Alternatives
Doppler alternatives
Doppler is a capable secrets manager. People look elsewhere when they need to self-host, want open source, find per-user pricing expensive as they grow, or need more than application configuration.
Shortspan is one of the options below. It is listed with its limits, the same as everything else.
Why teams look
Hosting and source
Doppler is a proprietary hosted service; an on-premises option is listed only on its Enterprise plan. Teams that must keep secrets on their own infrastructure, or want source they can audit, look at open source options.
Per-user pricing
Doppler’s Developer plan is free for three users, then $8 per additional user per month; Team is $21 per user per month. That is good value for small teams, and grows linearly with headcount.
More than configuration
Doppler delivers secrets to applications. It does not broker SSH sessions, database connections, or cloud access for people, so teams with that problem need a second tool.
The shortlist
4 alternatives to Doppler
An open-core platform covering secrets management, certificate management, and privileged access, available as a cloud service or self-hosted.
Best for: The closest like-for-like alternative, with an MIT-licensed core you can self-host and an optional privileged access product.
Trade-offs: Pricing is per identity, and dynamic secrets start on its Advanced plan.
An identity-based secrets and encryption platform with pluggable secrets engines, including ones that generate short-lived credentials on demand.
Best for: Teams that need dynamic secrets, PKI, and encryption as a service, and can run or pay for a managed cluster.
Trade-offs: Far more to learn and operate than Doppler, and source available under the Business Source License rather than open source.
AWS’s managed secrets store, controlled with IAM and integrated with other AWS services.
Best for: Workloads that run on AWS and are already governed by IAM.
Trade-offs: No environment-centric workflow like Doppler’s, and pricing per secret and per API call.
A credential broker: secrets, SSH servers, databases, AWS accounts, and Kubernetes clusters are registered once, encrypted, and reached through one CLI, with every release recorded.
Best for: Teams that need SSH, database, AWS, and Kubernetes access for people alongside application secrets, with approvals and an audit trail. Team is $49 per month · 5 users included.
Trade-offs: No platform syncs, rotation, or SSO yet, no compliance report, proprietary, and hosted only for now.
At a glance
Doppler and its alternatives.
| Capability | Doppler | Infisical | HashiCorp VaultHashiCorp, an IBM company | AWS Secrets ManagerAmazon Web Services | Shortspan |
|---|---|---|---|---|---|
| How it runs | Hosted. The Enterprise plan lists an on-premises option. Source | Infisical Cloud in US and EU regions, or self-hosted. Source | Self-managed (Community or Enterprise), or HashiCorp-managed as HCP Vault Dedicated. HCP Vault Secrets stopped taking new customers on 30 June 2025. Source | A managed AWS service in your AWS account. | Hosted service. Self-hosting is listed as coming soon for Enterprise. Source |
| Source code and licence | The platform is proprietary. The CLI is open source under Apache 2.0. Source | Open core: MIT licence outside the | Source available under the Business Source License 1.1 since version 1.15; not an OSI open source licence. Each release converts to MPL 2.0 four years after publication. Source | Proprietary AWS service. | Proprietary. The source code is not public. |
| Pricing | Developer: free for 3 users, then $8 per additional user per month. Team: $21 per user per month. Enterprise is quoted. Source | Secrets: Free (5 identities), Pro $20 and Advanced $40 per identity per month billed annually. Privileged access: Pro $20 per user per month. Enterprise is quoted. Source | Community Edition is free to self-host. Vault Enterprise and HCP Vault Dedicated are commercial; see HashiCorp for current pricing. Source | $0.40 per secret per month plus $0.05 per 10,000 API calls. Source | Free for one user. Pro $12 per month. Team $49 per month · 5 users included. Enterprise is quoted. |
| Application secrets | Its core product. | Its core product, with CLI injection ( | Versioned key/value secrets engine, plus Vault Agent to render secrets into files or environments. Source | Its core product, read through the AWS SDKs, CLI, and integrations. Source | Encrypted, versioned, project-scoped secrets with typed templates and named groups injected into a process with |
| Credentials generated per request | Dynamic secrets on Enterprise. Automatic secret rotation from the Team plan. Source | Dynamic secrets from the Advanced plan; rotation (for public databases) from Pro. Its access product mints a short-lived SSH certificate per session. Source | Yes - its defining feature. Engines generate leased, revocable credentials for databases, AWS, Kubernetes, SSH, PKI, and more. Source | Automatic rotation: managed rotation for secrets owned by AWS services and partners, a Lambda function for the rest. It does not issue a new credential per request. Source | No. Stored credentials are released for a short-lived grant; the credential itself stays valid until you rotate it. Dynamic credentials are listed as coming soon. Source |
| SSH server access | Doppler can store an SSH key as a secret, but it does not broker SSH sessions. | Privileged access product: certificate-based SSH through a browser terminal or the CLI, with a gateway for private networks. Source | SSH secrets engine issues signed SSH certificates or one-time passwords. Servers are configured to trust Vault’s CA. Source | Stores keys as secrets; it does not broker SSH sessions. | Brokers the stored key or password into the CLI’s memory for one session. Nothing is installed on the server, and traffic does not pass through Shortspan. Per-server host-key pinning, exec, and port-forwarding policy. Source |
| Database access | Stores and rotates database credentials as secrets; it does not open database connections. | Privileged access product: PostgreSQL, MySQL, SQL Server, MongoDB, and Redis. Source | Database secrets engine creates per-lease database users for many databases through plugins. Connecting the client is up to you. Source | Stores and rotates database credentials; it does not open connections. | PostgreSQL and MySQL. Connects directly, through a registered SSH bastion, or by running the client on the server. Source |
| Access requests with approval | Change requests on Team and change-request policies on Enterprise - approval for changing secrets rather than for temporary access. Source | Access requests with approval in the privileged access product (Pro); secrets approval workflows on Enterprise. Source | Control groups add approval factors before a request is satisfied - Enterprise and HCP Vault Dedicated only. Source | Access is decided by IAM policy. There is no built-in request and approval workflow. | Yes, on the Team plan. A required reason, a 1–72 hour window, approval by someone else, and automatic expiry. Source |
Every claim on this page - about Shortspan and about the other products - was checked against the linked public source on . Products change; if something here is out of date, tell us at info@shortspan.dev and we will correct it.
How to choose
Start from what you actually use.
- If you need to self-host or want open source, start with Infisical.
- If you need dynamic secrets and are ready for a platform, consider Vault or Infisical’s Advanced plan.
- If everything runs on AWS, AWS Secrets Manager keeps you on one bill.
- If people - not only applications - need servers, databases, and cloud accounts, consider Shortspan or Infisical’s privileged access product.
Common questions
Moving off Doppler
- What is the best open source alternative to Doppler?
- Infisical is the closest: a similar developer workflow with an MIT-licensed core that can be self-hosted. Enterprise features are under a commercial licence.
- Can Shortspan replace Doppler?
- For storing secrets and injecting them into a process with a CLI, yes. For syncing secrets to platforms and CI, rotation, or SSO, not today - Shortspan has none of those yet.
Keep comparing
Related comparisons
See whether Shortspan fits.
The free plan is enough to register a server and a secret and try the workflow on one project.