Doppler alternatives in 2026: what to compare, and when Dynv fits
Short answer: Doppler is a strong, mature product, and for many teams it is the right choice. Look at alternatives when you want one of these: per-machine pricing instead of per-seat, a self-hostable or open-source option (Infisical), a cloud-provider-native store (AWS Secrets Manager), encryption where the vendor cannot read your values, or values that update in running processes without a restart. Dynv is built for the last two and is earlier in its life than the others.
Disclosure: we make Dynv, so we are not neutral. We read every price and capability below from the vendor’s own pages on 2026-11-01 and link them; where we could not verify something, we say so. Prices change, so check the linked page before deciding. Where a competitor is better than Dynv today, we say that too.
What people switch away from Doppler for
The common reasons, and what they imply for the alternative you pick:
| Reason | What to look for |
|---|---|
| Per-seat cost as the team grows | Pricing by something other than humans (services, machines), or a free tier that fits |
| Self-hosting or data location | A self-hostable edition; Doppler lists on-prem on its Enterprise plan (pricing) |
| Vendor can read secrets | Client-side (zero-knowledge) encryption |
| Restarts and redeploys to change a value | Live delivery into running processes |
| AI agents with access to secrets | Masking, scoping and previews for agents |
| Fewer moving parts | Cloud-native store, or a single CLI |
Prices, read from the vendors (2026-11-01)
| Free tier | First paid tier | Metric | |
|---|---|---|---|
| Doppler | Developer: free for 3 users, $8/mo per additional user | Team: $21/mo per user | Human seats; the page says AI agents and non-human identities are free (source) |
| Infisical (cloud) | Free: 5 identities | Pro: $20/identity/mo billed annually, $23 billed monthly; Advanced $40 annual / $46 monthly | Identities: “any human or machine that authenticates” (source) |
| AWS Secrets Manager | see AWS’s free tier terms on the page | $0.40 per secret per month, plus $0.05 per 10,000 API calls | Per secret and per call (source) |
| Dynv | Early access is free | Planned prices are on our pricing page; billing is not live yet | Active services plus human seats |
How to read this: Doppler and Infisical look similar per head, but they count different things. A team with ten developers and many CI jobs, services and agents pays for the machines at Infisical and not at Doppler, by the vendors’ own definitions. Run your own numbers: count humans, machines and secrets. For a hyperscaler store the bill depends on secret count and read volume, not people. We have not compared enterprise or on-prem quotes because they are not public.
What each alternative does better than Dynv today
Doppler (the incumbent):
- A broad, mature product with the features teams ask for in procurement. Its Team plan lists SAML SSO, change requests, role-based access controls, automatic secret rotation and 90 days of activity logs, and it has an official MCP server and many integrations (pricing page). Dynv’s team features and SSO are coming soon, not available.
- On-prem or cloud on Enterprise.
Infisical:
- Open source (its repository is public) and self-hostable; its Enterprise tier lists self-hosting or dedicated infrastructure (pricing).
- A wider feature set today: its pricing page lists dynamic secrets, honey tokens (fake credentials that alert when used), approval workflows and SIEM streaming on the paid tiers. Dynv’s canary secrets are coming soon.
- Its published security notes say the server decrypts data it retrieves from storage (“the server securely retrieves and decrypts requested data”) (security overview). That is an encryption-at-rest model with a trusted server, which is a legitimate design with different trade-offs from client-side encryption. We did not find a zero-knowledge claim in that document, and don’t make one for them.
AWS Secrets Manager (and the other cloud stores):
- Native IAM, CloudTrail and rotation for AWS services, no extra vendor, and pricing that is tiny at small scale (the AWS page’s own example puts 15 secrets and about 4,000 calls at $6.02 a month).
- Not cross-cloud, and not a workflow for developers’ local environments or for updating running processes.
Where Dynv is different (live today)
- The server cannot read your values. Encryption and decryption happen on your machine; the server stores signed ciphertext and metadata (security model). A database dump shows no names or values.
- Live updates. Mark a variable hot and a running Node, Python or Go service receives the change in about a second without a restart; other variables restart cleanly under
dynv run(demo). - Agents. A local MCP server that is read-only by default, with masked values, per-key write allow-lists and dry runs (guide).
- Rotation across services, previewed, including same-value copies under other names (demo).
- Vulnerability monitoring of what your services have installed, re-checked at boot, on change and every six hours, with count-only alerts (how it works).
And the costs of that design: a zero-knowledge server cannot search or process your values, so rotation hooks that need plaintext run on your machines rather than ours; writes come from one writer machine; and Dynv is young. It has fewer integrations, no SSO yet, and team workspaces are coming soon.
Decision guide
| If you need… | Consider |
|---|---|
| A broad, proven, per-seat product with SSO and integrations today | Doppler |
| Open source, self-hosting, dynamic secrets | Infisical |
| Everything inside AWS with IAM | AWS Secrets Manager |
| The vendor unable to read values; live updates; agent-safe access; you’re a small team or solo and fine being early | Dynv |
Moving from Doppler
Dynv’s importer can read through a locally installed, already-authenticated Doppler CLI and encrypt on your machine; nothing is sent to Dynv in plaintext. Preview first:
dynv admin import web --from doppler --project my-project --config prd --dry-run(Flags from dynv admin import --help: --from doppler, --project, --config, --dry-run. We did not run this against a Doppler account.) Then see the migration walkthrough for the rest of the cutover, and rotate any secret you no longer want the old vendor to hold.
Verification notes
- Doppler plan facts: doppler.com/pricing, read 2026-11-01. The page’s comparison table lists the Developer plan’s user limit in more than one place; we quote the headline “free for 3 users.”
- Infisical plan facts: infisical.com/pricing and its security overview, read 2026-11-01.
- AWS: pricing page, read 2026-11-01.
- Told us something is wrong? Email us; we will check and fix it.
Facts last verified . Spotted an error? Tell us.