---
title: sops — structured file secrets management
date: 2026-10-18
time: 12:00
model: admin
category: programs
author_type: human
summary: Encrypts only some values in JSON, YAML, and TOML. Secrets are not exposed even when committed to Git.
tags: program, User and Security Management, sops
---

**💬 "sops command"**

sops handles **structured file secret management** by encrypting only certain values in JSON, YAML, and TOML. Secrets remain hidden even when committed to Git.

It recognizes JSON, YAML, TOML, ENV, and INI structures. Only values are encrypted, while keys and structure are kept in plain text.

- **Concept**: Recognizes JSON, YAML, TOML, ENV, and INI structures.
- **Key Features**: Encrypts only values, keeping keys and structure in plain text.
- **Advantages**: Supports age, PGP, KMS, GCP, AWS, and Azure key backends.
- **Usage**: Diff remains readable even after Git commits.
## Installation and Download

sops is installed via a package manager or an official script.

| Environment | Command |
| --- | --- |
| Go install | go install go.mozilla.org/sops/v3/cmd/sops@latest |
| macOS (brew) | brew install sops |
| Official Binary | github.com/getsops/sops/releases |
| Verification | sops --version |

Installation can be verified using `sops --version`.

## Frequently Used Options

| Options | Description |
| --- | --- |
| -e, --encrypt | Encrypt (file to standard output) |
| -d, --decrypt | Decrypt |
| -i, --in-place | Modifies the original file in place |
| --set <path> <value> | Sets and encrypts a specific path value |
| --extract <path> | Extracts only the value at a specific path |

## 3 Essential Command Combinations

- `sops -e secrets.yaml > secrets.enc.yaml` — Encrypt entire file
- `sops -d secrets.enc.yaml` — Decrypt
- `sops --set '["db"]["password"] "newpass"' secrets.enc.yaml` — Update value
**💬 "Show me an example of using sops on a real server"**

Here are common scenarios encountered on production servers, listed in order.

### Step 1: Key Setup

Register the age public key in .sops.yaml.

```
echo 'creation_rules:\n  - path_regex: secrets\\.ya?ml$\n    age: age1...' > .sops.yaml
```

### Step 2: Encryption

Encrypt the secrets file.

```
sops -e secrets.yaml > secrets.enc.yaml
```

### Step 3: Git Commit

Commit the encrypted file.

```
git add .sops.yaml secrets.enc.yaml && git commit -m 'Add secrets'
```

## Actual Execution Screen

This is the result of encrypting a YAML value with sops.

![sops command execution result](https://games.aidebatehub.com/assets/sops-demo.png)

Production server

## In Practice, It's Used Like This

### 1. docker-compose Secret Management

**Situation** — Encrypt only the password in docker-compose.yml.

```
sops -e docker-compose.yml > docker-compose.enc.yml
```

**Result** — The password value changes to ENC[AES256_GCM,...].

**Point** — Keys and structure remain in plain text, making diff readable.

### 2. Decryption After Git Commit

**Situation** — Commit the encrypted file to git and decrypt during deployment.

```
git add .sops.yaml secrets.enc.yaml && git commit -m 'secrets'
sops -d secrets.enc.yaml
```

**Result** — Only ENC[...] remains in Git, and it's decrypted to actual values during deployment.

**Point** — Register the age public key in .sops.yaml.

## Actual Execution Screen

This is the result of decrypting with sops -d.

![sops command execution result 2](https://games.aidebatehub.com/assets/sops-demo2.png)

Production server

## Points to Note

- The creation_rules in .sops.yaml must match the actual file paths. Mismatches will cause encryption to fail.
- Losing the private key makes decryption impossible. Always back up your keys, whether age or PGP.
- sops may not recognize the structure of ENV format files.

---
Source (HTML): https://games.aidebatehub.com/programs/linux/security/sops.html
This file is an auto-generated Markdown twin of the DevHub document.