SOPS

MPL-2.0 encrypts config values; keys stay readable

DevOps / Infrastructure · MPL-2.0 · 23.4k

Reviewed 2026-09-09 · last push 2026-10-13 · repo checked 2026-10-19

What's Good

MPL-2.0. CNCF sandbox. Works with age, PGP, and cloud KMS (AWS/GCP/Azure/Vault and friends). Structure-preserving so diffs stay reviewable. Pairs cleanly with age keys for offline teams. Offline + online identity modes.

The Catch

Vs age (file encryption) and Infisical (secrets product): SOPS is the *structured config encryptor*, not a password manager and not a hosted vault UI. You still design key distribution, rotation, and who can decrypt in CI. Binary mode encrypts whole files when structure does not apply.

Verdict

MPL-2.0 secrets-in-git. Free forever; use age underneath when you want KMS-free recipients.

Embed

Maintainer? Add the badge to your README. It is free, links to this review, and there is no paid version.

Markdown

[![Reviewed on Stack Gems](https://stackgems.com/badge/sops.svg)](https://stackgems.com/gems/sops)

HTML

<a href="https://stackgems.com/gems/sops"><img src="https://stackgems.com/badge/sops.svg" alt="SOPS reviewed on Stack Gems" height="20"></a>

DevOps →

Related