Doppler alternatives: where to go and how to move your secrets cleanly
Seven destinations, one for each reason to leave, and a seven-step migration plan.
The short answer: Infisical if you want the closest match, with a built-in Doppler import and an MIT-licensed core you can self-host; Bitwarden Secrets Manager if per-seat pricing is why you're leaving; AWS Secrets Manager or Azure Key Vault if your whole infrastructure already lives on that cloud; OpenBao (or HashiCorp Vault) if you want to run everything yourself, dynamic secrets included; Akeyless for a managed service with a generous free tier; dotenvx if you'd rather keep encrypted files in Git. One thing to weigh first: Doppler bills humans only. Machine identities are free. Some of these alternatives bill both. We compared all seven and their migration paths in 2026.
The ranking is editorial: a sponsored spot is always labeled on its card, and no affiliate link changes a score.
Why teams move off Doppler
Developers generally like Doppler. Forum threads call it super easy to set up, and that holds up: one command and your environment variables show up in your app. So people rarely leave over the developer experience. They leave over the bill, the hosted-only model, and a few limits that show up as the team grows.
Seat pricing that jumps fast
The Developer plan is free for 3 users, then $8 per month for each extra user. Team is $21 per user per month for everyone. A 10-developer team on Team pays $210 a month. One reviewer summed it up: quite expensive for a mid-sized business.
Tight caps on the entry plan
Developer stops at 25 users, 10 projects and 4 environments. An agency running one project per client, or a team with extra staging environments, hits those walls before it has a real budget. The only next step is Team.
A short activity log
The activity log (who read or changed which secret) keeps 3 days on Developer and 90 days on Team. An incident spotted a week later on the free plan has already lost its trail. Longer retention means Enterprise, with custom pricing.
Hosted only, no self-hosting
Doppler only runs as a hosted service. There's no version you can install on your own servers. For some teams, handing every production key to a third party is a non-starter. It was the top objection on the original launch thread, and it still comes up.
A network dependency
doppler run calls the API when your app starts. The CLI keeps an encrypted fallback file, and users have long asked for a real offline mode and a looser cache. If a service restarts during an outage, that fallback file is what saves you, or doesn't.
Access control that feels coarse
Even happy users say permissions could be more fine-grained. Giving a contractor access to one config and nothing else often means a higher plan. Teams already on AWS or Azure have fine-grained access built in, and start asking why they pay for another layer.
You're leaving because… go with…
Usually one row fits. If two do, the first one tends to win: price triggers most departures. Each card jumps to the full write-up below.
Native Doppler import, MIT core you can self-host.
Per-seat pricing is the problemBitwarden Secrets ManagerFree for 2 users, Teams at $6 per user.
Your whole infrastructure is on AWSAWS Secrets Manager$0.40 per secret per month, IAM permissions.
You want to self-host, dynamic secrets includedOpenBaoOpen-source Vault fork, free, on your servers.
Your company runs on AzureAzure Key VaultPay per operation, $0.03 per 10,000.
You don't want another service at alldotenvxEncrypted .env files committed to Git.
Doppler alternatives, tool by tool
For each tool: why move to it, who it fits, its catch, how to migrate from Doppler, and what it costs. Prices are what the vendor lists in 2026, in USD, before tax. Each score out of 5 weighs three things: how easy the move from Doppler is, the price for a 5 to 25 developer team, and the ops load. One rule before you compare: Doppler counts people, while some alternatives count every identity, human or machine. Run the numbers with your real count of service accounts.
Infisical: the closest match, with a built-in Doppler import
Easiest moveWhy move to Infisical. It's the only tool on this list that can pull your secrets straight out of Doppler. The model will feel familiar: projects, environments, syncs to your platforms. The real difference is the license. Infisical's core is MIT-licensed and free to self-host, so you can start on the cloud version and bring it in-house the day trusting a vendor becomes an issue.
Who it's for. Dev teams that like Doppler's workflow but want an exit from hosted-only, or want dynamic secrets (credentials created on demand, then revoked) and automatic rotation.
Who it's not for. Teams with lots of service accounts and few humans. Infisical bills every identity, human or machine. Your 15 deploy bots were free on Doppler. Here, each one is a line item.
The catch. The free tier caps at 5 identities and 3 environments, with no rotation, no dynamic secrets and no SSO. Pro is $20 per identity per month billed yearly ($23 monthly), and rotation plus dynamic secrets sit on Advanced at $40 ($46 monthly). Do the math: 10 developers and 5 service accounts on Pro run $300 a month, versus $210 on Doppler Team for the same 10 people.
