Open-source secrets-management software
115 open-source libraries, tools and applications tagged secrets-management, ranked by how closely secrets-management is their primary purpose, then by adoption and maintenance health. Each entry links to a page with sources, use cases and when to choose or avoid it.
115 products, primary matches first, then adoption-weighted; health v2 shown.
| Product | Health v2 | Stars | Maturity |
|---|---|---|---|
| keepassxreboot/keepassxc KeePassXC is a modern, open‑source password manager that stores credentials in an encrypted local database. It runs on Windows, macOS and L… | 77 | 29299 | active |
| TruffleHog TruffleHog is an open-source secrets scanning tool that discovers, classifies, validates, and analyzes leaked credentials across Git reposi… | 93 | 28212 | active |
| getsops/sops SOPS is a CLI tool for encrypting and decrypting configuration files (YAML, JSON, ENV, INI, and binary) while keeping keys and structure vi… | 95 | 23393 | stable |
| motdotla/dotenv Dotenv is a zero‑dependency JavaScript library that loads variables from a .env file into process.env. It also provides a CLI to run comman… | 75 | 20538 | active |
| direnv/direnv direnv is a shell extension that loads and unloads environment variables based on the current directory by evaluating an authorized .envrc … | 95 | 15498 | stable |
| bitnami/sealed-secrets A Kubernetes controller plus the kubeseal CLI that lets you encrypt Kubernetes Secrets into one-way encrypted SealedSecrets that are safe t… | 97 | 9300 | active |
| OpenBao OpenBao is an open-source, identity-based secrets management system for storing, distributing, and rotating sensitive data such as secrets,… | 94 | 8451 | active |
| MightyMoud/sidekick Sidekick is a Go CLI tool that turns a bare Ubuntu VPS into a production-ready application hosting platform, similar to fly.io or Heroku bu… | 40 | 7594 | active |
| external-secrets/external-secrets External Secrets Operator is a Kubernetes operator that synchronizes secrets from external secret management systems such as AWS Secrets Ma… | 95 | 6900 | stable |
| dotenvx/dotenvx Dotenvx is a secure, cross-platform CLI and SDK for managing .env files, adding encryption so secrets can be safely committed to git and de… | 90 | 5833 | active |
| dmno-dev/varlock Varlock is a CLI tool and library for managing environment variables and secrets via a typed .env.schema file, serving as a drop-in dotenv … | 83 | 4696 | active |
| dynaconf/dynaconf Dynaconf is a configuration management library for Python inspired by the 12-factor app guide. It supports multiple file formats (toml, yam… | 95 | 4332 | stable |
| sobolevn/git-secret git-secret is a bash-based command-line tool that encrypts private files with GPG public keys and stores them safely inside a git repositor… | 66 | 4048 | active |
| onecli/onecli OneCLI is an open-source platform that gives every employee a personal, sandboxed AI agent, with all tool calls routed through a gateway th… | 74 | 3511 | active |
| tellerops/teller Teller is an open-source, developer-first CLI secret manager written in Rust that fetches secrets from multiple providers (HashiCorp Vault,… | 48 | 3232 | active |
| Mic92/sops-nix sops-nix is a NixOS module that provides atomic, declarative secret provisioning based on Mozilla's sops. It decrypts sops-encrypted files … | 66 | 3172 | active |
| onetimesecret/onetimesecret A self-hostable web service for sharing sensitive information like passwords via single-use, self-destructing links. Written in Ruby with R… | 95 | 2958 | active |
| awnumar/memguard MemGuard is a pure Go library that securely stores sensitive information in memory, encrypting it with XSalsa20Poly1305 and bypassing the g… | 67 | 2760 | active |
| segmentio/chamber Chamber is a Go CLI tool for managing application secrets by storing them in AWS SSM Parameter Store (with S3 backend support). It lets tea… | 71 | 2615 | active |
| ryantm/agenix Agenix is a Nix library and CLI tool for managing age-encrypted secrets in NixOS and Home Manager using existing SSH public/private key pai… | 99 | 2516 | active |
| Infisical/agent-vault Agent Vault is an open-source HTTP credential proxy and vault by Infisical that sits between AI agents and the APIs they call. It stores cr… | 82 | 2362 | active |
| jdx/fnox fnox is a Rust CLI tool for managing secrets via encryption or cloud secret providers, storing them in a git-committed fnox.toml file. It s… | 81 | 2295 | active |
| Bank-Vaults Bank-Vaults is a CNCF Sandbox umbrella project of tools for cloud-native secret management with Hashicorp Vault. This repository provides t… | 88 | 2276 | active |
