About SOPS
SOPS is an open source tool for encrypting configuration and secret files. It keeps the file structure visible, so you can still review changes in version control.
What it does
SOPS encrypts the values and comments in a file while leaving the keys readable. This means a reviewer can see which settings changed without seeing the secret values. It supports YAML, JSON, INI and DotEnv files, and it can also encrypt whole binary files. Access is managed through identities, and you can require several identities before a file can be decrypted.
Key features
- Encrypts values, keeps keys readable
- Supports YAML, JSON, INI and DotEnv
- Encrypts whole binary files too
- Access through one or more identities
- Works with offline and cloud key stores
Who it's for
DevOps engineers and developers who want secrets in git alongside the code that uses them. Security teams that need controlled access to configuration will also find the identity model useful.
Pricing and good to know
SOPS is open source under the MPL-2.0 licence and is free to use. It can work offline with age or PGP keys, or with cloud key services such as AWS KMS, Google Cloud KMS, Azure KMS and HashiCorp Vault. How secure a file is depends on how well its keys are stored, so protect the key material as carefully as you protect the secrets themselves.
Highlights
- Encrypts values and keeps keys readable
- Supports YAML, JSON, INI and DotEnv
- Encrypts whole binary files too
- Access controlled through identities
- Works with offline and cloud key stores
