# SOPS

> MPL-2.0 encrypts config values; keys stay readable

**Category:** DevOps  
**Pricing:** open-source  
**URL:** https://getsops.io  
**GitHub:** https://github.com/getsops/sops  
**Added:** 2026-09-09

---

## The Hook

SOPS is git-friendly secrets for YAML/JSON/dotenv — encrypt values, leave keys visible, decrypt in CI.

## What's Good

MPL-2.0. CNCF sandbox. Works with age, PGP, and cloud KMS (AWS/GCP/Azure/Vault and friends). Structure-preserving so diffs stay reviewable. Pairs cleanly with age keys for offline teams. Offline + online identity modes.

## The Catch

Vs age (file encryption) and Infisical (secrets product): SOPS is the *structured config encryptor*, not a password manager and not a hosted vault UI. You still design key distribution, rotation, and who can decrypt in CI. Binary mode encrypts whole files when structure does not apply.

## Verdict

MPL-2.0 secrets-in-git. Free forever; use age underneath when you want KMS-free recipients.