1Password is a genuinely good product, and its developer tooling is better than its critics usually acknowledge. If you're already paying for it and using op run, you may not need an alternative at all — that's covered in the first section, honestly, before any of the recommendations.
People look elsewhere for four specific reasons: they don't want a subscription, they don't want another cloud holding developer credentials, they need open source or self-hosting, or they want something shaped for API keys rather than login forms.
We make one of the alternatives listed here. The requirements map comes first so you can judge for yourself, and every option states who it's wrong for.
Pick by requirement
| What you need | Use |
|---|---|
| Open source and self-hostable | Bitwarden / Vaultwarden |
| Free, offline, macOS, no account | PassStore or pass |
| Team env vars and CI, good CLI | Doppler or Infisical |
| Dynamic short-lived credentials, regulated | Vault / OpenBao |
| Fully offline, cross-platform, DIY sync | KeePassXC |
| Terminal-only, scriptable, plain files | pass |
| Encrypted config committed to Git | sops + age |
| You already pay for 1Password | 1Password CLI — don't add a tool |
1. First: are you sure you need an alternative?
Worth ruling out, because switching secret managers is real work.
1Password's op run injects secrets at process start from op:// references, so no plaintext ever lands on disk:
# .env is safe to commit — it holds references, not values
# STRIPE_SECRET_KEY=op://Development/stripe/credential
op run --env-file=.env -- npm run dev
op read "op://Development/stripe/credential"
Plus an SSH agent with per-use Touch ID, service accounts for CI, and shell plugins for aws and gh.
Stay with 1Password if: your company already standardised on it with SSO and audit; you need cross-platform; you need team sharing; or you want one tool for human logins and machine credentials. Those are strong reasons, and no alternative below beats it on them.
Look elsewhere if: you don't want a per-seat subscription; you'd rather not have a vendor in the trust chain for developer keys; you need open source or self-hosting for policy reasons; or you're a solo developer whose actual problem is .env sprawl on one Mac.
Full comparison: 1Password vs a local secret manager.
2. Bitwarden — the open-source direct replacement
The closest like-for-like swap. Open source, cross-platform, with a free tier that's genuinely usable rather than a demo.
Important detail when evaluating it for developer work: Bitwarden splits products. The password manager is separate from Bitwarden Secrets Manager, which is the one aimed at machine credentials and CI injection. If you're comparing against 1Password's developer story, compare against Secrets Manager, not the password vault.
Self-hosting is a real option — either Bitwarden's own server or the community Vaultwarden implementation, which is much lighter to run and popular for homelab and small-team setups.
Best for: teams wanting open source, anyone with a self-hosting mandate, budget-conscious setups, cross-platform needs.
Wrong for you if: you want the smoothest native macOS experience (the desktop app is cross-platform, and it shows), or you don't want to run and patch a server. Detail: Bitwarden for developers: is it enough?
3. PassStore — local-first, macOS, developer-shaped
A native macOS vault for developer secrets specifically, rather than a password manager that also holds keys.
- AES-256-GCM vault encryption, Argon2id key derivation (Security)
- Touch ID / Secure Enclave unlock; auto-lock; clipboard auto-clear
- No cloud sync, no account server — no backend exists for data to reach
- Workspace per repository;
.envgroups, API keys, database URLs, SSH credentials as distinct types - Vault health audit for reused and weak secrets
- Command palette and menu bar access
- Encrypted backup export and import
- Native Swift/SwiftUI, macOS 26.0+, free and MIT
Download · Source · API key manager guide
Best for: solo developers and small teams on macOS who want project-shaped local secrets with no subscription and no account, and whose real problem is .env files scattered across a dozen repos.
Wrong for you if: you need to share credentials (not supported by design), you need an audit trail, you're not on macOS, you can't run macOS 26, or you want browser autofill for logins. Also, plainly: no account means no password recovery. Lose the master password without a backup and the vault is gone.
