How Doppler and AWS KMS differ on scope, key custody, deployment and cost.
| Doppler | AWS KMS | |
|---|---|---|
| Type | SaaS secrets | Cloud KMS |
| Scope | App secrets and config | Encryption keys |
| Deployment | SaaS | SaaS (AWS) |
| Key custody | AES-256 at rest; no customer HSM | FIPS 140-3 Level 3 validated HSMs |
| How it works | One place for environment variables across every environment, synced automatically into hosting platforms, CI and containers. Deliberately narrow: it is not trying to be a cryptographic service, which is why it takes an afternoon rather than a quarter to roll out. | Keys never leave the service — you call it to encrypt and decrypt rather than fetching key material. Envelope encryption is the normal pattern: KMS protects a data key, the data key protects your data. Every AWS service integrates natively, which is most of the value. |
| Pricing* | Free for 3 users; Team $21/user/mo | $1/key/mo + $0.03 per 10k requests |
| Free tier | Yes | Yes |
| Licence | CLI (Apache-2.0) | — |
| Best for | Small teams that want it working today | Anything already running on AWS |
Choose Doppler for small teams that want it working today. Choose AWS KMS for anything already running on aws.
* Published list pricing (vendor pricing pages, August 2026).