| betterleaks/betterleaks Betterleaks is a fast, configurable secrets scanner for finding leaked credentials in git repositories, filesystems, and platforms like Git… | 82 | 2198 | active |
| hashicorp/envconsul Envconsul is a Go CLI tool that launches a subprocess with environment variables populated from HashiCorp Consul key-value data and Vault s… | 83 | 2073 | active |
| jkroepke/helm-secrets helm-secrets is a Helm plugin that transparently encrypts and decrypts Helm value files using sops, allowing secrets to be safely stored in… | 99 | 2033 | active |
| 1Password/for-open-source 1Password for Open Source is a program that grants eligible open source projects a free 1Password Teams account for securely storing and sh… | 67 | 1982 | active |
| kapicorp/kapitan Kapitan is a Python CLI tool for templated, inventory-driven configuration management that compiles Jsonnet, Jinja2, Kadet, Helm, Kustomize… | 94 | 1932 | active |
| elasticdog/transcrypt A single Bash script that configures transparent encryption of sensitive files in a Git repository using Git's clean/smudge filters and Ope… | 74 | 1712 | stable |
| configu/configu Configu is an open-source ConfigOps infrastructure for managing and collaborating on software configuration data such as environment variab… | 68 | 1687 | active |
| docker/mcp-gateway A Docker CLI plugin (docker-mcp) that provides the Docker MCP Gateway for securely running and deploying Model Context Protocol (MCP) serve… | 72 | 1593 | active |
| kubernetes-sigs/secrets-store-csi-driver A Kubernetes CSI driver that mounts secrets, keys, and certificates from external secrets stores (Vault, Azure Key Vault, AWS Secrets Manag… | 94 | 1565 | stable |
| cachix/secretspec SecretSpec is a declarative tool and library for defining the secrets an application needs in a secretspec.toml manifest and resolving them… | 84 | 1564 | active |
| drduh/pwd.sh pwd.sh is a single Bash script that manages text secrets such as passwords using GnuPG symmetric encryption. Secrets are stored in randomly… | 86 | 1563 | active |
| Shopify/ejson EJSON is a Go CLI utility for managing encrypted secrets in JSON files using asymmetric elliptic-curve (NaCl Box) encryption. It lets teams… | 80 | 1481 | stable |
| OWASP/wrongsecrets OWASP WrongSecrets is a deliberately vulnerable Java application containing 50+ challenges that demonstrate how secrets are commonly miscon… | 97 | 1466 | active |
| docker/docker-credential-helpers A suite of Go programs that store Docker login credentials in native platform keystores (e.g., macOS Keychain, Windows Credential Manager, … | 95 | 1323 | active |
| hvac/hvac hvac is a Python 3.x client library for the HashiCorp Vault HTTP API. It lets Python applications authenticate to Vault and read, write, an… | 49 | 1321 | active |
| GoogleCloudPlatform/berglas Berglas is a command line tool and Go library for managing secrets on Google Cloud, encrypting them with Cloud KMS and storing them in Clou… | 91 | 1302 | active |
| google/secrets-gradle-plugin A Gradle plugin by Google that injects secrets from a properties file (like local.properties) not checked into version control into BuildCo… | 23 | 1288 | stable |
| pinterest/knox Knox is a self-hosted secret management service written in Go that stores, serves, and rotates secrets, keys, and credentials used by other… | 64 | 1271 | active |
| mongodb/kingfisher Kingfisher is an open-source, Rust-based secret scanner that detects leaked credentials in code, Git history, cloud storage, and developer … | 82 | 1260 | active |
| mittwald/kubernetes-replicator A custom Kubernetes controller written in Go that synchronizes Secrets, ConfigMaps, Roles, RoleBindings, and ServiceAccounts across namespa… | 78 | 1116 | active |
| laserlemon/figaro Figaro is a Ruby gem that provides simple, Heroku-friendly configuration for Rails applications using environment variables and a single Gi… | 42 | 3743 | maintenance |
| fugue/credstash CredStash is a Python CLI utility for managing and distributing shared credentials in the cloud, encrypting secrets with AWS KMS key wrappi… | 23 | 2064 | maintenance |
| Noovolari/leapp Leapp is a cross-platform Electron desktop app for managing and generating cloud credentials across multiple AWS and Azure accounts, with e… | 56 | 1773 | maintenance |
| mprimi/portable-secret Portable Secret is a tool that packs an encrypted payload and decryption JavaScript into a single self-contained HTML file, using the brows… | 32 | 1735 | maintenance |
| orta/cocoapods-keys A CocoaPods plugin that stores per-developer environment and application keys securely in the macOS keychain instead of source code. On pod… | 32 | 1547 | maintenance |
| cloud66-oss/habitus Habitus is a standalone command-line build flow tool for Docker that orchestrates chained, multi-step Docker image builds defined in a buil… | 23 | 1401 | maintenance |
