Overview

SOPS — Secrets OPerationS — is an editor of encrypted files. It was launched at Mozilla in 2015 and donated to the CNCF as a Sandbox project in 2023, where it is now stewarded by its own group of maintainers. SOPS encrypts the values inside structured configuration files — YAML, JSON, dotenv/ENV, INI and raw binary — while leaving the keys, comments and overall file structure in cleartext. The result is a secrets file that is still readable, diffable and reviewable in a pull request: you can see which secrets changed without seeing what they are.

Encryption uses a per-file AES-256-GCM data key, and that data key is wrapped in turn — envelope encryption — by one or more master keys from the backends a team already runs: AWS KMS, GCP KMS, Azure Key Vault, HuaweiCloud KMS, HashiCorp Vault / OpenBao, age and PGP/GnuPG. The wrapped master keys plus a MAC for integrity checking live in a sops metadata block at the foot of the file, so a colleague only needs the file and their own key to decrypt it — no separate key server lookup or shared passphrase.

Key Features

• Selective encryption — keys stay in cleartext, values become ENC[AES256_GCM,data:…,iv:…,tag:…,type:str]. --encrypted-regex and --unencrypted-regex decide which parts of a tree are encrypted, so a Kubernetes manifest can encrypt only data/stringData.
• Multiple formats — YAML, JSON, dotenv/ENV, INI and binary files. Tree formats encrypt only the leaf values; binary input is read as bytes, encrypted and stored base64 under tree['data']. The format is inferred from the file extension (override with --input-type / --output-type).
• Envelope encryption with several master keys — one file can be decryptable by a combination of keys at once (multiple KMS regions, a cloud key plus an offline “break glass” PGP or age key), because the metadata block carries every wrapped data key.
• Key groups — recipients can be split into groups with their own Shamir threshold, e.g. any 2 of 3 groups must co-operate to recover the data key.
• Backends — AWS KMS (--kms), GCP KMS (--gcp-kms), Azure Key Vault (--azure-kv), HuaweiCloud KMS (--hckms), HashiCorp Vault / OpenBao and age (--age) or PGP (--pgp). Credentials come from the usual provider environment/CLI configuration, or from SOPS_KMS_ARN, SOPS_PGP_FP, SOPS_GCP_KMS_IDS, SOPS_AGE_KEY_FILE and friends.
• .sops.yaml creation rules — a repo-level config maps a path regex to the keys to use, so secrets/prod/*.yaml is automatically encrypted for the production team keys and new files need no flags at all.
• Key management — sops updatekeys adds or removes recipients without re-encrypting the values, while sops rotate generates a fresh data key and re-encrypts everything, optionally adding and removing master keys in the same pass (--add-age, --rm-pgp, …).
• Integrity checking — every value is authenticated against its own path in the file and the file carries a MAC, so hand-edited or tampered ciphertext is refused rather than silently accepted; a lastmodified stamp and the key list are kept in the metadata.
• Script and CI friendly — reads stdin and writes stdout with no temp files, --filename-override picks the format and the matching creation rule for piped data, --output and -i (--in-place) control the destination, and sops exec-env / sops exec-file run a command with the decrypted secrets injected as environment variables or as a temporary file that is removed on exit.
• Everyday editing — sops edit transparently decrypts, opens $EDITOR and re-encrypts on save; sops set / sops unset change a single value without an editor; sops filestatus reports whether a file is encrypted; sops publish pushes a file to S3, GCS or Vault with a re-encryption rule.
• Single static binary — shipped for Linux, macOS and Windows (amd64 and arm64, plus other architectures) as a signed release artifact, so it drops into a container, a CI runner or a workstation with no runtime dependencies.

Why Use It

The usual alternative to a secrets manager is to keep credentials out of the repository altogether, which pushes them into an unversioned place that nobody reviews. SOPS takes the opposite approach: the secret stays with the code, in a file that can be committed, diffed and code-reviewed, but the sensitive part of it is unreadable without a key the team already controls. That makes secret changes visible — a pull request shows that db_password was rotated — without exposing the value in the review UI, the git history or a CI log.

Because the master keys live in the cloud KMS or key store that the organisation already pays for and audits, there is no new server to run and no new credential to distribute. Revoking a person’s access is a matter of removing them from the KMS policy or from the creation_rules and running sops updatekeys — no shared passphrase to rotate and no re-deployment of the application.

Use Cases

• GitOps and Kubernetes: keep Secret manifests encrypted in the same repository as the workloads and decrypt them in the pipeline (the basis of tools such as helm-secrets and sealed-secret workflows).
• Application configuration: encrypt only the credential values in an otherwise readable config.yaml or .env, so non-secret settings stay greppable.
• Infrastructure as code: hold Terraform variables and Ansible group vars encrypted next to the playbooks that consume them.
• CI/CD: decrypt at deploy time with the runner’s cloud identity, or inject values straight into a command with sops exec-env 'deploy.sh' so they never touch the disk.
• Team handover and break-glass access: keep a second, offline age or PGP master key on a file that only KMS protects, so the file remains recoverable if a cloud account is unavailable.
• Retiring a credential: sops rotate re-encrypts all values with a new data key in one command, which is the cheap way to respond to a leaked file.

Platforms and Requirements

• Linux, macOS and Windows, as a pre-built static binary; also packaged by most distributions and available as a container image.
• One or more master keys: an age or PGP key pair works entirely offline; the cloud backends additionally need credentials with permission to wrap/unwrap (e.g. kms:Encrypt and kms:Decrypt on the relevant AWS KMS keys).
• An editor for sops edit, taken from $SOPS_EDITOR or $EDITOR (vim, nano or vi as a fallback).
• No server, database or daemon is required — SOPS is a single client-side binary, and the encrypted files are ordinary text files.

Licence and Website

SOPS is free and open source software, released under the Mozilla Public License 2.0. It was created at Mozilla by Adrian Utrilla and Julien Vehent, and is now a Cloud Native Computing Foundation Sandbox project.

• Source code: github.com/getsops/sops
• Documentation: getsops.io/docs
• Licence: Mozilla Public License 2.0

Alternatives

• gopass stores secrets in a git-backed, GPG/age-encrypted tree and is the closer alternative if you want a password-store workflow rather than encrypted files sitting beside their configuration
• KeePassXC or Bitwarden are where individual credentials belong when they are not tied to a deployment artefact
• Gitleaks complements SOPS: it scans the repository for secrets that were committed before SOPS was adopted

Explore Further

Browse more self-hosted security and privacy tooling in the full directory, or submit a tool of your own.