HashiCorp Vault vs AWS Secrets Manager vs Doppler: Secrets Management Pricing

HashiCorp Vault vs AWS Secrets Manager vs Doppler: Secrets Management Pricing

A secrets platform is a meter before it is a product. AWS counts secrets and API calls. Doppler counts people. Vault Dedicated counts the cluster you run plus every application, service, and user that signs in to it.

This guide prices all three on the same three profiles, with every rate from the vendors' own pricing and documentation pages read on 2026-11-11. Profile S (small team): 100 secrets, 10 calls per secret per day, 5 users, 10 clients. Profile M (growing team): 1,000 secrets, 20 calls, 10 users, 25 clients. Profile L (platform team): 10,000 secrets, 40 calls, 25 users, 100 clients. User and client counts are stated assumptions, not vendor quotes. One figure set carries a caveat: HashiCorp's pricing page returned a rate-limit challenge twice on 2026-11-11, so the Vault hourly rates and per-client fee are corroborated-secondary, confirmed by three independent reads.

The three meters on one page

AWS scales with secret count and read volume; Doppler with headcount, ignoring secret count; Vault with cluster size and every identity that authenticates.

AWS Secrets Manager: the per-secret meter

AWS charges $0.40 per secret per month and $0.05 per 10,000 API calls, with no up-front cost and no long-term contract. A secret is one stored item: a database credential, an API key, an OAuth token. The call meter counts reads and writes, including rotation calls — at 20 calls per secret per day it adds $0.003 per secret per month, under 1 percent of the charge.

S: 100 secrets cost $40.00 and 30,000 calls cost $0.15, for $40.15 a month. M: 1,000 secrets cost $400.00 and 600,000 calls cost $3.00, for $403.00 a month. L: 10,000 secrets cost $4,000.00 and 12,000,000 calls cost $60.00, for $4,060.00 a month. That last figure is AWS's own Example 4 — 10,000 secrets at 40 calls a day, totaling $4,060.00.

Rotation comes in two forms. Managed rotation covers managed secrets — the service configures and runs it, with no Lambda involved. Everything else rotates through a Lambda function you own. Rotating creates a new version, and AWS does not charge for new versions.

Secrets are encrypted with Key Management Service keys: the managed key aws/secretsmanager is free, while keys you create yourself are charged at current KMS rates. Every API call is logged by CloudTrail as a management event, the first copy free; you pay only for extra S3 storage, notifications, or additional trails. New customers get up to $200 in Free Tier credits from July 15, 2025.

Doppler: the per-seat meter

Doppler charges per person, not per secret: Developer is free for 3 users with $8 a month for each additional user; Team is $21 a month per user with a 14-day free trial; Enterprise is custom pricing. AI agents and non-human identities ride free.

Developer caps at 25 users, 10 projects, 4 environments, 10 configs per environment, 5 config syncs, 50 service tokens, and 3 days of logs, with no automatic rotation. Team raises those caps to 500 users, 250 projects, 15 environments, 100 configs, 100 syncs, and 500 service tokens, with 90 days of logs, automatic rotation, SAML SSO, role-based access controls, trusted IPs, and priority support. Enterprise adds dynamic secrets, Enterprise Key Management, proxied rotation, SCIM, on-prem deployment, log forwarding, custom retention and rate limits, and a 99.95 percent service level objective. Dynamic secrets — credentials generated on demand with a short life — are Enterprise-only.

At the three profiles, Team costs $105.00 a month for 5 users, $210.00 for 10, and $525.00 for 25. Developer costs $16.00, $56.00, and $176.00 — but Profile L sits exactly at Developer's 25-user cap, with 10 projects and 5 config syncs, so the cheap plan runs out of room where a platform team lives. Team add-ons also move the bill: custom roles, user groups, and extra integration syncs each cost $9 per seat per month on top of the $21.

HashiCorp Vault Dedicated: the cluster-plus-client meter

Vault Dedicated is a managed, single-tenant Vault Enterprise cluster on AWS or Azure, billed hourly, in three tiers. Development is a single node for sandboxing, limited to 25 clients, with no production SLA, high availability, audit logging, or snapshot restore. Essentials is the production entry point — highly available, 99.9 percent SLA, Silver Support, audit and telemetry streaming, backup and restore. Standard adds governance and scaling, including performance replication and control groups.

The meter has two parts: an hourly cluster base that varies by tier, size, and region, plus a flat-rate hourly cost per Vault client on Essentials and Standard. A client is any unique application, service, or user that authenticates, counted once per monthly billing period — a pod that signs in once counts for the whole month. Corroborated rates: Essentials Small $1.58 an hour (~$1,153 a month), Standard Small $1.84 an hour (~$1,343 a month), and $72.92 a month per client; the full table is in the capture above. One discrepancy is flagged honestly: HashiCorp's own Flex consumption table lists $1.647 an hour for Standard Small in us-west-1, against $1.84 in the guide this article corroborates from. Verify the Standard rate live before signing; Essentials $1.58 agrees exactly across every read.

