HCP Vault Dedicated and Vault Enterprise are usage-based or custom-quoted | Yes — self-managed Vault is free to run under HashiCorp’s Business Source License | Teams that need dynamic, short-lived credentials across many backends and are willing to run or pay HashiCorp/IBM to run the infrastructure |
| AWS Secrets Manager | $0.40 per secret/month + $0.05 per 10,000 API calls | No dedicated free tier for the service itself, though new AWS accounts can apply up to $200 in general AWS Free Tier credit to it for 6 months | Teams already standardized on AWS who want a zero-infrastructure, pay-as-you-go secrets store wired into IAM |
| Doppler | Free for up to 3 users, then $8/user/month on the Developer plan | Yes — Developer plan is free for up to 3 users | Small-to-mid dev teams who want a fast SaaS secrets/config manager without standing up any infrastructure |
Short Verdict
If you need Vault’s dynamic-secrets engine and can absorb either the operational overhead of self-hosting or the cost of HashiCorp’s managed HCP Vault Dedicated, it remains the most capable option on paper. If your workloads already live in AWS and you just need a durable, audited place to store and rotate credentials, Secrets Manager’s flat per-secret pricing is the path of least resistance. If you want something a small team can set up in an afternoon with no servers to run, Doppler’s free-to-start, per-seat SaaS model is the easiest on-ramp — though its most Vault-like features, like dynamic secrets, are reserved for its Enterprise tier.
What It Is
HashiCorp Vault is a secrets-management platform originally built by HashiCorp, which IBM completed its acquisition of on February 27, 2025, according to IBM’s own newsroom announcement. IBM has kept Vault and Terraform available under the “HashiCorp, an IBM company” banner, with no rename announced as of this writing. Vault itself has shipped under the Business Source License (BSL v1.1) since August 2023 rather than a fully open-source license — HashiCorp’s own licensing FAQ says internal use is unrestricted and that “all non-production and production usage” is permitted, with the main carve-out being offering a competing hosted version of the software to third parties. You can run Vault yourself (Community edition, free under the BSL, or licensed Vault Enterprise for extra features and support), or consume it as a managed service called HCP Vault Dedicated, which comes in Development, Essentials, and Standard tiers per HashiCorp’s own documentation.
AWS Secrets Manager is a fully managed, AWS-native secrets store. There is nothing to install or patch — you create a secret through the console, CLI, or SDK, and AWS handles storage, encryption, and (optionally) rotation. It is deeply wired into IAM for access control and into CloudTrail for audit logging of every API call made against a secret, per AWS’s own documentation.
Doppler is a SaaS secrets and configuration manager aimed at development teams who want a single source of truth for environment variables and secrets across local dev, CI, and production, without running any servers. It syncs secrets out to the platforms you already use (cloud providers, CI systems, container platforms) and layers team features — SSO, RBAC, audit logs — on top as you move up its plans.
Pricing Breakdown
| Tool | Plan | Price | Notes |
|---|---|---|---|
| HashiCorp Vault | Vault Community (self-hosted) | Free | BSL-licensed; you run and operate it yourself, no HashiCorp SLA or support |
| HashiCorp Vault | HCP Vault Dedicated – Development | Pay-as-you-go, hourly base cost only (no published dollar rate) | Single-node, 25-client limit, no HA, no HCP SLA; for sandboxing and prototyping |
| HashiCorp Vault | HCP Vault Dedicated – Essentials | Hourly base cost plus a per-client rate that varies by cluster size/region (no published flat rate) | HA clusters, 99.9% SLA, Silver support; small/medium/large cluster sizes |
| HashiCorp Vault | HCP Vault Dedicated – Standard | Hourly base plus per-client rate (no published flat rate); annual contracts available via sales | Adds Gold support, performance replication, secrets sync, and Advanced Data Protection |
| HashiCorp Vault | Vault Enterprise (self-managed) | Custom — contact sales | For teams that want Enterprise features/support on their own infrastructure |
| AWS Secrets Manager | Pay-as-you-go (only billing model) | $0.40 per secret/month + $0.05 per 10,000 API calls | No tiers; rotation and temporary IAM credentials are included at no extra charge |
| Doppler | Developer | Free for up to 3 users; $8/user/month thereafter (up to 25 users) | CLI, integrations, service tokens, 3 days of activity log retention, 5 config syncs |
| Doppler | Team | $21/user/month (up to 500 users); 14-day free trial | SSO/SAML, RBAC, automatic secret rotation for supported integrations, 90-day activity logs |
| Doppler | Enterprise | Custom, scaled to team size | Dynamic secrets, SCIM, Terraform-managed config, log forwarding, 99.95% SLO |
Pros
- Vault: Purpose-built dynamic secrets — database and cloud IAM secrets engines that issue short-lived, auto-expiring credentials rather than static ones, per HashiCorp’s own product documentation.
- Vault: Detailed audit logging that records every request whether authentication succeeds or fails, useful for compliance-heavy environments.
- AWS Secrets Manager: Simple, predictable flat-rate billing with no separate plan tiers to evaluate, and automatic rotation (managed or Lambda-based) included at no extra cost.
