SOPS
Hacker ApprovedRanked 2 of 20 secrets managers by recommenders
Encrypts secret files such as .env so they can live in Git or be read only when needed; people praise its simplicity, especially with age. Common caveat: it doesn't solve team sharing.
Encrypts secret files such as .env so they can live in Git or be read only when needed; people praise its simplicity, especially with age. Common caveat: it doesn't solve team sharing.
33 people gave an opinion
- recommend it
- 28
- criticize it
- 5
- approval share
- 85%
Recommended in 10 of 13 months
- November 2025: recommended
- December 2025: recommended
- January 2026: recommended
- February 2026: recommended
- March 2026: recommended
- April 2026: recommended
- May 2026: recommended
- June 2026: recommended
- July 2026: not recommended
- August 2026: recommended
- September 2026: recommended
- October 2026: not recommended
- November 2026: not recommended (month in progress)
Why it carries the badge
- 28 people recommend itNeeds 10 or more, met.
- 5.6 recommenders for every criticNeeds 2 to 1 or better, met.
- Recommended in 10 of 13 monthsNeeds 4 or more, met.
The same three rules apply to every product, and the badge can’t be bought. How the badge works
What people say about it
The reasons people give, with the number of comments that give each one. Open a reason to read what they said.
Why people recommend it
Each mark is one comment
Pairs well with age encryption
“sops combined with age is great! Benefit is that it doesn't tie you into 1Password's ecosystem”
Comment from 12 May 2026 in “TanStack NPM Packages Compromised” “cheapest effective setup ive found: sops+age for the .env”
Comment from 24 Feb 2026 in “Show HN: enveil – hide your .env secrets from prAIng eyes” “use sops + age or dotenvx to encrypt just the values”
Comment from 24 Feb 2026 in “Show HN: enveil – hide your .env secrets from prAIng eyes” - Comment from 24 Feb 2026 in “Show HN: enveil – hide your .env secrets from prAIng eyes”
- Comment from 24 Nov 2025 in “Show HN: I just fixed .env once and for all – better-env”
Simple and easy to use
“sOps is so much cleaner, easy enough to use and works well enough in k8s.”
Comment from 29 Aug 2026 in “The Twelve-Factor App (2025)” “I like it because it's pretty easy to use, however it's not fool-proof”
Comment from 19 Jan 2026 in “Using Proxies to Hide Secrets from Claude Code” “SOPS with Age is simple, and simple is good.”
Comment from 12 Mar 2026 in “Scrt: A CLI secret manager for developers, sysadmins and DevOps” - Comment from 12 Mar 2026 in “Scrt: A CLI secret manager for developers, sysadmins and DevOps”
Keeps plaintext secrets off disk
“switch to SOPS or Vault or whatever to keep these out if plaintext except exactly when needed”
Comment from 19 May 2026 in “CISA Admin Leaked AWS GovCloud Keys on GitHub” “I like this because this way the .env doesn't sit in the directory at all”
Comment from 18 Sep 2026 in “Inside ZCode: Silently uploading your Git history to the cloud” “so no secrets live on disk”
Comment from 4 May 2026 in “Microsoft Edge stores all passwords in memory in clear text, even when unused” Mature and used for years
“I've used it with ease for the last two years, both personally and professionally.”
Comment from 12 Mar 2026 in “Scrt: A CLI secret manager for developers, sysadmins and DevOps” “compared to something mature like SOPS”
Comment from 15 Mar 2026 in “Scrt: A CLI secret manager for developers, sysadmins and DevOps” “This software has done this for years”
Comment from 24 Feb 2026 in “Show HN: enveil – hide your .env secrets from prAIng eyes”
What people warn about
Each mark is one comment
Weak for team sharing
“solves accidental file reads but doesn't help with team sharing”
Comment from 24 Feb 2026 in “Show HN: enveil – hide your .env secrets from prAIng eyes” “The existing tools (pass, sops, git-crypt) are close but they assume a single human identity.”
Comment from 1 Mar 2026 in “How HN: Agent-Vault – A Zero-trust credential manager for AI agents” Complicated, clunky user experience
“SOPS is ultra-complicated for a security tool.”
Comment from 12 Mar 2026 in “Scrt: A CLI secret manager for developers, sysadmins and DevOps” “But SOPS UX feels clunky.”
Comment from 16 Aug 2026 in “Show HN: Laptop is the last place your secrets are still in plaintext”
Other secrets managers people recommend
The four most recommended other secrets managers, with the same counts for each, so you can compare like for like. The tick on each bar marks the 2 to 1 line the badge needs.
| Product | Recommend | Criticize | Approval | Months | Owned | Badge |
|---|---|---|---|---|---|---|
| OneCLI | 39 | 8 | 83% | 6 | — | Approved |
| SOPSThis page | 28 | 5 | 85% | 10 | — | Approved |
| HashiCorp Vault | 26 | 10 | 72% | 10 | — | Approved |
| fnox | 20 | 4 | 83% | 9 | — | Approved |
| Agent Vault | 20 | 3 | 87% | 5 | — | Approved |
What people said
32 of the 39 comments that mention it, newest first. Each links to the original comment.
“I like this because this way the .env doesn't sit in the directory at all”
“I found it works nicely here too.”
“Works great with Instance Profiles or IRSA.”
“sOps is so much cleaner, easy enough to use and works well enough in k8s.”
“But SOPS UX feels clunky.”
“sops , ansible vault and similar seems too weak given the agent is gonna read them at some point”
“so far that has been working just great!”
“You can use Mozilla SOPS instead with IAM roles and KMS instead of gpg.”
“SOPS is exactly what I use too”
“I use `sops` to keep an encrypted env around”
“switch to SOPS or Vault or whatever to keep these out if plaintext except exactly when needed”
“You could store these in sops and have an alias or task that routes your aws commands through sops”
“sops combined with age is great! Benefit is that it doesn't tie you into 1Password's ecosystem”
“so no secrets live on disk”
“Personally, I've been using sOPs for this purpose.”
“compared to something mature like SOPS”
“I've used it with ease for the last two years, both personally and professionally.”
“it seems mostly simple to me”
“SOPS is ultra-complicated for a security tool.”
“SOPS with Age is simple, and simple is good.”
“The existing tools (pass, sops, git-crypt) are close but they assume a single human identity.”
“if you go into SOPS you will see several issues around how the .env file format is just a complete nightmare”
“sops, by nature of how it works, cannot really easily offer that”
“cheapest effective setup ive found: sops+age for the .env”
“solves accidental file reads but doesn't help with team sharing”
“if you want .env-ish behavior, use sops + age”
“use sops + age or dotenvx to encrypt just the values”
“This software has done this for years”
“I like it because it's pretty easy to use, however it's not fool-proof”
“SOPS reduces the surface area you need to cover.”
“sops encodes json and yaml semantically, key names of objects are preserved”
“its a good time to mention sops supports age”
Counts come from 1,795,640 Hacker News comments, November 2025 to November 2026. How we count. Report a mistake.