SOPS
A command-line editor for encrypting secrets inside YAML, JSON, ENV, INI or binary files — using AWS KMS, GCP KMS, Azure Key Vault, age or PGP — so encrypted config can be safely committed to git.
🔗 Visit SOPS
Description
Storing passwords or API keys directly in a config file is risky, but managing a separate secrets vault for every project is a lot of overhead. SOPS solves this in between: it lets you keep your config files exactly where they already are — including in git — but automatically encrypts only the values (not the structure), so the file stays readable as YAML or JSON while the actual secrets are unreadable to anyone without the right key.
SOPS supports YAML, JSON, ENV, INI and binary formats, and can encrypt with AWS KMS, GCP KMS, Azure Key Vault, age, or PGP — including using multiple keys at once so a team or CI pipeline can decrypt without sharing a single master key. It edits files in place (sops file.yaml decrypts, opens your editor, then re-encrypts on save), integrates cleanly into infrastructure-as-code pipelines, and is a CNCF Sandbox project (donated by Mozilla) with active governance. It's free, open source under MPL 2.0, with 22.9k GitHub stars.
💬 Our review
The short version: if your team currently keeps secrets in a shared password manager, a Slack DM, or (worse) plaintext in a private repo, SOPS lets you commit encrypted secrets alongside your code and infrastructure config instead, decrypting them only at deploy time.
Against HashiCorp Vault, SOPS is dramatically simpler to adopt — there's no server to run, no API to integrate, just a CLI that wraps your existing cloud KMS; the tradeoff is that Vault offers dynamic secrets and fine-grained audit logging that SOPS doesn't attempt to replicate. Against a lighter tool like age used alone, SOPS adds the crucial ability to encrypt only specific values inside a structured file rather than the whole file, so diffs in git stay meaningful. Being a CNCF Sandbox project gives it a level of governance and longevity assurance that most infrastructure tooling doesn't have. The main cost is a real setup investment — key management across AWS/GCP/Azure KMS has a learning curve — but for any team managing secrets across multiple environments and cloud providers, that investment pays off quickly.
💰 Pricing
📊 Global score
🤖 AI-enriched data
Projet open source (MPL 2.0), aucune offre payante — dépend uniquement du coût du KMS cloud utilisé
Pros
Chiffrement multi-cloud (AWS KMS, GCP KMS, Azure Key Vault, Huawei)
Chiffre uniquement les valeurs, garde la structure du fichier lisible
Projet CNCF Sandbox avec gouvernance solide
Édition directe des fichiers chiffrés sans étape de déchiffrement manuel
22 900+ étoiles, écosystème large
Cons
Nécessite une infrastructure de gestion de clés séparée (KMS)
Courbe d'apprentissage pour la configuration initiale
Peut être excessif pour une application simple sans infra cloud