HashiCorp Vault review

Vault is a secrets-management server, not a secrets file format or a client-side library. It stores sensitive values in configured physical storage and provides controlled access through a UI, CLI, or HTTP API. Applications and infrastructure use it as a central service for passwords, tokens, certificates, encryption keys, and other sensitive data.

In a stack, Vault sits between workloads that need secrets and the systems or operators that manage access to them. Its key-value secrets engine stores arbitrary secrets. The database secrets engine can generate credentials from preconfigured roles, while the transit secrets engine provides encryption as a service. Those capabilities let applications request credentials or encryption operations rather than keeping every secret in application configuration.

You can run Vault yourself or use HCP Vault Dedicated, HashiCorp's hosted service. The self-managed route makes Vault part of your infrastructure to operate; the hosted route shifts cluster operations to the service while billing by cluster hour and Vault client.

The homepage names three access surfaces: a UI, CLI, and HTTP API. The CLI is useful for operator workflows and scripting; application integrations can use the HTTP API to access Vault. HashiCorp organizes its developer resources around installation, tutorials, documentation, APIs, CLI guidance, and integrations. It also provides a Vault sandbox with preinstalled tools and services for experimentation.

The homepage does not name programming languages or SDKs. Confirm SDK availability and support for your language in HashiCorp's documentation before choosing an integration path; otherwise, plan around the HTTP API and verify the specific endpoints and authentication workflow your application needs. The listed integration resources are a starting point, not a guarantee that every framework has a maintained client.

The docs also cover use cases such as secrets management, database credential management, encryption, and Enterprise disaster-recovery replication. That gives teams a path from basic secret reads to specialized engines, but designing policies, authentication, and application behavior still requires Vault-specific work.

Vault has no HCP free plan in the listed pricing. The self-managed community edition is available without an Enterprise subscription, but its source-available BSL license differs from an open-source license. For hosted evaluation, Development (IBM HCP Vault Dedicated) starts at $0.62 per cluster per hour and includes up to 25 clients. Essentials starts at $1.58 per cluster per hour; Standard starts at $1.85. Essentials and Standard also list $73 per Vault client per month, and both include $500 in HCP trial credit.

HCP bills by cluster hour, so the cluster charge accumulates while the service runs; client charges add another usage-based line on Essentials and Standard. Monthly and annual prices are not published for Development, and client limits are not published for Essentials or Standard. Flex and Enterprise Self Managed use custom pricing, with usage limits not published. Ask HashiCorp to confirm expected client counts, billing treatment, and any plan-specific limits before sizing a production deployment.

Vault can be self-hosted; HashiCorp lists Enterprise Self Managed, and community discussion distinguishes a free self-hosted version from Enterprise. Reddit users describe Vault's current license as BSL, or Business Source License: source-available, but not an OSI-approved open-source license. Check the license terms that apply to the version and use case you intend to deploy.

Vault stores secrets in configured physical storage and exposes access through its HTTP API. That gives teams a service interface for reading and managing secrets, but do not assume that moving data to another product is a one-step export. Plan to map secrets, policies, authentication methods, and engine-specific behavior, then confirm export and restore procedures for your deployment. HashiCorp's homepage does not describe a standard export workflow.

Migration effort will depend on how much of your stack relies on Vault-specific engines and integrations. Keep secrets and policy definitions documented, and test recovery and migration processes before Vault becomes a critical dependency.

Vault handles sensitive credentials, so production design needs to cover access policy, authentication, storage, backup, recovery, and upgrades. HashiCorp's tutorials include disaster-recovery replication for Vault Enterprise. Reddit commenters report that the open-source version does not support active-active cluster nodes; verify current edition and version behavior with HashiCorp before treating that as a deployment constraint. Ask the vendor about rate limits and applicable HCP client limits when sizing a service, since those details affect application design and cost.

Operational care is a recurring concern in user reports. One Reddit commenter described an aging, unmanaged installation that caused breakage and failed deployments, including problems with a Vault mutating webhook during rapid pod scaling. Another called out restoring the secret store in a new cluster. These are reports about particular deployments, not a guarantee of failure, but they make upgrades, restore drills, and scaling tests important parts of operating Vault. HCP Dedicated reduces self-management work, while introducing hourly cluster and client charges.