4. Doppler / Infisical — team environment variables
If your pain is "our team's .env files are out of sync across dev, staging, and prod", these target exactly that, and neither 1Password nor a local vault is really built for it.
doppler run -- npm run dev # injects the current environment's secrets
doppler secrets set STRIPE_KEY # updates it for everyone
Both offer environment-per-branch models, CI integrations, and audit logs. Infisical is open source and self-hostable; Doppler is SaaS with a polished CLI.
Best for: teams with multiple environments and shared config, where drift between .env files is the daily problem.
Wrong for you if: you're solo (significant overhead for one person), or you want no cloud dependency in your inner loop. Compare: Doppler vs local .env management.
5. HashiCorp Vault / OpenBao — the different category
Worth being clear: Vault is not a 1Password alternative. It's infrastructure.
Its distinguishing feature is dynamic secrets — it generates a database credential on request, valid for minutes, then revokes it. There is no durable secret to leak, which is categorically stronger than rotating a static one well. It also does PKI, encryption-as-a-service, and fine-grained policy.
OpenBao is the community fork that emerged after HashiCorp's licence change; evaluate its governance and release cadence for your own risk tolerance.
Best for: regulated production environments, dynamic credentials, teams with platform engineers to run it.
Wrong for you if: you want pleasant laptop UX (it isn't that, and isn't trying to be), or you don't have someone to operate it. The operational cost is real and frequently underestimated. Pair it with something local for developer ergonomics rather than expecting it to serve both roles.
6. KeePassXC — fully offline, cross-platform
A local encrypted database file, no account, no vendor, no subscription. Mature, audited, and available everywhere.
Best for: people who want complete control, cross-platform support, and DIY sync (Syncthing, a private Git repo, a USB key).
Wrong for you if: you want polish — the UX is functional rather than pleasant, and the API-key workflow is manual. Sync is entirely your problem, and naive file sync of a single database across machines invites conflicts and, at worst, corruption. Have a plan before you rely on it.
7. pass and sops — the Unix answers
pass
One GPG-encrypted file per secret, in a Git repository.
brew install pass
pass insert dev/stripe/secret-key
STRIPE_SECRET_KEY="$(pass show dev/stripe/secret-key)" npm run dev
Best for: developers already comfortable with GPG who want full scriptability, plain files, and Git-based history.
Wrong for you if: GPG key management isn't something you want to own — that's the real cost, not the tool. Also note pass encrypts values but not the directory structure, so secret names are visible in the repository. Fine for many, disqualifying for some.
sops + age
Encrypts values inside structured files (YAML, JSON, .env) while leaving keys readable, so encrypted config can be committed and diffed sensibly. age is a far simpler key layer than GPG.
Best for: teams wanting encrypted config in Git, per-environment files, Kubernetes workflows.
Wrong for you if: you're managing ad-hoc personal keys rather than versioned config. See open source secret managers compared.
8. Decision questions
Do auditors need per-read logs? → 1Password Business, Doppler, or Vault. No local tool satisfies this; stop here.
Do several people need the same credential? → Something with sharing. Better still, issue per-developer credentials so leaks are traceable and individually revocable.
Is your real pain Git leaks and plaintext .env? → Pre-commit hooks plus a local vault. Cheapest and fastest fix, and it can be done today. See keep secrets out of Git.
Do you need cross-platform today? → Bitwarden, 1Password, or KeePassXC. macOS-only tools are out regardless of their merits.
Is the objection cost? → Bitwarden's free tier, pass, sops, KeePassXC, and PassStore are all free. Note that paid tiers buy sharing, audit, and provisioning — team problems. If you don't have team problems, you may not need to pay.
Is the objection "another cloud"? → Local-first (PassStore, KeePassXC, pass) or self-hosted (Vaultwarden, Infisical).
What about the built-in options?
Apple Passwords / iCloud Keychain is fine for Safari logins and Wi-Fi, and it now has a standalone app. It has no project model, no rotation metadata, and can't auto-lock during your session — the login keychain stays unlocked while you're logged in. Reasonable for passwords, not a developer secret manager. Detail: macOS Keychain for developers.
Browser password managers (Chrome, Firefox) are worse for this: no project grouping, and sync scope is often wider than people assume. Fine for logins, not for API keys.