The cluster base is $1.58 times 730 hours, or $1,153.40 a month. Add clients: 10 add $729.20 (S: $1,882.60 a month); 25 add $1,823.00 (M: $2,976.40); 100 add $7,292.00 (L: $8,445.40). At 100 clients, size up to Medium at $3.16 an hour ($2,306.80 a month), lifting L to $9,598.80. The client meter overtakes the cluster meter at 16 clients, and by 100 clients it is more than three times the cluster cost.

What Vault sells for that floor is control no per-secret meter offers. Dynamic secrets are its core idea: instead of storing a database password, Vault generates a credential on demand, hands it out with a lease, and revokes it automatically when the lease expires. The consumer must check in to renew or request a replacement, which makes key rolling routine and turns the audit log into a record of live access. Vault also supports HSM and KMS auto-unseal, so the cluster starts without an operator typing unseal keys. HCP Vault Secrets, the old SaaS-only product, was sunset in mid-2025 — Dedicated is now the managed Vault to buy.

The head-to-head at three profiles

Year 1 is the monthly total times 12. S: $481.80 (AWS), $1,260.00 (Team), $192.00 (Developer), $22,591.20 (Vault). M: $4,836.00, $2,520.00, $672.00, $35,716.80. L: $48,720.00, $6,300.00, $2,112.00, $115,185.60 on a Medium Vault cluster. Read the table by what grows: AWS with secrets, Doppler with people, Vault barely at all.

Where the lines cross

At 20 calls per secret per day, each AWS secret costs $0.403 a month ($0.40 for the secret plus $0.003 for its calls). A 10-person team on Doppler Team pays $210.00 a month, so the lines meet at 521 secrets: below that Doppler Team is cheaper, above it AWS is cheaper. Against Vault's floor — Essentials Small plus 10 clients at $1,882.60 a month — AWS meets it at about 4,671 secrets. Vault's cluster base alone, $1,153.40 a month, equals Doppler Team at about 55 users. The lines cross where they do because each meter grows on a different axis: secrets for AWS, people for Doppler, clients for Vault.

Who each platform fits — and who should walk away

AWS Secrets Manager fits a team already living in AWS: the secrets sit next to the databases and services that use them, rotation is managed, and the bill tracks the estate secret by secret. It does not fit a team that needs dynamic, short-lived credentials, or one that runs multi-cloud.

Doppler fits a team whose secret count is large and whose headcount is small: five people with 2,000 secrets pay $105.00 a month on Team while AWS would charge $806.00. It does not fit a team that needs dynamic secrets or HSM-backed key management without Enterprise custom pricing.

Vault fits a team that needs dynamic secrets, short leases, and HSM-backed unseal as the core of its security posture, and that can staff it: policies, namespaces, auth methods, and unseal management are real work even on the managed tier. It does not fit a small team that only needs static secrets — the floor is $1,882.60 a month before a single secret is read.

Moving from one to another: the migration sequence

Switching secrets platforms is a credential rotation exercise with a billing change attached. Do it in this order, and keep the old platform until the last step passes.

1. Inventory every secret: name, owner service, rotation schedule, and readers.
2. Stand up the new platform beside the old one with the same structure: projects or paths, environments, and access policies.
3. Migrate the lowest-risk secrets first — CI tokens and API keys — and point one service at the new platform.
4. Watch the new platform's audit log for a full rotation cycle to confirm reads, writes, and rotation land.
5. Move database credentials next, one service at a time, rotating each as it moves.
6. Re-point the remaining services in batches, keeping the old platform read-only.
7. Run both platforms for one full billing month and compare the new bill against the forecast.
8. Delete the old platform's secrets only after every service has run a full week on the new one with no fallback reads.

Before you sign

• [x] Count all three meters: secrets, people, and authenticating clients.
• [x] Check the Vault client census: every pod, container, CI runner, and user at $72.92 a month each.
• [x] Check Doppler's plan caps: Developer stops at 25 users, 10 projects, 5 syncs, no automatic rotation.
• [x] Check whether you need dynamic secrets: Enterprise pricing on Doppler, core on Vault, not the product on AWS.
• [x] Verify the Vault Standard rate live: $1.84 an hour here is corroborated-secondary; HashiCorp's Flex table says $1.647.
• [x] Price the add-ons: Doppler's three $9 per seat add-ons can more than double a Team bill.
• [x] Confirm the KMS and audit costs: customer-managed KMS keys bill at KMS rates; CloudTrail extras bill for S3.
• [x] Run the crossover math on your counts: 521 secrets against Doppler Team, 4,671 against the Vault floor.

The choice is a meter, not a brand. Under about 521 secrets with a 10-person team, Doppler Team is the cheapest honest option. Past that line, AWS is cheaper until the estate needs what only Vault sells: credentials that live for minutes, die on their own, and leave a lease record behind. Past about 4,671 secrets, Vault's floor looks proportionate — but only if the team uses the dynamic secrets and HSM control it buys. Pay for the meter that matches how your estate grows, and re-count every year. The Terraform versus Pulumi versus AWS CDK infrastructure-as-code pricing playbook prices the tooling that provisions these platforms, the Supabase versus Firebase versus PlanetScale backend platform pricing guide prices the databases whose credentials these platforms guard, the Datadog versus Grafana Cloud versus New Relic observability pricing playbook prices the audit and monitoring that watches them, and the ROI calculator turns any of these monthly totals into a return comparison.