How to migrate to Infisical. Create a Doppler token (personal or service), then add it in Infisical as a Doppler app connection. In your project, add secrets, pick the option to add from Doppler, choose the Doppler project and config, and run the import. Each import takes one config into one environment: 3 projects with 4 configs each means 12 imports. Root and branch configs are both supported. The docs don't say how duplicates or secret references are handled, so run one sample config first.
Price. Free up to 5 identities, Pro at $20 per identity per month billed yearly, Advanced at $40, Enterprise on quote. 30-day trial, no card.
- Free
- 5 identities, free self-hosting
- Paid
- Pro $20/identity/mo, yearly
- Score
- 4.4/5
- Catch
- machines are billed too
Bitwarden Secrets Manager: the lowest bill for a team
CheapestWhy move to Bitwarden Secrets Manager. Price. Teams is $6 per user per month against Doppler Team's $21. For 10 developers, the bill drops from $210 to $60 a month. Secret storage is unlimited, and the vendor's password manager is often already in the company. If you're also leaving Bitwarden on the password side, our Bitwarden switching guide covers that half.
Who it's for. Small teams storing static secrets (API keys, database passwords, tokens) who want a simple bill. The free plan covers 2 users, 3 projects and 3 machine accounts, enough for a side project.
Who it's not for. Teams that want dynamic secrets or automatic rotation. And teams that relied on Doppler syncing to ten platforms: Bitwarden is leaner there.
The catch. Machine accounts are counted. Teams includes 20, then $1 each per month. Enterprise, at $12 per user, includes 50 machine accounts and adds SSO, SCIM provisioning and self-hosting. Listed prices are in USD, billed annually, taxes not included.
How to migrate to Bitwarden Secrets Manager. There's no Doppler import. Export each Doppler config as JSON and recreate the secrets in a Bitwarden project with a short script. Create one machine account per app, scoped to its own project, and swap your Doppler service tokens for those accounts in CI.
Price. Free for 2 users, Teams at $6 per user per month, Enterprise at $12.
- Free
- 2 users, 3 projects
- Paid
- Teams $6/user/mo
- Score
- 4.0/5
- Catch
- no dynamic secrets
AWS Secrets Manager: cut out the middleman
For AWS shopsWhy move to AWS Secrets Manager. Plenty of teams sync Doppler into AWS Secrets Manager and have their services read from AWS. One of them said it plainly in a forum thread: maybe Secrets Manager alone would do it for them. If your apps already run on AWS, you drop a hop, a bill and a failure point. Access goes through IAM, which your team already knows.
Who it's for. Teams whose production lives entirely on AWS, with few developers to serve locally. New AWS customers get up to $200 in Free Tier credits.
Who it's not for. Multi-cloud teams, or teams attached to Doppler's local experience (one command and your variables are there). AWS gives you no turnkey equivalent on a developer laptop.
The catch. You pay per secret: $0.40 per secret per month, plus $0.05 per 10,000 API calls. And you lean harder into AWS lock-in.
How to migrate to AWS Secrets Manager. Export each Doppler config as JSON and store it as is in a single JSON secret. That's the trick that changes the bill: 300 values stored one by one cost $120 a month, while the same values grouped into 12 secrets (3 projects, 4 configs) cost $4.80. In your app, read the secret at startup in place of doppler run. If you automate AWS with Make, our Make scenarios for AWS KMS and secrets show examples.
Price. $0.40 per secret per month, $0.05 per 10,000 calls, nothing per user.
- Price
- $0.40/secret/mo
- API calls
- $0.05 per 10,000
- Score
- 4.3/5
- Catch
- AWS lock-in
OpenBao or HashiCorp Vault: run it all yourself
Fully self-hostedWhy move to OpenBao or Vault. It's the most direct answer to "Doppler is hosted only." Your secrets stay on your servers, and you gain things Doppler doesn't do: dynamic secrets (database credentials created for an hour, then revoked), encryption as a service, leases with a lifetime. OpenBao is the open-source fork of Vault, MPL 2.0, free. Vault Community stays free for internal use under the BSL.
Who it's for. Teams that already have someone running infrastructure, and for whom trusting a third party is the real reason to leave.
