HashiCorp Vault is a secrets management platform for securely storing, generating and controlling access to tokens, passwords, certificates and encryption keys through a UI, CLI or HTTP API. First released in 2015 by HashiCorp, the company founded in 2012 by Mitchell Hashimoto and Armon Dadgar, Vault is now part of IBM following IBM's 6.4 billion dollar acquisition of HashiCorp, completed in February 2025.
Vault centralizes secrets that would otherwise be scattered across configuration files and environment variables, enforcing authentication, fine-grained access policies and comprehensive audit logging for every secret request.
Key Features
Vault's pluggable secrets engines cover different secret types: a Key-Value engine for static secrets, database secrets engines that generate short-lived dynamic credentials automatically revoked after use, a PKI engine for issuing short-lived TLS certificates, and a Transit engine providing encryption as a service without exposing raw keys to applications.
Access is governed by identity-based policies evaluated against authentication methods including cloud IAM roles, Kubernetes service accounts, LDAP and GitHub, with every access recorded in an immutable audit log. Dynamic secrets minimize the lifetime of any single leaked credential compared to traditional static passwords.
Pricing
Vault Community Edition is free, open source and self-hosted, with no secret-count limits, released under the Business Source License 1.1 since August 2023. HCP Vault Dedicated offers a managed SaaS Development tier around 0.03 dollars per hour, with production-grade Essentials and Standard tiers priced hourly plus a per-authenticated-client fee.
Vault Enterprise is a self-managed license for organizations needing full deployment control, adding the Transform secrets engine, disaster recovery replication and Sentinel governance; pricing is not published and commonly starts in the low six figures annually depending on scale.
Key Features
Key-Value Secrets Engine — Stores arbitrary static secrets such as API keys and passwords in Vault's encrypted internal storage.
Dynamic Secrets — Generates short-lived, unique database and cloud credentials on demand, automatically revoked after a configurable time-to-live.
Transit Encryption Engine — Provides encryption as a service, letting applications encrypt and decrypt data without ever handling raw encryption keys.
Identity-Based Access Policies — Controls secret access through fine-grained policies evaluated against authenticated identity from cloud IAM, Kubernetes, LDAP or GitHub.
Immutable Audit Logging — Records every secret access request for compliance, forensics and security monitoring.
Multiple Authentication Methods — Supports AWS, Azure and GCP IAM, Kubernetes service accounts, LDAP, GitHub and username and password authentication.
Disaster Recovery Replication (Enterprise) — Replicates Vault data across regions or data centers for business continuity in Enterprise deployments.
Pros & Cons
Pros
Free, full-featured Community Edition with no secret-count limits for self-hosted use
Dynamic secrets and the Transit encryption engine go well beyond basic secret storage offered by many competitors
Cloud-agnostic design works consistently across AWS, Azure, GCP and on-premises infrastructure
Deep integration with the rest of the HashiCorp toolchain, particularly Terraform and Consul
De facto standard secrets manager in much of the Kubernetes and DevOps ecosystem
Cons
Business Source License change in 2023 removed Vault from OSI-approved open-source licensing, concerning some community members
Vault Enterprise and HCP Vault Dedicated pricing is not published and can reach low six figures annually even for modest deployments
Operating self-hosted Vault at scale requires meaningful expertise in unsealing, storage backends and high availability configuration
HCP Vault Secrets SaaS product was discontinued in 2025, consolidating options around the more complex HCP Vault Dedicated
IBM's 2025 acquisition has introduced some uncertainty among customers about long-term roadmap direction
Pricing
Community (Open Source) Free N/A
HCP Vault Dedicated - Development From approximately $0.03/hour (~$22/month) Hourly usage-based
HCP Vault Dedicated - Essentials/Standard From approximately $1,152/month plus ~$72.92/client/month Hourly usage-based plus per-client fee
Enterprise Custom pricing Annual contract
Frequently Asked Questions
What is HashiCorp Vault used for
Vault is used to centrally store, generate and control access to secrets such as passwords, API keys, certificates and encryption keys, replacing hardcoded credentials scattered across configuration files and code.
Is Vault free to use
Yes, Vault Community Edition is free and open source for self-hosted deployment with no secret-count limits. Paid HCP Vault Dedicated and Vault Enterprise options add managed hosting and advanced governance features.
What are dynamic secrets in Vault
Dynamic secrets are credentials, such as database passwords, that Vault generates uniquely for each request and automatically revokes after a set time-to-live, reducing the risk window if a credential leaks.
Who owns HashiCorp Vault now
HashiCorp, the company behind Vault, was acquired by IBM in a deal valued at approximately 6.4 billion dollars that closed in February 2025. Vault continues to be developed under the HashiCorp brand as part of IBM.
What is the Vault Transit secrets engine
The Transit secrets engine provides encryption as a service, allowing applications to encrypt and decrypt data by calling Vault's API without ever handling the underlying encryption keys directly.
When was Vault first released
Vault was first released by HashiCorp in 2015, three years after HashiCorp itself was founded in 2012 by Mitchell Hashimoto and Armon Dadgar.