Tools · SPBoucher
Menu

SOPS

by SOPS project (CNCF) · CLI tool · also known as Mozilla SOPS, Secrets OPerationS, getsops

Command-line tool that encrypts the values of YAML, JSON, ENV and INI files with age, PGP or cloud KMS keys so secrets can be committed to git

MPL-2.0 licenseOpen sourceFreeLocalSelf-hostable
Visit official site Compare

Link verified Nov 2, 2026

Overview

SOPS is an open-source editor and encryption tool, originally created at Mozilla and now hosted under the getsops organization as a CNCF project, licensed under MPL-2.0. It encrypts only the values of structured files, leaving keys and structure readable, so an encrypted Kubernetes manifest or .env file still diffs sensibly in version control. Data keys are wrapped by one or more master keys: age or PGP keys for offline use, or AWS KMS, Google Cloud KMS, Azure Key Vault and HashiCorp Vault for identity-based access in the cloud.

A .sops.yaml file maps path patterns to key sets, so a team can declare which identities may decrypt which files. sops edit opens the decrypted content in an editor and re-encrypts on save, sops exec-env runs a command with the decrypted values in its environment, and integrations exist for Flux, Helm, Ansible and Terraform.

It is a good fit for small teams who want secrets alongside code without running a server. It offers no dynamic secrets, rotation or audit trail beyond git history, and decrypted values end up on disk or in memory wherever they are used.

Capabilities

  • Value-level encryption of YAML, JSON, ENV, INI and binary files
  • Master keys from age, PGP, AWS KMS, GCP KMS, Azure Key Vault and HashiCorp Vault
  • Creation rules in .sops.yaml mapping paths to key groups
  • Editor workflow and exec-env/exec-file commands
  • Key rotation and multi-key groups with Shamir thresholds

Typical workflows

  1. Commit encrypted Kubernetes secrets to a GitOps repository
  2. Share a team .env file encrypted to each member's age key
  3. Decrypt configuration at deploy time with a cloud KMS identity

Strengths

  • No server to operate
  • Readable diffs of encrypted files
  • Works offline with age or PGP

Limitations

  • No dynamic secrets, rotation automation or access audit
  • Decrypted values live on the consuming host
  • Key management is left to the user or cloud KMS

Prerequisites

  • age or PGP key, or access to a cloud KMS

Who it is for

  • Developers practicing GitOps
  • Small teams avoiding a secrets server

Alternatives & comparison

Vault and Infisical centralize secrets in a service with access control and dynamic credentials; SOPS keeps them in the repository and relies on key custody. 1Password's CLI can play a similar injection role for teams already using it.

  • 1Password

    Password and secrets manager for individuals, families and businesses with end-to-end encrypted vaults, passkeys, an SSH agent and a developer CLI

    ProprietaryPaid
  • HashiCorp Vault

    Identity-based secrets manager providing encrypted key-value storage, dynamic database and cloud credentials, PKI and encryption-as-a-service, under the Business Source License

    Source-availableFree
  • Infisical

    Secrets, certificate and privileged-access management platform with an MIT-licensed core, available as a hosted service or self-hosted deployment

    MixedOpen source
Compare SOPS with its alternatives →

Sources & verification

Primary sources consulted for this record. Claims are tied to the fields each source supports; the automated link checker re-verifies every URL on a schedule.

  • License
    SOPS LICENSE (MPL-2.0)

    https://github.com/getsops/sops/blob/main/LICENSE

    Supports: license_spdx, source_model

    checked Nov 1, 2026
  • Official documentation
    SOPS Documentation

    https://getsops.io/docs

    Supports: capabilities, data_formats, integrations

    checked Nov 1, 2026
  • Official site
    SOPS: Secrets OPerationS

    https://getsops.io/

    Supports: name, summary, capabilities

    checked Nov 1, 2026
Confidence
High
Reviewed
Nov 1, 2026
Links
Verified · Nov 2, 2026

Spotted an error?

Broken link, outdated license, wrong category, or a tool that no longer exists? Tell us; reports are reviewed by the editor.

Bitwarden

Bitwarden Inc. · Secrets management

Open-source password manager with hosted and self-hosted server options, passkey support, organization sharing and a separate Secrets Manager for developers

AGPL-3.0-onlyFreemiumPaidLocalSelf-hostedNov 2, 2026