Tools · SPBoucher
Menu

HashiCorp Vault

by HashiCorp (an IBM company) · Application · also known as Vault, IBM HashiCorp Vault, HCP Vault

Identity-based secrets manager providing encrypted key-value storage, dynamic database and cloud credentials, PKI and encryption-as-a-service, under the Business Source License

BUSL-1.1 licenseFreePaidEnterpriseUsage-basedSelf-hostedCloudSelf-hostable
Visit official site Compare

Link verified Nov 2, 2026

Overview

Vault is a secrets management server from HashiCorp, now part of IBM. It stores static secrets in an encrypted key-value engine, but its distinguishing features are dynamic secrets, short-lived database, cloud and SSH credentials generated on demand and revoked automatically, a PKI engine that acts as an internal certificate authority, and a transit engine that encrypts and signs data for applications without exposing keys. Clients authenticate through methods tied to their platform identity (Kubernetes service accounts, cloud IAM roles, OIDC, AppRole, tokens), and policies written in HCL define which paths each identity may read or write.

Vault runs as a single binary with integrated Raft storage and is operated self-hosted (Community or Enterprise editions) or as HCP Vault Dedicated in HashiCorp's cloud. Since August 2023 the source has been released under the Business Source License 1.1, which permits most use but restricts offering Vault as a competing managed service; the OpenBao project forked the last MPL-licensed version under the Linux Foundation.

Vault is heavier to operate than file-based tools like SOPS or a hosted secrets service: unsealing, storage, high availability and policy design all need attention, which is why small teams often reach for lighter options until they need dynamic credentials or an internal CA.

Editorial note on uncertainty. The Vault-specific pricing tiers could not be read from the pricing page; pricing_model reflects the documented Community/Enterprise/HCP structure.

Capabilities

  • Encrypted key-value secrets engine with versioning
  • Dynamic credentials for databases, cloud providers and SSH
  • PKI engine issuing internal certificates
  • Transit engine for encryption, signing and key rotation as a service
  • Authentication via Kubernetes, cloud IAM, OIDC, AppRole and tokens with HCL policies
  • Audit logging, namespaces and replication (Enterprise)

Typical workflows

  1. Issue short-lived database credentials to applications
  2. Run an internal certificate authority for service-to-service TLS
  3. Centralize application secrets with per-service policies

Strengths

  • Dynamic, automatically revoked credentials
  • Broad set of auth methods and secrets engines
  • Mature HA deployment model with integrated storage

Limitations

  • Business Source License is not an OSI-approved open-source license
  • Operational complexity (unseal, HA, policy management)
  • Enterprise features such as replication and namespaces are paid

Prerequisites

  • Linux, macOS or Windows host or Kubernetes cluster
  • Storage backend (integrated Raft recommended)

Who it is for

  • Platform and security engineers
  • Organizations needing dynamic credentials or an internal CA

Alternatives & comparison

Infisical covers static and dynamic secrets with a web UI and an MIT-licensed core, positioning itself as a lighter alternative. SOPS encrypts secrets inside versioned files with cloud KMS keys and has no server at all. 1Password and Bitwarden are end-user password managers whose CLIs handle simple machine-secret cases but offer no dynamic credentials or PKI.

  • 1Password

    Password and secrets manager for individuals, families and businesses with end-to-end encrypted vaults, passkeys, an SSH agent and a developer CLI

    ProprietaryPaid
  • Bitwarden

    Open-source password manager with hosted and self-hosted server options, passkey support, organization sharing and a separate Secrets Manager for developers

    MixedFreemium
  • Infisical

    Secrets, certificate and privileged-access management platform with an MIT-licensed core, available as a hosted service or self-hosted deployment

    MixedOpen source
  • SOPS

    Command-line tool that encrypts the values of YAML, JSON, ENV and INI files with age, PGP or cloud KMS keys so secrets can be committed to git

    Open sourceOpen source
Compare HashiCorp Vault with its alternatives →

Sources & verification

Primary sources consulted for this record. Claims are tied to the fields each source supports; the automated link checker re-verifies every URL on a schedule.

  • License
    Vault LICENSE (Business Source License 1.1)

    https://github.com/hashicorp/vault/blob/main/LICENSE

    Supports: license_spdx, source_model, vendor

    Licensor named as International Business Machines Corporation (IBM).

    checked Nov 1, 2026
  • Official documentation
    Vault Documentation

    https://developer.hashicorp.com/vault/docs

    Supports: capabilities, workflows, interfaces

    checked Nov 1, 2026
  • Official site
    Vault | HashiCorp Developer

    https://developer.hashicorp.com/vault

    Supports: name, summary, capabilities

    checked Nov 1, 2026
  • Pricing page
    HashiCorp Pricing

    https://www.hashicorp.com/en/pricing

    Supports: pricing_model

    General HashiCorp pricing page; the www.hashicorp.com product pages rate-limited automated requests on 2026-11-02.

    checked Nov 1, 2026
Confidence
High
Reviewed
Nov 1, 2026
Links
Verified · Nov 2, 2026

Spotted an error?

Broken link, outdated license, wrong category, or a tool that no longer exists? Tell us; reports are reviewed by the editor.