How HashiCorp Vault and OpenBao differ on scope, key custody, deployment and cost.
| HashiCorp Vault | OpenBao | |
|---|---|---|
| Type | Secrets platform | OSS secrets platform |
| Scope | Secrets, keys, PKI, dynamic credentials | Secrets, keys, PKI |
| Deployment | Self-hosted + HCP | Self-hosted |
| Key custody | HSM auto-unseal and seal wrap in Enterprise | PKCS#11 auto-unseal in community builds |
| How it works | A secrets engine rather than a key store: it issues short-lived database credentials, cloud tokens and certificates on demand, so secrets expire instead of sitting in a config file. Transit lets it act as an encryption service too. Powerful, and heavy to run properly. | Forked from the last MPL-licensed Vault release and developed under Linux Foundation governance. The API and concepts are the ones your team already knows, which makes migration realistic rather than theoretical — the point of the project is that no single company can change the terms again. |
| Pricing* | Community free (BUSL); HCP by quote | Free |
| Free tier | Yes | Yes |
| Licence | BUSL-1.1 — not OSI-approved | MPL-2.0 |
| Best for | Dynamic, short-lived credentials at scale | Vault semantics without licence risk |
Choose HashiCorp Vault for dynamic, short-lived credentials at scale. Choose OpenBao for vault semantics without licence risk.
* Published list pricing (vendor pricing pages, August 2026).