| sorah/envchain envchain is a command-line tool that stores environment variables like API credentials in macOS Keychain or the D-Bus Secret Service (gnome… | 23 | 1331 | maintenance |
| dotenv-org/dotenv-vault dotenv-vault is a CLI and cloud service for syncing .env files across machines, environments, and team members, with encrypted .env.vault d… | 32 | 1247 | maintenance |
| earendil-works/gondolin Gondolin is a TypeScript library and CLI that runs untrusted AI-agent code inside fast local Linux micro-VMs (QEMU by default, optional lib… | 82 | 2281 | experimental |
| SécurixOS SécurixOS is a NixOS-based hardened Linux distribution for secure workstations, developed by the French DINUM for sysadmin, office, and dev… | 87 | 1136 | experimental |
| 99designs/aws-vault AWS Vault is a CLI tool that securely stores AWS IAM credentials in the operating system's native keystore (macOS Keychain, Windows Credent… | 46 | 8996 | abandoned |
| StackExchange/blackbox BlackBox is a CLI tool that uses GPG to encrypt specific files in a Git, Mercurial, Subversion, or Perforce repository so secrets are encry… | 10 | 6767 | abandoned |
| Keywhiz Keywhiz is a Java-based system for centrally storing, managing, and distributing secrets such as TLS keys, API tokens, and database credent… | 10 | 2622 | abandoned |
| external-secrets/kubernetes-external-secrets A Kubernetes controller that syncs secrets from external secret management systems like AWS Secrets Manager and HashiCorp Vault into native… | 10 | 2579 | abandoned |
| Caiyeon/goldfish Goldfish is a web-based UI and workflow tool for HashiCorp Vault, built with VueJS on the frontend and a Go backend using Vault's native AP… | 10 | 2128 | abandoned |
| lyft/confidant Confidant is a secret management service from Lyft that stores secrets encrypted at rest in AWS DynamoDB, with a web UI and client tooling.… | 10 | 1853 | abandoned |
| zendesk/helm-secrets A deprecated Helm plugin that manages encrypted secrets files (YAML/JSON) within Git workflows, using SOPS as its backend for per-value enc… | 10 | 1146 | abandoned |
| NetBird NetBird is an open‑source zero‑trust networking platform that creates a WireGuard‑based overlay network for secure private connectivity. It… | 92 | 29443 | active |
| Teleport Teleport is an identity-aware access proxy and certificate authority that provides unified, credential-free access to SSH servers, Kubernet… | 88 | 20995 | stable |
| Windmill Windmill is an open-source, self-hostable developer platform that turns scripts in Python, TypeScript, Go, Bash, SQL and other languages in… | 96 | 18219 | active |
| Dagger Dagger is a programmable automation engine for building, testing, and shipping software, replacing YAML pipelines with real code via SDKs i… | 94 | 16334 | active |
| yc-software/qm QM is a self-hostable multiplayer agent harness that lets every employee in a company work with AI agents in personal and shared scopes acr… | 80 | 15434 | active |
| semaphoreui/semaphore Semaphore UI is an open-source, self-hosted web UI and API for running Ansible playbooks, Terraform/OpenTofu/Terragrunt, Bash, PowerShell, … | 92 | 14201 | active |
| Encore Encore is an open-source infrastructure SDK and backend framework for TypeScript and Go that lets developers declare resources like databas… | 95 | 12446 | active |
| AGWA/git-crypt git-crypt is a command-line tool that provides transparent encryption and decryption of selected files in a git repository. It lets teams s… | 39 | 9943 | active |
| Nasiko-Labs/nasiko Nasiko is a developer control plane for AI agents, built in Rust, that lets teams deploy, route, secure, and observe A2A-speaking agents wi… | 57 | 7324 | active |
| Shuttle Shuttle is a Rust-native cloud development platform and framework that lets developers build and deploy backends without writing infrastruc… | 10 | 6926 | active |
| Passbolt Passbolt Community Edition API is the JSON backend for the open source, security-first password manager for teams, built in PHP on CakePHP.… | 96 | 6136 | stable |
| AidLux (AidLearning) AidLux (originally AidLearning) is an AIoT development platform that runs a native Ubuntu Linux environment with GUI, deep learning tooling… | 63 | 5812 | active |
| agentscope-ai/AgentTeams AgentTeams is an open-source collaborative multi-agent runtime platform that orchestrates multiple Agent containers using a Manager-Workers… | 81 | 5698 | active |
| ThreatMapper Deepfence ThreatMapper is an open-source Cloud Native Application Protection Platform (CNAPP) that hunts threats in production cloud, Kuber… | 78 | 5324 | active |
