Infisical alternatives for automatic secret rotation

Updated October 2026

Infisical's free plan has no rotation at all. Its paid rotation starts at $20 per identity a month for database secrets only, and $40 per identity a month for full rotation. If rotation is the feature you're after, it's worth seeing what else exists before paying per identity for it.

Here's what Infisical charges, and three real alternatives.

What Infisical charges, for the record

Infisical's free plan covers 5 identities, 3 environments, and 10 secret syncs, with no rotation included. Pro is $20 per identity a month billed annually, and only covers rotation "for public databases." Full secret rotation across every type doesn't show up until the Advanced plan, $40 per identity a month. (Infisical's pricing page, checked October 24, 2026)

The identity count is the part that catches people. Every human and every machine, including each CI job and each service, counts as its own identity. A two-service app with one developer can burn through the free plan's 5 identities faster than it sounds like it should.

Alternative 1: Doppler

Doppler is the other big hosted vault, and it has the same shape as Infisical. The free Developer plan, up to 3 users, does not include rotation. Rotation is a Team-plan feature, $21 a month per user after a 14-day trial. (Doppler's pricing page, checked October 24, 2026)

Pick Doppler over Infisical if you'd rather not self-host and you want a slightly simpler per-seat model instead of per-identity counting. Neither one rotates for free. See the full Doppler alternatives roundup for more on this comparison.

Alternative 2: AWS Secrets Manager

If your app already runs on AWS, Secrets Manager charges $0.40 per secret a month plus $0.05 per 10,000 API calls, with rotation included at no extra charge. AWS's own pricing page says rotating a secret creates a new version you aren't billed for separately, checked October 24, 2026.

There's no free tier, but there's also no per-identity counting. The cost is that you write and run the rotation Lambda yourself, for each type of secret.

Alternative 3: Key Robot

Key Robot isn't a vault, open source or otherwise. It doesn't ask you to store a secret anywhere, and it doesn't count identities. It runs from your own GitHub Actions, makes a new key for a connected service every day, checks that your app still works, and deletes the old one. If the check fails, it puts the old key back by itself. A Kill it now button handles a leaked key outside the daily cycle. Our own test kit runs 8 checks on every service we support, and it caught a bug in our own code where Kill it now kept the leaked secret working as a backup value. We fixed it before launch.

It's free for one app, no card, and it never stores a key itself. Keys are locked in your browser before anything is sent. Today it covers Neon, Resend and Supabase keys, for apps on Netlify or Vercel, with Cloudflare and OpenAI built and being tested.

The verdict

Pick Infisical if self-hosting matters to you and you're fine paying per identity once rotation is the feature you need.

Pick Doppler if you want a hosted vault with simpler per-seat pricing instead of per-identity counting, and rotation can live behind the same Team-plan fee.

Pick AWS Secrets Manager if you're already on AWS and willing to write your own rotation code per secret type.

Pick Key Robot if you don't want a vault, an identity count, or a per-seat bill. You just want a key to actually change on a schedule, using infrastructure you already have. See the rotate hub for which services it covers today, and the ranked list of rotation tools for how it stacks up against everything else here.