HashiCorp Vault

HashiCorp Vault is an identity-based secrets and encryption management system. It centralizes credentials, encryption keys, certificates and other sensitive data behind authentication, authorization policies and audit controls.

Vault supports self-managed deployments across cloud, on-premises and hybrid environments. HCP Vault Dedicated provides a managed Vault Enterprise deployment operated through the HashiCorp Cloud Platform.

IBM completed its acquisition of HashiCorp on February 27, 2025. Vault remains part of the HashiCorp product portfolio within IBM Software.

Vault stores static secrets, generates short-lived credentials and rotates access data through configurable secrets engines. It also supports PKI, encryption as a service, identity workflows and detailed audit logging.

Authentication methods include LDAP, OIDC, GitHub, AppRole, JWT, cloud identity systems and Kubernetes authentication. Policy-based authorization controls which clients can access specific paths and operations.

Vault integrates with Kubernetes through Vault Agent Injector, Vault Secrets Operator and the Vault Secrets Store CSI provider. It also supports plugins for authentication, secret storage and database credential generation.

Vault Community Edition can be installed as a self-managed product without a listed license charge. Enterprise features require a commercial license and custom pricing.

HCP Vault Dedicated uses trial, pay-as-you-go and contract-based billing options. Development, Essentials and Standard tiers are billed according to cluster tier, size, region and, for some tiers, active clients.

HCP trial organizations can create one Vault Dedicated cluster. Exact trial and pay-as-you-go rates are displayed in the HCP Portal and can change by region and service configuration.

Vault suits organizations that need centralized, policy-controlled secrets across multiple clouds, Kubernetes clusters and on-premises systems. Its plugin model and API support complex infrastructure workflows.

The main trade-off is operational complexity. Self-managed deployments require careful configuration of storage, high availability, sealing, upgrades, backups, policies and recovery procedures.

OpenBao is a community-driven, open-source fork with Vault-compatible origins. AWS Secrets Manager, Azure Key Vault and Google Secret Manager are cloud-native choices for organizations centered on one provider.

CyberArk Conjur, Akeyless, Infisical and Doppler are additional alternatives. Their suitability depends on requirements for self-hosting, dynamic credentials, cloud integration, policy control and managed operations.

Does Vault have an API?
Yes. Vault exposes an HTTP API using REST-style methods. API routes use the /v1/ prefix, and the CLI also communicates through the API.

Does Vault offer a free trial?
HCP Vault Dedicated provides an HCP trial option. Trial limitations and current usage rates are managed through the HCP Portal.

Which operating systems support Vault?
Official installation documentation lists macOS, Windows, Linux and FreeBSD. Vault can also run in Kubernetes and container environments.

Can Vault generate database credentials?
Yes. Database secrets engines can generate dynamic credentials for supported database systems, including PostgreSQL, MySQL, SQL Server and MongoDB.

Is Vault suitable for Kubernetes?
Yes. HashiCorp documents several Kubernetes integrations, including Vault Agent Injector, Vault Secrets Operator and the Secrets Store CSI provider.

Who is Vault best for?
Vault is best suited to platform engineering, security and operations teams managing secrets across distributed or hybrid infrastructure.