A secret manager stores passwords, API keys and certificates in encrypted form, and controls access through permissions. Applications retrieve them at runtime rather than including them in the code or the repository, which enables rotation and auditing.