← All platforms
HHashiCorp Vault
The tool that defined the category — now an IBM product under a licence that is no longer open source.
Secrets platformSecrets, keys, PKI, dynamic credentialsBy IBMSince 2015Licence: BUSL-1.1 — not OSI-approved
- Type
- Secrets platform
- How it works
- A secrets engine rather than a key store: it issues short-lived database credentials, cloud tokens and certificates on demand, so secrets expire instead of sitting in a config file. Transit lets it act as an encryption service too. Powerful, and heavy to run properly.
- Scope
- Secrets, keys, PKI, dynamic credentials
- Deployment
- Self-hosted + HCP
- Hardware / key custody
- HSM auto-unseal and seal wrap in Enterprise
- Pricing*
- Community free (BUSL); HCP by quote
- Free tier
- Yes
- Licence
- BUSL-1.1 — not OSI-approved
- Best for
- Dynamic, short-lived credentials at scale
- Notable
- Acquired by IBM; BUSL since 2023
* Published list pricing at August 2026 (vendor pricing pages, August 2026), not a quote.
Strengths
- Widest set of secret engines and integrations
- Dynamic secrets genuinely reduce credential sprawl
- Cloud-agnostic — one interface across providers
- Enormous community knowledge base
Trade-offs
- BUSL-1.1 is not open source — a real problem for some
- Operating it well needs dedicated expertise
- Two ownership changes worth of roadmap uncertainty
- Enterprise features gated and quote-priced
Visit HashiCorp Vault → Documentation
Listed for comparison as of August 2026 — not an endorsement, and HashiCorp Vault did not pay for placement. See disclosure.
Compare HashiCorp Vault with…