| SaladDay/cc-switch-cli A cross-platform CLI and interactive TUI tool for managing configurations of AI coding assistants like Claude Code, Codex, and Gemini CLI. … | 76 | 5181 | active |
| cloudflare/workers-sdk The Cloudflare Workers SDK is a monorepo containing Wrangler, the official CLI for building, testing, and deploying Cloudflare Workers serv… | 95 | 4612 | active |
| nolabs-ai/nono nono is a Rust-based CLI and SDK that runs AI coding agents and their tool invocations in ephemeral, kernel-enforced micro sandboxes with c… | 76 | 4273 | active |
| octelium/octelium Octelium is a free, open-source, self-hosted unified zero trust secure access platform built on Kubernetes. It can operate as a remote acce… | 87 | 4107 | active |
| Boundary HashiCorp Boundary is an identity-aware proxy that provides secure, least-privilege access to hosts and critical systems across clouds and … | 10 | 4067 | active |
| Metorial Metorial is an open-source identity and access control plane for AI agents, providing 1200+ verified MCP integrations with centralized auth… | 63 | 3356 | active |
| jasypt-spring-boot A Spring Boot integration of the Jasypt library that enables transparent encryption and decryption of property sources in Spring Boot appli… | 62 | 3086 | active |
| jenkinsci/configuration-as-code-plugin The Jenkins Configuration as Code (JCasC) plugin lets administrators configure Jenkins controllers and plugins via human-readable declarati… | 99 | 2795 | active |
| cloudflare/gokey gokey is a vaultless password manager written in Go that deterministically derives passwords and cryptographic keys on the fly from a maste… | 73 | 2436 | stable |
| learnhouse/learnhouse LearnHouse is a next-generation open-source learning management system (LMS) for creating, sharing, and selling educational content. It com… | 100 | 2404 | active |
| 1backend/1backend 1Backend is an AI-native microservices platform written in Go that combines a framework, proxy, and runtime for building distributed applic… | 70 | 2349 | active |
| nottelabs/notte Notte is a full-stack framework and cloud platform for building, deploying, and scaling AI web agents and browser automations. It combines … | 85 | 2040 | active |
| sniptt-official/ots OTS is a Go CLI tool for sharing end-to-end encrypted secrets (API keys, passwords, signing secrets) via one-time URLs. Secrets are destroy… | 34 | 1845 | active |
| stakpak/agent Stakpak is an open-source Rust CLI and autonomous agent that runs on your machines 24/7 to keep applications running, handling tasks like a… | 71 | 1803 | active |
| kimdre/doco-cd Doco-CD is a lightweight GitOps continuous deployment tool written in Go that automatically deploys and updates Docker Compose projects and… | 87 | 1741 | active |
| fabro-sh/fabro Fabro is an open-source workflow orchestration engine that runs AI coding agents as version-controlled workflow graphs defined in Graphviz … | 76 | 1702 | active |
| dyne/tomb Tomb is a minimalist command-line tool for GNU/Linux that creates and manages encrypted storage folders ('tombs') using dm-crypt and LUKS v… | 54 | 1596 | stable |
| lakekeeper/lakekeeper Lakekeeper is an Apache Iceberg REST Catalog implementation written in Rust that provides centralized access control, credential vending, a… | 93 | 1483 | active |
| webfactory/ssh-agent A GitHub Action that starts ssh-agent on the workflow runner, exports SSH_AUTH_SOCK, and loads one or more private SSH keys from repository… | 75 | 1483 | active |
| infrahq/infra Infra is an open-source authentication and access management service for servers, Kubernetes clusters, and databases. It provides identity-… | 68 | 1468 | active |
| fabriziosalmi/certmate CertMate is a self-hosted certificate lifecycle management platform that issues and renews TLS certificates via ACME/Let's Encrypt across 2… | 83 | 1466 | active |
| getporter/porter Porter is a CNCF Sandbox CLI tool that packages applications, client tools, configuration, and deployment logic into CNAB-based installers … | 86 | 1429 | active |
| cloudposse/atmos Atmos is an open-source CLI runtime for infrastructure that orchestrates Terraform, OpenTofu, Kubernetes, Helm, and containers through decl… | 96 | 1405 | active |
| paradigmxyz/centaur Centaur is a self-hosted, open-source platform for running shared AI agents for teams, triggered via Slack mentions or an API. Each convers… | 78 | 1393 | active |
| pipe-cd/pipecd PipeCD is a GitOps-style continuous delivery platform that provides a unified deployment and operations experience for applications across … | 96 | 1358 | active |
| FreeIPA FreeIPA is an integrated security information management solution providing centralized identity, authentication, and access control for Li… | 77 | 1295 | stable |
page 1 / 2 next →