Comparison
Shortspan vs Infisical
Infisical and Shortspan cover similar ground - application secrets plus access to servers, databases, and cloud accounts. Infisical covers more of it today, and its core is open source. Here is where each one stands.
The short answer
Infisical is the broader, more mature platform: an MIT-licensed core you can self-host, dynamic secrets, rotation, PKI, and a privileged access product with session recording, SSO, and a SOC 2 report. Shortspan is narrower - one CLI for secrets, SSH, databases, AWS, and Kubernetes, with access requests and approval-gated runbooks under one published team price.
Choose Infisical if
- You want open source you can self-host for free.
- You need dynamic secrets, secret rotation, or certificate management.
- You need session recording for SSH, databases, or RDP.
- You need SAML SSO, SCIM, or LDAP.
- You need RDP, Windows, SQL Server, MongoDB, or Redis access.
- You need a vendor with a SOC 2 Type II report.
Choose Shortspan if
- You want secrets and infrastructure access in one product and one plan, rather than separately priced products.
- You want to reach servers with the SSH credentials they already accept, with no gateway to deploy.
- You want versioned, approval-gated runbooks for deploys and routine operations.
- A flat team price suits you: Team is $49 per month · 5 users included.
Side by side
Infisical and Shortspan, capability by capability.
| Capability | Infisical | Shortspan |
|---|---|---|
| Primary job | Secrets management, PKI and certificate management, and privileged access management as separate products in one platform. Source | One broker for application secrets and infrastructure access (SSH, databases, AWS, Kubernetes), used from a single CLI. |
| How it runs | Infisical Cloud in US and EU regions, or self-hosted. Source | Hosted service. Self-hosting is listed as coming soon for Enterprise. Source |
| Source code and licence | Open core: MIT licence outside the | Proprietary. The source code is not public. |
| Pricing | Secrets: Free (5 identities), Pro $20 and Advanced $40 per identity per month billed annually. Privileged access: Pro $20 per user per month. Enterprise is quoted. Source | Free for one user. Pro $12 per month. Team $49 per month · 5 users included. Enterprise is quoted. |
| Application secrets | Its core product, with CLI injection ( | Encrypted, versioned, project-scoped secrets with typed templates and named groups injected into a process with |
| Credentials generated per request | Dynamic secrets from the Advanced plan; rotation (for public databases) from Pro. Its access product mints a short-lived SSH certificate per session. Source | No. Stored credentials are released for a short-lived grant; the credential itself stays valid until you rotate it. Dynamic credentials are listed as coming soon. Source |
| SSH server access | Privileged access product: certificate-based SSH through a browser terminal or the CLI, with a gateway for private networks. Source | Brokers the stored key or password into the CLI’s memory for one session. Nothing is installed on the server, and traffic does not pass through Shortspan. Per-server host-key pinning, exec, and port-forwarding policy. Source |
| Database access | Privileged access product: PostgreSQL, MySQL, SQL Server, MongoDB, and Redis. Source | PostgreSQL and MySQL. Connects directly, through a registered SSH bastion, or by running the client on the server. Source |
| Kubernetes access | Privileged access product covers Kubernetes clusters; an operator also syncs secrets into clusters. Source | Releases a stored kubeconfig to a temporary file for one subshell and removes it on exit. Source |
| AWS access | Time-bound AWS IAM, GCP, and Azure access through the privileged access product. Source | Releases stored AWS access keys into one subshell’s environment; nothing is written to ~/.aws. It does not mint temporary STS credentials. Source |
| Access requests with approval | Access requests with approval in the privileged access product (Pro); secrets approval workflows on Enterprise. Source | Yes, on the Team plan. A required reason, a 1–72 hour window, approval by someone else, and automatic expiry. Source |
| Session recording | Privileged access product records sessions: command logs for SSH, query logs for databases, video for RDP. 30-day retention on Pro. Source | No. SSH session contents are not recorded; Shortspan records that a session was opened and how long the command ran. Listed as coming soon. Source |
| SAML / OIDC single sign-on | SAML SSO from the Pro plan; LDAP and SCIM on Enterprise. Source | Not yet. Sign-in is password plus optional TOTP or passkeys. SAML, OIDC, and SCIM are listed as coming soon. Source |
| Audit log | Audit logs: 30-day retention on Pro, 90 on Advanced, streaming and custom retention on Enterprise. Source | Append-only, including refusals, on the Team plan. Records that a credential was released, never its value. Source |
| Approved operational runbooks | Not an Infisical feature. | Versioned runbooks with optional approval before each run. Steps run on the executor’s machine and are not sandboxed. Source |
| Independent compliance report | States SOC 2 Type II, HIPAA, and FIPS 140-3 compliance. Source | None yet. Controls are built with SOC 2 in mind, but no audit has been completed. Source |
Every claim on this page - about Shortspan and about the other products - was checked against the linked public source on . Products change; if something here is out of date, tell us at info@shortspan.dev and we will correct it.
Where they differ
Breadth
Infisical is three products in one platform - secrets management, certificate management, and privileged access - each priced separately. Its secrets product has SDKs, integrations, rotation, and dynamic secrets; its access product covers SSH, RDP, Kubernetes, cloud identities, and five database engines, with session recording.
Shortspan does fewer things: stored secrets with CLI injection, brokered SSH, PostgreSQL and MySQL, AWS, and Kubernetes access, time-boxed access requests, runbooks, and an audit log. It has no dynamic secrets, rotation, PKI, or session recording.
How access works
Infisical’s access product mints a short-lived SSH certificate per session and uses an outbound-only gateway to reach private networks, which also lets it record sessions.
Shortspan releases the stored key or password into the CLI’s memory for one recorded session and connects directly or through an SSH bastion you registered. Nothing new runs on your network, but the credential is long-lived until you rotate it, and session contents are not recorded.
Open source and hosting
Infisical’s core is MIT-licensed and free to self-host, with enterprise features under a separate licence, and Infisical Cloud runs in US and EU regions.
Shortspan is proprietary and hosted. Self-hosting is listed as coming soon for Enterprise.
Pricing
Infisical’s secrets product is priced per identity - $20 per month on Pro, billed annually - and its access product is $20 per user per month on Pro. Shortspan’s Team plan is $49 per month · 5 users included and includes every capability Shortspan has at that tier. Compare against the features you need, not only the headline number.
Common questions
Infisical or Shortspan?
- Is Infisical open source?
- Its core is, under the MIT licence; code in its
ee/directories is under a commercial licence. The core can be self-hosted at no cost. - Does Shortspan have dynamic secrets like Infisical?
- No. Shortspan stores the credentials you register and releases them for authorized, recorded sessions. Dynamic credentials are listed as coming soon.
- Do I need a gateway or agent to use Shortspan with private servers?
- No. The CLI connects with the credentials the server already accepts, directly or through an SSH bastion you registered in Shortspan.
Keep comparing
Related comparisons
Try it on one project.
The free plan is enough to register a server and a secret and see whether the workflow fits.