Independent cybersecurity directory, built from public sources. Featured listings are paid placements and always labelled. How we work

SOPS

CLI tool for encrypting YAML/JSON/ENV files with KMS, age, or PGP

ToolSecrets ManagementSelf-hosted, Open source

Pricing: Free (open source)

Reviewed by the Cyber Vendor Guide editorial team against the public sources cited below · Last reviewed April 2026 · How we review listings

What is SOPS?

SOPS (Secrets OPerationS) is a command-line tool for editing encrypted files. It uses KMS keys (AWS KMS, GCP KMS, Azure Key Vault, HashiCorp Vault, age, or PGP) to encrypt only the values in YAML, JSON, ENV, or INI files. Leaving the keys readable so you can diff changes in Git. Originally created at Mozilla and now a CNCF Incubating project, SOPS is a favorite for teams that want encrypted-in-Git secrets without adopting a full operator.

Best for: Infrastructure-as-code teams that want encrypted-in-Git secrets with a simple CLI

Pros

  • Encrypted values + readable keys makes Git review actually work
  • No server or operator to run; pure CLI tool
  • Multi-key support makes sharing with teammates painless
  • Works with almost every KMS; vendor-agnostic

Things to check

  • Requires discipline: anyone can commit an unencrypted secret by accident
  • Key management is on you; rotating a compromised key is manual
  • Not a secrets manager; no audit trail of accesses
  • Only encrypts at rest in Git; runtime apps still need a way to decrypt

Reported in public reviews and vendor documentation. See sources below.

Key Features

Encrypts only values, leaves keys readable for diffs
Supports YAML, JSON, ENV, INI, and binary files
KMS providers: AWS KMS, GCP KMS, Azure Key Vault, Vault, age, PGP
Multiple key support per file (team member or automation key)
Path regex for selective encryption
Git-friendly: small diffs on encrypted-value changes
Integrations with Helm (helm-secrets), Terraform, Kustomize
CLI and Go library usage
Rotates keys without re-encrypting every file
CNCF Incubating project

Do you work at SOPS? to confirm the details or send us a correction.

Add the Cyber Vendor Guide badge to your site

Sources & references

Where the information on this listing comes from. Always verify pricing and capabilities against the vendor before a purchasing decision.

Spot an error, or do you represent SOPS? Request a correction.

Key facts

Pricing
Free (open source)
Model
Open Source
Founded
2015
Cloud
No
Self-hosted
Yes
Open source
Yes
Visit websiteView on GitHub

SOPS Alternatives

FeaturedSplitSecure
Distributed secrets management — no vault, no vendor depende...
Learn more
View all alternatives

Where SOPS appears

Guides

Shortlists