Who it's not for. Small teams that picked Doppler precisely to avoid running anything. Here you handle unsealing after restarts, storage, upgrades and access policies. If nobody wants the pager, skip it.
The catch. OpenBao has no official managed offering. On the Vault side, HCP Vault Dedicated runs about $450 a month for a development cluster alone, more than Doppler Team for 20 people. Our guide to switching from HashiCorp Vault breaks down both options.
How to migrate to OpenBao. No Doppler import. Export each config as JSON, then write it to the key-value engine, one path per project and config (for example project/production). Create a policy and an auth method per app, then replace doppler run with the agent or an API call at startup.
Price. OpenBao is free, and so is Vault Community for internal use. Your real cost is servers and team time.
- License
- MPL 2.0 (OpenBao)
- Price
- free, self-hosted
- Score
- 4.5/5
- Catch
- you run everything
Azure Key Vault: the native vault for Microsoft shops
For Azure teamsWhy move to Azure Key Vault. Same logic as AWS: if your apps run on Azure, Key Vault already sits next to them. It also handles keys and certificates, which Doppler doesn't.
Who it's for. Companies already on Microsoft 365 and Azure, where the security team would rather use a service from the same provider than audit one more tool.
Who it's not for. Developers who want an interface built for them, with environments and branches like Doppler. Key Vault is a vault, not a config manager.
The catch. No built-in concept of environments: you create one vault per environment or encode it in secret names. And no Vault-style dynamic secrets.
How to migrate to Azure Key Vault. Export each Doppler config as JSON, then create one Azure secret per value with a script. Keep one config per vault (a production vault, a staging vault) to preserve the access split Doppler gave you. In your app, read secrets at startup in place of doppler run.
Price. Pay as you go: $0.03 per 10,000 secret operations. No per-user price.
- Operations
- $0.03 per 10,000
- Users
- not billed
- Score
- 4.2/5
- Catch
- no built-in environments
Akeyless: a managed service with a real free tier
Generous free tierWhy move to Akeyless. You keep the comfort of a managed service, with a free tier that goes further than Doppler's on one point: dynamic secrets and rotation are included, in small amounts. It also pitches itself against Doppler on deployment, with a hosted or hybrid model.
Who it's for. Teams that want to try dynamic secrets without standing up a cluster, or that connect few clients (5 clients, 500 static secrets, 5 dynamic secrets and 5 rotations on the free tier).
Who it's not for. Anyone leaving Doppler over price who wants to know the bill before migrating. Beyond the free tier, Akeyless lists no prices.
The catch. The free tier keeps 3 days of logs, same as Doppler Developer. Enterprise is quote-only: get a written number before you commit.
How to migrate to Akeyless. No Doppler import. Export each config as JSON and recreate the secrets with a script, keeping one folder per project and environment. Start with one project to check you stay under the free tier's 500 static secrets.
Price. Free within the limits above, Enterprise on quote.
- Free
- 5 clients, 500 static secrets
- Paid
- Enterprise on quote
- Score
- 3.9/5
- Catch
- no public paid pricing
dotenvx: encrypted .env files, no service to pay for
No serviceWhy move to dotenvx. It's a different philosophy. Instead of trusting a service with your secrets, you encrypt your .env files and commit them to Git next to your code. No API call at startup, no third-party outage to fear. The User plan is free.
Who it's for. Solo developers or very small teams with one or two projects, who mainly used Doppler to share variables between a laptop and production.
Who it's not for. Teams that need an activity log, per-person permissions or rotation. With encrypted files, whoever holds the decryption key reads the whole file.
The catch. When a developer leaves, you rotate keys and secrets: they still have a clone of the repo. And managing the decryption keys (where they live, who has them) becomes your problem.
How to migrate to dotenvx. Export each Doppler config in env format straight to your project's .env location, encrypt it with dotenvx right away, then make sure no plaintext version got committed. Keep the decryption key in your CI secrets, never in the repo.
Price. User at $0, Member at $5 a month, Business at $90 a month, extra seats at $15 a month.
