Doppler vs OpenBao
Doppler
doppler.com
OpenBao
openbao.orgSide by side
| Figure | Doppler | OpenBao |
|---|---|---|
| Price from | $8/mo | Free |
| Free plan | — | Yes |
| Free trial | Yes | — |
| Open source | — | — |
| Web | Yes | Yes |
| Windows | Yes | Yes |
| macOS | Yes | Yes |
| Linux | Yes | Yes |
| API | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 3 | 1 |
| Spec score · Secrets Management Tools | 8.6 (#2) | 8.0 (#12) |
| Deployment | Doppler describes deployment options in the cloud or on-prem. | OpenBao can be installed through package managers, container registries, precompiled binaries, source builds, or Helm for Kubernetes. |
| Encryption | Doppler states that it encrypts and tokenizes customer secrets and uses AES-256-GCM encryption. | OpenBao can encrypt and decrypt data without storing it, using centrally defined encryption parameters. |
| Founded | 2018 | 2023 |
| Integrations | Listed integrations include AWS Secrets Manager, Terraform Cloud, GitHub Actions, Kubernetes, GCP Secret Manager, Azure Key Vault, Vercel, and Okta. | The project lists integrations including Sigstore for artifact signing, StackHPC for OpenStack, and Percona for database encryption key management. |
Plans
In their own words
Doppler
Doppler is a secrets manager for storing and managing sensitive application secrets through a dashboard, API, and command-line tool. It centralizes secret management with config syncs, secret referencing, and automatic rotation on eligible plans. Its MCP server lets AI agents request secrets natively, and Doppler says per-seat pricing adds no fees for AI agents or other non-human identities. Developers can use a CLI, SDKs, API, webhooks, and a VS Code extension with two-way sync. Listed integrations include AWS Secrets Manager, Terraform Cloud, GitHub Actions, Kubernetes, GCP Secret Manager, Azure Key Vault, Vercel, and Okta. Security controls include scoped tokens, fine-grained access, breach detection, encrypted fallback files, and trusted IP allow lists. Doppler says it encrypts and tokenizes secrets using AES-256-GCM and is SOC 2 and ISO 27001 certified. Deployment is available in the cloud or on-prem. The Developer plan is free for three users, with additional users at $8 a month. Team costs $21 per user per month and is free for 14 days. Enterprise pricing is custom.
OpenBao
OpenBao is a free, open-source system for storing and controlling access to secrets such as API tokens, encryption keys, passwords, and certificates. Management is available through a web UI, CLI, or HTTP API. Key/value secrets are encrypted before persistent storage, while dynamic credentials can be generated for Kubernetes and SQL databases and revoked when leases expire. Leases can be renewed, and individual secrets or groups can be revoked. OpenBao also encrypts and decrypts data without retaining it. Authentication methods include GitHub, LDAP, and AppRole, with token-based policies. Its storage barrier uses AES-256-GCM and verifies authentication tags during decryption. High-availability configurations are supported. Deployment options include packages, containers, binaries, source builds, and Helm; documentation covers Linux, macOS, FreeBSD, and Windows. Releases provide GPG signatures and SBOMs. Integrated Storage defaults to a 1 MiB maximum entry size, configurable with max_entry_size.