Open Source Secrets Manager
A secrets manager is a single point that, if it falls, exposes every credential your infrastructure runs on - the blast radius is the whole environment, so how it encrypts at rest, scopes access, and rotates keys matters more than any convenience feature. The open source systems here put that machinery in the open: you can read the encryption and access logic, host it inside your own trust boundary, and rotate or revoke without waiting on a vendor.
Vaultwarden
Self-hosted Bitwarden-compatible server in Rust, light enough to run where the official service is too heavy
HashiCorp Vault
Secrets management, encryption as a service, and privileged access management
Infisical
Open-source secrets, certificate, and privileged access management for teams and infrastructure
SOPS
Editor for encrypted YAML, JSON, ENV, INI, and binary files with KMS, age, and PGP
Bitwarden
Open-source password manager for passwords and passkeys, with clients for web, browser, desktop, and CLI
Sealed Secrets
Kubernetes controller and kubeseal tool for one-way encrypted Secrets
gopass
GPG-encrypted, git-versioned password manager for teams - a drop-in replacement for the standard UNIX pass
External Secrets Operator
Kubernetes operator that syncs values from external secret stores into Kubernetes Secrets
OpenBao
Open source secrets manager for storing, encrypting, leasing, and revoking sensitive data