Cheapest platform as machine identity count grows
Users, secrets and API calls held at your current inputs β only the number of machine/service identities changes per row. Watch Infisical's per-identity bill climb while Doppler stays flat and AWS doesn't move at all (it never counts identities).
| Machine identities | Doppler | Infisical | AWS Secrets Manager | Cheapest |
|---|
Why per-seat, per-identity and per-secret billing shapes matter
Secrets managers don't compete on a single price β each meters a completely different dimension of your stack. Doppler bills cost = f(human users only) β on the Developer plan the first 3 users are free and each additional user is $8/month (capped at 25 users), or on the Team plan every user costs a flat $21/month β and critically, machine identities, service accounts, CI runners and AI agents don't count toward the bill at all. Infisical bills cost = identities Γ rate where an identity is any human OR machine credential holder β the first 5 identities are free, then Pro plan pricing is $20/identity/month billed annually or $23/month on-demand, with humans and bots charged identically. AWS Secrets Manager ignores identities entirely and instead bills cost = (secrets Γ $0.40/mo) + (API calls Γ· 10,000 Γ $0.05) β a flat per-secret storage fee plus a tiny per-call charge, regardless of how many people or services are reading those secrets.
That means the "cheapest" platform flips hard depending on your team's shape. A team with a handful of humans but dozens of CI jobs, Lambda functions and bot accounts pulling secrets will find Infisical's per-identity model brutally expensive compared to Doppler (machines free) or AWS (identities don't matter at all). A team with very few secrets but heavy automation will often find AWS cheapest of all, since its cost is decoupled from headcount. But a team that creates hundreds or thousands of secrets β one per environment/service/tenant, a common Kubernetes pattern β will watch AWS's linear per-secret charge overtake both Doppler's and Infisical's flat per-seat pricing. Run your own numbers above instead of comparing sticker prices.
How this calculator works
The Doppler vs Infisical vs AWS Secrets Manager Cost Calculator compares three secrets management pricing shapes β Doppler (per human seat, machine identities free), Infisical (per identity, humans and machines billed the same) and AWS Secrets Manager (per secret stored + per API call, no identity concept) β at your team size, machine identity count, secret count and monthly API call volume. Doppler's Developer-plan cost is max(0, users-3) Γ $8 (first 3 users free, up to 25), or on the Team plan users Γ $21; machines never count. Infisical's cost is identities β€ 5 ? $0 : identities Γ rate where identities = users + machines and rate is $20/mo (annual) or $23/mo (on-demand). AWS Secrets Manager's cost is (secrets Γ $0.40) + (apiCallsThousands Γ· 10 Γ $0.05). The calculator shows all three totals side by side, then a separate table isolates all three vendors across a range of machine identity counts at your current users/secrets/API-call settings, so you can see exactly where Infisical's per-identity charge overtakes Doppler's flat per-seat model and where AWS's identity-independent pricing wins outright.
These are representative pricing shapes based on each vendor's published self-serve rates as of August 2026 (Doppler Developer and Team tiers from doppler.com/pricing, including its "AI agents and non-human identities ride free" policy; Infisical Free and Pro tiers from infisical.com/pricing; AWS Secrets Manager's $0.40/secret/month + $0.05/10,000-API-calls rate from aws.amazon.com/secrets-manager/pricing), not live vendor quotes. Doppler's Enterprise, Infisical's Advanced/Enterprise tiers and AWS volume/reserved pricing are negotiated separately and aren't modeled here. Always confirm current pricing directly with the vendor before budgeting.
Frequently asked questions
Is Doppler or Infisical cheaper for teams with many CI/CD or service identities?
Doppler is almost always cheaper once you add machine identities, because Doppler explicitly excludes service accounts, CI runners and AI agents from its per-seat billing β only human users count toward your bill. Infisical bills per identity on its Pro plan ($20/identity/month annual, $23/month on-demand), and an "identity" includes every human user plus every machine/service token, so a team with 5 humans and 60 CI/service identities pays Infisical for 65 identities (roughly $1,300/month annual) while Doppler only bills for the 5 humans. The gap widens the more automation, bots and non-human callers you register.
When does AWS Secrets Manager beat Doppler and Infisical on price?
AWS Secrets Manager wins when you have a small number of secrets and low API call volume but a large number of humans or machine identities that would otherwise be billed per-seat. It charges $0.40 per secret per month plus $0.05 per 10,000 API calls, completely independent of how many people or services read those secrets. A team with 2 developers, 50 CI bots and just 20 secrets pays AWS a flat ~$8-10/month regardless of headcount, while Infisical would bill for 52 identities (~$1,000+/month) and even Doppler's per-user Team plan would charge for the 2 humans only ($42/month) β so AWS wins hardest against Infisical specifically, and can still beat Doppler when secret count and API call volume stay low.
When does AWS Secrets Manager get expensive?
AWS Secrets Manager's cost scales directly with how many discrete secrets you store and how often your infrastructure reads them β neither of which is capped by a subscription. Storing 500 secrets alone costs $200/month before a single API call, and high-frequency reads (e.g. every pod fetching a secret on every restart, or short TTL caching that forces frequent re-fetches) can add real API-call costs on top. Teams that create a new secret per environment/service/tenant combination (a common Kubernetes pattern) can rack up thousands of secrets, at which point Doppler's or Infisical's flat per-seat pricing becomes cheaper than AWS's linear per-secret charge, even after accounting for their per-identity or per-user fees.
Why do secrets managers use such different billing models?
Doppler, Infisical and AWS Secrets Manager are metering three different things because they're optimizing for different buyers. Doppler (per human seat, machines free) is built to make automation cheap and predictable for engineering teams that want to plug secrets into every CI job and serverless function without a per-token bill. Infisical (per identity, humans and machines both count) treats every credential-holder the same way, which is simpler to reason about but punishes machine-heavy architectures. AWS Secrets Manager (per secret + per API call, no seat concept at all) fits AWS's usage-based cloud billing model and is cheapest for small, low-traffic secret sets embedded in existing AWS infrastructure, but scales linearly and can surprise teams that treat it as a place to dump thousands of environment-specific secrets.