- Free
- User plan at $0
- Paid
- Member $5/mo, Business $90/mo
- Score
- 3.7/5
- Catch
- no per-person permissions
Doppler and 7 alternatives side by side
Our default pick: Infisical if you want the same workflow plus a path to self-hosting, Bitwarden Secrets Manager if price is the reason, your cloud's native vault if everything runs on one provider. Left column is the model, right column is the entry price and what changes versus Doppler.
| Model and hosting | Entry price and gap vs Doppler | |
|---|---|---|
| DopplerStarting point | Hosted only | Free for 3 users, Team $21/user/mo; machines free |
| InfisicalClosest match | MIT core, cloud or self-hosted | Pro $20/identity/mo; Doppler import built in, machines billed |
| Bitwarden Secrets ManagerCheapest | Cloud, self-hosted on Enterprise | Teams $6/user/mo; 20 machine accounts included |
| AWS Secrets ManagerOn AWS | AWS managed service | $0.40/secret/mo; no per-user price |
| OpenBao / VaultFully yours | MPL 2.0 (OpenBao), self-hosted | Free; dynamic secrets, you run it |
| Azure Key VaultOn Azure | Azure managed service | $0.03 per 10,000 operations; no environments |
| AkeylessGenerous free tier | Hosted or hybrid | Free for 5 clients; Enterprise on quote |
| dotenvxNo service | Encrypted files in Git | Free; Member $5/mo; no activity log |
Prices listed by vendors in 2026, in USD, before tax. Bitwarden prices are for annual billing. Always check the vendor's page before you sign.
Leave Doppler in seven steps
A botched secrets migration doesn't break anything on day one. It breaks on the next deploy, when a variable is missing, or three months later, when a key still live in Doppler leaks. These seven steps close both doors, in this order.
Inventory your whole Doppler workspace
FirstList every project, every root config (dev, staging, prod), every branch config and each developer's personal config. Also note secret references (a value that points to another one with ${...}), active syncs (Vercel, AWS, GitHub Actions…) and every service token in use.
That list sets the size of the job: one config means one export, one import and one check. Three projects with four configs each is 12 passes.
- Time
- half a day
- Output
- configs, syncs and tokens list
Export each config without creating an encrypted file
The command to remember: doppler secrets download --no-file --format json, run for each project and config (-p and -c). --no-file sends the output to stdout. Without it, the CLI writes an encrypted fallback file, with a passphrase derived from the config, which your destination can't read. It's the most common trip-up in user bug reports about exporting.
Doppler itself strongly recommends against writing plaintext secrets to disk. Pipe the output straight into your import script, or into a temp file you delete right after. Other formats exist (env, docker, yaml, dotnet-json) if your destination prefers them.
- Command
- doppler secrets download --no-file --format json
- Trap
- no --no-file means an encrypted file
Import into the destination, one config at a time
For Infisical, use the built-in import: one Doppler config per run, into the environment you choose. For everything else, a script reads the exported JSON and creates the secrets. On AWS, store each whole config as one JSON secret so you pay $0.40 per config instead of $0.40 per value.
Start with the dev config of a small project. Count keys before and after: the numbers must match.
- Infisical
- built-in import, one config per run
- Others
- script from the JSON
Replace doppler run everywhere it hides
Search your codebase for doppler run: start scripts, Dockerfiles, CI files (GitHub Actions, GitLab), Kubernetes operator manifests. Both doppler run -- command and doppler run -p PROJECT -c CONFIG -- command need to go. If you're changing CI as well, our guide to switching from GitLab helps in parallel.
Swap the Doppler service tokens stored in your CI variables for the new destination's credentials too.
- Search for
- doppler run, service tokens
- Where
- scripts, Dockerfiles, CI, Kubernetes
Turn off Doppler syncs
As long as a Doppler sync stays on toward Vercel, AWS or GitHub, it can overwrite a value you just changed in the new tool. Two sources fighting each other is the hardest outage to debug. Turn off each sync as soon as its target reads from the new source. If you're also leaving Vercel, keep our Vercel switching guide handy.
- When
- as each target switches
- Risk
- two sources overwriting each other
Rotate every secret and revoke the tokens
Every secret has lived in Doppler, on laptops, maybe in a fallback file on a former employee's machine (Doppler's own team acknowledged that at launch). Doppler itself recommends rotating secrets after a migration. Rotate every API key, database password and token, production first. Then revoke all Doppler service tokens.
- Order
- production first
- Then
- revoke Doppler tokens
Verify, clean up, then close the account
Compare key counts per config between Doppler and the destination. Check that every ${...} reference got resolved: a reference copied as is becomes a literal string, and your app boots with the wrong value. Then delete leftover .env files and fallback files on laptops and servers. Keep Doppler read-only for a week, then close it.
