Dynv vs Infisical: an honest comparison
Short answer: Infisical is a larger, more established product with open source, self-hosting, dynamic secrets, approval workflows and SSO today. Dynv is younger and smaller, and differs in two ways: its server cannot read your values or names (client-side encryption), and it updates running processes in about a second through a supervising agent and SDKs. Choose Infisical if you need its breadth or want to self-host. Consider Dynv if the encryption model and live delivery matter more.
Disclosure: we make Dynv. Everything about Infisical below comes from its own pricing page and documentation, read on 2026-11-01 and linked; where we couldn’t verify something we say so. We have not run Infisical ourselves for this post. Prices change; check the linked pages.
At a glance
| Infisical | Dynv | |
|---|---|---|
| Encryption model | Server-side: its security overview says the server “securely retrieves and decrypts requested data” (docs). It supports external KMS and HSM on its Enterprise tier (pricing) | Client-side: values and names are encrypted on your machine; the server holds ciphertext and metadata (security) |
| Open source / self-host | Open source (public repository); Enterprise tier lists self-hosting or dedicated infrastructure | Hosted only today; self-hosting is on the roadmap (marked planned on our pricing page) |
| Updating running apps | Agent daemon renders secrets into files or templates and can run a command on change; documented default polling interval 5 minutes (agent docs). Kubernetes operator syncs secrets and can reload deployments (docs) | dynv run supervises your process: restart-mode variables restart that process; hot variables update in place through an SDK in about a second (demo) |
| Dynamic secrets | Yes, on its Advanced tier | No |
| Rotation | Secret rotation is listed from its Pro tier; we did not evaluate which systems it supports | Rotation across services from the CLI, with a preview, propagation tracking, optional fallback windows and rollback until the window ends (demo); rotation policies and reminders are coming soon |
| Honey tokens / canaries | 3 on Pro, 10 on Advanced, unlimited on Enterprise | Canary secrets: tripwire tokens, URL, DNS and database-URL kinds, with alerts without names (guide) |
| SSO | SAML on Pro | Coming soon |
| Approval workflows, SCIM, audit streaming | Enterprise tier | Planned (see our pricing page); not available |
| Vulnerability monitoring of running services | Not listed on its pricing page | Yes: installed-package monitoring with instant and six-hourly checks (docs) |
| Process firewall | Not listed | Yes, with documented limits (tested run) |
| AI agents | We did not evaluate its agent features | Local MCP server: read-only by default, masked values, previews (guide) |
| Team workspaces | Mature, with roles and environments | Opt-in and newer; some features owner-only in organizations for now |
Pricing, from both pages
- Infisical (billed annually unless noted): Free with 5 identities; Pro $20 per identity per month ($23 billed monthly); Advanced $40 ($46 monthly); Enterprise custom. An “identity” is “any human or machine that authenticates to Infisical,” so CI jobs and services count (pricing).
- Dynv: early access is free and billing is not live. The prices at general availability, which count active services and people (humans, not AI agents or CI), are on our pricing page; we’re not copying them here so they can’t go stale.
Because the unit differs (identities versus services plus people), compare using your own counts: how many humans, how many machines and services you run.
Where Infisical is ahead today
- Breadth. Dynamic secrets, approval workflows, access requests, LDAP, SCIM, SIEM streaming, KMS/HSM support and SOC 2 Type II are listed on its pricing page. Dynv has none of these today.
- Self-hosting and open source. If you must run it yourself, or need to read the code that handles your secrets, Infisical gives you that now.
- Maturity and integrations. Its pricing page lists 100+ integrations and native syncs to platforms such as GitHub, Vercel, AWS and Kubernetes; Dynv has far fewer integrations.
- SSO. SAML is available on its Pro tier; Dynv’s SSO is coming soon.
Where Dynv differs
- The server can’t read your values or names. If your threat model includes the vendor’s servers or database being compromised, a client-side model changes what an attacker gets (what zero-knowledge means). The cost is that anything needing plaintext runs on your machines, not ours, and lost keys can’t be recovered by us.
- Live delivery into running processes without a redeploy, with change events your code can react to, rather than a polling agent that re-renders files.
- Security tooling built around the running service: monitoring of installed packages, malicious-package alerts, a process firewall and canaries, in the same product.
What we couldn’t compare
- We did not test Infisical’s performance, reliability, agent behaviour or its newer features, and make no claims about them beyond its own pages.
- We did not evaluate how Infisical’s encryption works beyond the security overview, and we do not claim it lacks any property it has not documented.
- A feature table is not a decision. Run each tool against your own service for an afternoon.
Moving between them
Dynv’s importer can read through a locally installed, already-authenticated Infisical CLI (dynv admin import <service> --from infisical --project <id> --config <environment> --dry-run); nothing is sent to Dynv in plaintext. We did not run it against an Infisical project for this post. See the migration walkthrough for the general steps.
Facts last verified . Spotted an error? Tell us.