- AWS Secrets Manager: Zero infrastructure to run and native IAM/CloudTrail integration for access control and audit trails.
- Doppler: Fastest time-to-value of the three — a usable free plan and a straightforward per-seat Team tier with SSO and RBAC well below Vault Enterprise or HCP price points.
- Doppler: Built-in automatic rotation integrations for common services (AWS, Azure, GCP, Cloudflare, MongoDB Atlas, OpenAI, SendGrid, Twilio, and others) without custom engineering.
Cons
- Vault: The two most price-relevant tiers — Vault Enterprise self-hosted and HCP Vault Dedicated Essentials/Standard usage rates — have no public pricing; budgeting requires a sales conversation.
- Vault: Self-hosting the Community edition means you own patching, HA, backup, and upgrade operations yourself.
- AWS Secrets Manager: Costs scale linearly with secret count and API call volume, which can add up for high-churn, high-traffic architectures with many services polling secrets.
- AWS Secrets Manager: It is a store-and-rotate service for credentials you already provision, not a dynamic-secrets engine that mints brand-new short-lived credentials per request the way Vault’s secrets engines do.
- Doppler: Dynamic secrets — Doppler’s closest analog to Vault’s signature feature — are gated to the custom-priced Enterprise plan, and even there only cover AWS IAM and Azure Service Principal today, per Doppler’s own documentation.
- Doppler: Team-plan add-ons (custom roles, user groups, higher integration-sync limits) are billed separately at $9/seat/month each, which can push real-world per-seat cost above the headline $21.
Who It’s a Good Fit For
Platform and security teams running multi-cloud or on-prem infrastructure who need genuinely dynamic, short-lived credentials and have the engineering capacity (or budget for HCP/Enterprise) to run Vault properly. AWS-centric engineering teams who want secrets management to disappear into the rest of their AWS bill rather than become a separate procurement line item. Startups and mid-size dev teams who want a working secrets manager today, without a platform engineer dedicated to it, and who value SSO/RBAC arriving at a predictable per-seat price.
Who Should Look Elsewhere
Teams with no spare DevOps bandwidth should be cautious about self-hosting Vault Community — it is free in license cost only. Multi-cloud teams who specifically need dynamic secrets outside AWS IAM/Azure Service Principal will find Doppler’s dynamic-secrets coverage narrow unless they’re already committed to the Enterprise tier. And organizations that need vendor-published, line-item pricing for every tier should budget extra time for HashiCorp’s sales-assisted quoting process on HCP Vault Dedicated and Vault Enterprise.
Bottom Line
There isn’t a single winner here because the three tools are solving overlapping but distinct problems. Vault is still the deepest toolkit for dynamic, policy-gated secrets issuance, now operating under IBM ownership and a Business Source License rather than a fully open license. AWS Secrets Manager is the low-friction default if you’re already an AWS shop. Doppler is the fastest path to a clean, team-friendly secrets workflow for organizations that don’t need Vault’s full secrets-engine depth — as long as you price in the Enterprise tier if dynamic secrets end up mattering to you.
FAQ
Is HashiCorp Vault still open source after the IBM acquisition? No — Vault’s core has shipped under the Business Source License (BSL v1.1) since August 2023, a change HashiCorp made before IBM’s acquisition closed in February 2025. APIs, SDKs, and most provider code remain under the Mozilla Public License 2.0. The BSL still permits free internal and most production use; the restriction targets competitors offering Vault as a hosted service.
Does AWS Secrets Manager support dynamic, auto-generated credentials like Vault? Not in the same sense. Secrets Manager stores and rotates secrets you provision (via managed rotation, managed partner rotation, or Lambda-based rotation), but it isn’t a secrets engine that issues brand-new, short-lived credentials on each request the way Vault’s database or cloud secrets engines do.
Can I use Doppler for free indefinitely? Yes, for small teams — the Developer plan is free for up to 3 users, with per-user pricing of $8/month kicking in beyond that, up to 25 users total, according to Doppler’s pricing page.
Which of these three has the most predictable cost as I scale? AWS Secrets Manager’s flat per-secret-per-month plus per-10,000-API-calls model is the easiest to forecast mathematically, since there are no plan tiers to outgrow. Doppler’s and Vault’s costs instead scale with seats, cluster size, or client count, which require more active monitoring.
Do any of these tools log who accessed a secret and when? Yes, all three offer audit logging: Vault has a dedicated audit-device subsystem that records every request regardless of outcome; AWS Secrets Manager events are captured in AWS CloudTrail; Doppler includes activity logs starting at 3 days of retention on Developer and extending to 90 days on Team and custom retention on Enterprise.
Sources
IBM Completes Acquisition of HashiCorp (IBM Newsroom) — HashiCorp Updates Licensing FAQ Based on Community Questions — HCP Vault Dedicated Tiers and Features (HashiCorp Developer Docs) — HCP Vault Dedicated Product Page — What is Vault? (HashiCorp Developer Docs) — AWS Secrets Manager Pricing — Rotate AWS Secrets Manager Secrets (AWS Docs) — Log AWS Secrets Manager Events with AWS CloudTrail — Doppler Pricing — Doppler Dynamic Secrets Documentation
