# sops

> Editor for encrypted files supporting YAML, JSON, ENV, INI formats with AWS KMS, GCP KMS, Azure Key Vault, age, and PGP encryption

Stars: 23.6k · Language: Go · License: MPL-2.0 · Categories: Dev Tools

- Repository: https://github.com/getsops/sops
- Website: https://getsops.io
- Page: https://www.trmn.sh/tools/sops

## Install

- Go Install: `mkdir -p $GOPATH/src/github.com/getsops/sops/ && git clone https://github.com/getsops/sops.git $GOPATH/src/github.com/getsops/sops/ && cd $GOPATH/src/github.com/getsops/sops/ && make install`

## Overview

SOPS (Secrets OPerationS) is a command-line editor for encrypted files that supports multiple file formats (YAML, JSON, ENV, INI, and binary) and encryption backends. It integrates with cloud key management services including AWS KMS, GCP KMS, Azure Key Vault, and HuaweiCloud KMS, as well as age and PGP for encryption operations.

The tool handles encryption and decryption transparently, allowing users to edit encrypted files as if they were plaintext. When you run `sops edit myfile.yaml`, it decrypts the file, opens it in your configured editor, then re-encrypts and saves it when you're done. Each encrypted file contains metadata blocks that store encrypted copies of the data encryption key for each configured encryption method, ensuring redundancy and access control.

SOPS is designed for developers and operations teams managing secrets in infrastructure-as-code workflows. It supports configuration via environment variables (like `SOPS_KMS_ARN` for AWS KMS keys or `SOPS_AGE_RECIPIENTS` for age encryption), configuration files (`.sops.yaml`), and can decrypt files in a `cat`-like fashion using `sops decrypt`. The tool also provides a Go library for programmatic integration into other applications.

### Installation

```bash
# via Go Install
mkdir -p $GOPATH/src/github.com/getsops/sops/ && git clone https://github.com/getsops/sops.git $GOPATH/src/github.com/getsops/sops/ && cd $GOPATH/src/github.com/getsops/sops/ && make install
```

![SOPS editing workflow demonstration](https://media.trmn.sh/cached/2d15b2baf20afe0802115dab8311cb9566148b8009f8173deec924613164366d.gif)

## Alternatives

- [asdf](https://www.trmn.sh/tools/asdf.md): Version manager that handles multiple language runtimes per project through plugins, using a single CLI and a .tool-versions file. (Go, 25.6k stars)
- [VHS](https://www.trmn.sh/tools/vhs.md): Generate terminal GIFs from code scripts for testing and demonstrating CLI tools (Go, 21.2k stars)
- [kubectx](https://www.trmn.sh/tools/kubectx.md): CLI tools to quickly switch between Kubernetes contexts and namespaces with fuzzy search support (Go, 20.1k stars)
- [TruffleHog](https://www.trmn.sh/tools/trufflehog.md): Secrets scanner that finds credentials in Git, filesystems, S3/GCS buckets and Docker images, classifies 800+ types, and verifies whether they are live. (Go, 28.8k stars)
- [Task](https://www.trmn.sh/tools/go-task.md): Task runner and build tool that reads tasks from a YAML Taskfile, a simpler cross-platform alternative to Make. (Go, 16.3k stars)

## Guides

- [Best CLI Tools for Encrypting Files and Configuration](https://www.trmn.sh/best/file-encryption-tools): Compare age, sops, git-crypt: workflows, strengths and tradeoffs.

---

Canonical: https://www.trmn.sh/tools/sops