You might also find sops more user friendly for teams
I never understand why people go all in on cloud based password stores or identify for that manner
https://github.com/mozilla/sops
In Seriously, What is the best way to save passwords?getsops
sops
Go2015–2026
getsops / sops
sops
Simple and flexible tool for managing secrets
81Distinct people
95Mentions
2Explicit recommenders
23.7KGitHub stars
What to know before exploring
What it is
Simple and flexible tool for managing secrets
GitHub
Where it is used
No documented product use was verified in the last source check.
What people are saying
I recommend against with using secrets managers as opposed to config files for storing configuration. Ideally, your configuration is versioned and code-reviewed. Config files…
xvector used a recommendation phrase. 2 indexed comments match. This is a phrase match, not a verdict.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
- agwa/git-crypt · linked in 4 of the same discussions
- filosottile/age · linked in 2 of the same discussions
Mentioned in the same Hacker News threads. That is not proof they are substitutes.
This week on Hacker News
Nov 8–Nov 15 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/15/2026, 9:28:18 AM UTC.
No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.
Mentions over time
HN mentions by year95 dated mentions
Observed mentions: 2015-11-01 16:14:34 UTC to 2026-08-28 16:57:09 UTC.
* An incomplete calendar period is marked with an outlined bar. Its count is not directly comparable with a full period.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| 2015 | 2015-01-01 00:00:00 UTC | 2016-01-01 00:00:00 UTC | 4 | 2 | 2 |
| 2016 | 2016-01-01 00:00:00 UTC | 2017-01-01 00:00:00 UTC | 4 | 1 | 3 |
| 2017 | 2017-01-01 00:00:00 UTC | 2018-01-01 00:00:00 UTC | 5 | 2 | 3 |
| 2018 | 2018-01-01 00:00:00 UTC | 2019-01-01 00:00:00 UTC | 6 | 1 | 5 |
| 2019 | 2019-01-01 00:00:00 UTC | 2020-01-01 00:00:00 UTC | 1 | 0 | 1 |
| 2020 | 2020-01-01 00:00:00 UTC | 2021-01-01 00:00:00 UTC | 14 | 2 | 12 |
| 2021 | 2021-01-01 00:00:00 UTC | 2022-01-01 00:00:00 UTC | 4 | 1 | 3 |
| 2022 | 2022-01-01 00:00:00 UTC | 2023-01-01 00:00:00 UTC | 9 | 2 | 7 |
| 2023 | 2023-01-01 00:00:00 UTC | 2024-01-01 00:00:00 UTC | 15 | 1 | 14 |
| 2024 | 2024-01-01 00:00:00 UTC | 2025-01-01 00:00:00 UTC | 16 | 0 | 16 |
| 2025 | 2025-01-01 00:00:00 UTC | 2026-01-01 00:00:00 UTC | 9 | 2 | 7 |
| 2026 (partial) | 2026-01-01 00:00:00 UTC | 2027-01-01 00:00:00 UTC | 8 | 0 | 8 |
From the project README
An excerpt from the repository, fetched Nov 13, 2026.
Read the project’s introduction
SOPS: Secrets OPerationS
SOPS is an editor of encrypted files that supports YAML, JSON, ENV, INI and BINARY
formats and encrypts with AWS KMS, GCP KMS, Azure Key Vault, HuaweiCloud KMS, age, and PGP.
(demo)
Documentation
You can find the SOPS documentation on getsops.io under "Docs".
Security
Please report any security issues privately using GitHub's advisory form.
License
Mozilla Public License Version 2.0
Authors
SOPS was initially launched as a project at Mozilla in 2015 and has been
graciously donated to the CNCF as a Sandbox project in 2023, now under the
stewardship of a new group of maintainers.
The original authors of the project were:
Adrian Utrilla @autrilla
Julien Vehent @jvehent
Furthermore, the project has been carried for a long time by AJ Bahnken @ajvb,
and had not been possible without the contributions of numerous contributors.
Credits
SOPS was inspired by hiera-eyaml,
credstash,
sneaker,
password store and too many years managing
PGP encrypted files by hand...
We are a Cloud Native Computing Foundation sandbox project.
Read the full README on GitHubWhat Hacker News says
9 sourcesI recommend against with using secrets managers as opposed to config files for storing configuration. Ideally, your configuration is versioned and code-reviewed. Config files are optimal. Even secrets used by your deployment should be stored in configuration - encrypted, of course. The benefit of versioned configuration files, secrets included, cannot be overstated.
You can encrypt sensitive configuration fields with tools like `mozilla/sops` [1], which will reach out to your KMS or secrets manager of choice to encrypt/decrypt sensitive fields on the fly.
This way, you are minimizing the splitting of state across secrets managers and your code. Your configuration is stored at code, code reviewed, and versioned, which has devops and security benefits of its own.
[1]: https://github.com/mozilla/sops
In A not so unfortunate sharp edge in PipenvFor encrypted secrets in git I'd suggest looking at sops and password store:
https://github.com/mozilla/sops
https://github.com/android-password-store/Android-Password-S...
Both are extremely useful secrets oriented git tools with support for things like PGP encryption. Both will encrypt with multiple keys too, making sharing relatively easy. The android pass app even manages SSH keys for pushing and pulling. There may be good inspiration in those repos, or even code you can borrow.
Also, thanks so much for making this: it is elegant and lovely. Keep it up!
In GitJournal: Mobile first Markdown notes synchronized with GitMozilla SOPS, a tool for encrypting secrets for storage in source control systems, lets you encrypt secrets using the Shamir Sharing Threshold. You can use (and mix and match!) keys stored in of the first-party cloud secrets managers (AWS Secrets Manager, GCP KMS, Azure Key Vault), Hashicorp Vault, GnuPG, or Age.
Various IaC ecosystems have integrations for it. It's probably the best way to store secrets for Nix-based deployments, and there are also docs and integrations that pair it up with Kubernetes and Terraform.
Idk how many companies are really using keygroups, though. Probably in some of them, the repos are public and can tell you that.
https://github.com/mozilla/sops
In How to Share a Secret [pdf] (1979)i’ve used `pass` for 4-ish years now. i stopped last month. the interactions between pass and gpg-agent are too opaque for someone who’s not a regular PGP user. what happens when i let my PGP key expire? what’s the right way to share passwords between multiple machines — can i just clone the ~/.gnupg folder, do i need to `export` and then `import` the keys? should i create subkeys for each machine?
i want my password manager to be decently transparent, because if i misunderstand its failure modes that’s a big deal.
anyway, i’m using SOPS now [1]. it comes with a different set of tradeoffs (doesn’t integrate with keyrings quite as well as GPG does), but it’s way more transparent and pluggable. i generate distinct pubkey/privkey pairs per logical user and i can grant any subset of keys access to specific secrets. so e.g. my desktop and lapt
Read the rest
op can decrypt my banking secrets, but my phone cannot. i have a nightly backup cronjob which has to run unattended: i encode my Backblaze API key to the `duplicity` user’s privkey, and can safely check the encoded key into public repos and such. it’s simple and easy to grok. more so than pass, IMHO.
1: https://github.com/mozilla/sops
How does it compare to https://github.com/mozilla/sops?
In Show HN: Scrt – A secret manager for the command lineCovered by the guide: see https://github.com/drduh/YubiKey-Guide#using-keys and look for "Encrypt a message to your own key".
Also, sops (https://github.com/mozilla/sops) works with gpg and so with Yubikeys.
In Guide to Using YubiKey for GPG and SSHMozilla SOPS looking for a new maintainer
4 points · Open discussionMozilla SOPS is looking for new maintainers
7 points · Open discussion