- Check
- key counts and references
- Clean
- .env and fallback files
Is your tool missing from this page? Email us: hello@hackceleration.com
What breaks a Doppler migration
None of these depend on the tool you pick. They're prep mistakes, and each one costs an evening of debugging.
Exporting without --no-file
You get an encrypted file only the Doppler CLI can open. You find out at import time, usually after announcing the cutover. Put the flag in your script from line one.
Leaving plaintext secrets on disk
A JSON export forgotten in Downloads is your whole production readable by anyone on that laptop. Use a pipe, or a temp file deleted in the same command.
Forgetting branch and personal configs
Branch configs inherit from the root but carry their own values. Export only the roots and a staging environment loses its settings. Work from the inventory, config by config.
Copying references without resolving them
A value holding ${OTHER_SECRET} means nothing outside Doppler. Check each reference after import, and run a sample config first, Infisical included.
Underestimating the new bill
Infisical bills each machine identity, AWS each secret. Ten developers plus five bots on Infisical Pro cost $300 a month; 300 values stored one by one on AWS, $120. Run your own numbers before you sign.
Skipping rotation after cutover
Migrating without rotating leaves a leak path open at the old vendor and on old laptops. Rotation is part of the migration, not a later project. If you automate deployments with Terraform, our Make scenarios for Terraform Cloud can help.
- Projects, configs, syncs and tokens listed
- Every config exported with --no-file
- No plaintext export left on any disk
- Key counts match before and after
- ${...} references checked
- doppler run removed from scripts, Dockerfiles and CI
- Doppler syncs turned off
- Every secret rotated, Doppler tokens revoked
Doppler alternatives: frequently asked questions
Is Doppler free?
Yes, for up to 3 users on the Developer plan. After that, each extra user is $8 a month, up to 25 users, 10 projects and 4 environments. The activity log only keeps 3 days. Worth knowing: machine identities (your deploy accounts) aren't billed.
How much does Doppler cost per user?
$8 per extra user per month on Developer (the first 3 are free), $21 per user per month on Team, custom pricing on Enterprise. For 10 developers that's $56 a month on Developer if you stay under 10 projects, or $210 on Team. The same team on Bitwarden Secrets Manager Teams pays $60.
Is there an open-source Doppler alternative?
Yes. Infisical is the closest, with an MIT-licensed core, projects, environments, syncs and a direct Doppler import. OpenBao is the pick if you also want dynamic secrets and encryption as a service, at the cost of running it. Note that Infisical's advanced features (rotation, dynamic secrets) stay paid, even self-hosted.
Can you self-host Doppler?
No. Doppler only runs as a hosted service, on every plan. If self-hosting is a requirement, look at Infisical (free to self-host), OpenBao (MPL 2.0) or Bitwarden Secrets Manager on Enterprise.
Doppler vs Infisical: which one?
Doppler if you run lots of machine accounts and don't mind a hosted vendor: machines are free there. Infisical if you want the option to self-host or need dynamic secrets. On price, it comes down to your human-to-machine ratio: 10 people and 5 bots cost $210 on Doppler Team, $300 on Infisical Pro.
Doppler vs AWS Secrets Manager?
AWS Secrets Manager if all your production runs on AWS: $0.40 per secret, nothing per user, and one less sync to babysit. Doppler if you value the local developer experience and ready-made environments. Tip: on AWS, a whole config in one JSON secret costs $0.40 a month.
How do you export secrets from Doppler?
Run
doppler secrets download --no-file --format env(orjson) with your project and config. Don't skip--no-file: without it you get an encrypted file. To write a .env file, redirect with> .env, and delete it as soon as the import is done.Can Infisical import from Doppler?
Yes. Infisical has a native Doppler import through an app connection that uses a Doppler personal or service token. Each run imports one config into one environment, and root and branch configs are supported. Test a sample config first to check how references come through.
What's the cheapest secrets manager for a small team?
For static secrets, Bitwarden Secrets Manager: free for 2 users, then $6 per user per month on Teams. If you're fully on AWS with few secrets, AWS Secrets Manager can cost a few dollars a month when you group values into JSON secrets. A solo developer can also run dotenvx's free plan.
Do you need to rotate secrets after migrating?
Yes, all of them. Doppler recommends it after a migration. Your secrets lived at the old vendor, on laptops and sometimes in fallback files. Start with production, then revoke every Doppler service token.
Get the next migration guide in your inbox
One tool to leave, one destination, one migration plan. Nothing else.