HashiCorp Vault is a source-available secrets manager for teams whose applications, databases, and cloud accounts need credentials that are issued on demand, rotated automatically, and audited on every request. It serves platform and security engineers running dynamic infrastructure on premises, in the cloud, or across both.[1][2][3]
Quick verdict
Platform teams that centralize machine and application secrets across cloud and on-premises systems benefit most from HashiCorp Vault. Its decisive capability is issuing short-lived dynamic credentials for databases and cloud accounts with automatic rotation, backed by a full audit log. Its material constraint is operational weight: production clusters need unsealing, storage backups, upgrades, and monitoring, so teams with a handful of static secrets should choose something lighter. If you need audited dynamic secrets at scale, run Vault; if you mainly sync static secrets into apps with less operations, evaluate Infisical.[1][2][3]
Inspected G2 HashiCorp Vault review listing (4.6 out of 5, 156 reviews) plus two short labelled excerpts from named individual reviews, observed October 2026. · 1 cited community sources. Two individual G2 reports only; no prevalence claim can be made. G2 reviewers skew toward teams invested enough to review, and full review texts were not reproduced.
Key features
Dynamic database and cloud credentials Issues short-lived credentials on demand with automatic rotation, so leaked passwords expire instead of lingering in config files.[1][2]
Versioned static secrets Keeps API keys and certificates in key-value engines with version history for safe rollback.[1]
Transit encryption as a service Encrypts and decrypts application data through Vault, removing the need to run separate cryptography infrastructure.[1]
Fourteen-plus auth methods Authenticates people and workloads via Kubernetes, cloud IAM, LDAP, OIDC, Okta, AppRole, and more, with SAML and SPIFFE gated to Enterprise.[1]
Policy and audit on every request Checks each call against policies and records it in a detailed audit log for privileged-access review.[1]
Agent, injector, and CSI delivery Puts secrets into applications through Vault Agent, the Kubernetes injector, or the Secrets Store CSI provider without baking them into images.[1]
Raft HA with Enterprise replication Runs high-availability clusters on integrated storage, with cross-datacenter replication on Enterprise plans.[1][2]
Versioned HTTP API, CLI, and UI Drives every operation through routes under /v1/, consumed by the CLI, the web UI, and automation alike.[1]
Who will love it
Centralizing machine secrets: one policy and audit plane replaces credentials scattered across repos, CI variables, and dashboards.[1][2]
Regulated workloads needing audit trails: per-request logging and fine-grained policies map directly onto privileged-access reviews.[1]
Kubernetes shops issuing cloud credentials: the operator, injector, and CSI provider fit naturally into container delivery pipelines.[1]
Who should avoid it
Teams with a handful of static secrets: unsealing, backups, upgrades, and monitoring outweigh the benefit when rotation and audit needs are minimal.[1][2]
Shops without operators to run it: an inspected G2 reviewer calls the architecture very complex with a limited knowledge pool, making an unmanaged cluster a staffing risk.[1]
Builders wanting pure no-code secret sync: Vault assumes engineers who can wire agents, policies, and engines together.[1][2]
Compatibility
Runs as a single binary with integrated Raft storage, as Docker containers, or on Kubernetes via the official Helm chart, on macOS, Windows, Linux, and FreeBSD.[1][2]
Integrates with Kubernetes, cloud IAM, LDAP, OIDC, and Okta for authentication, and delivers secrets through Agent, injector, or CSI.[1]
Managed alternative available as HCP Vault Dedicated; every operation is also reachable through the versioned HTTP API for automation.[1][2]
How people experience it
Exact excerpt
generate temporary credentials on demand, which automatically expire
G2 review of HashiCorp Vault, 5 out of 5 stars, posted 19 June 2026. Excerpt of a longer review praising dynamic secrets.
Exact excerpt
It's very complex to architect, and there's a limited knowledge pool available
G2 review of HashiCorp Vault, 4.5 out of 5 stars, posted 23 April 2026. Excerpt noting architecture complexity.
Questions worth asking
What is the best HashiCorp Vault alternative for non-technical users?
Infisical is the conditional pick among catalogue options: it stores application secrets and syncs them into the platforms that need them with less operational machinery. Vault itself assumes engineers, so non-technical teams should prefer a sync-oriented secrets tool over running a Vault cluster.[1]
Is HashiCorp Vault really no-code?
How much does HashiCorp Vault cost per month?
The self-hosted community edition carries no licence fee; you pay only your own infrastructure. HCP Vault Dedicated bills pay-as-you-go hourly (third-party reports put a small cluster near $1.58 per hour before spend) with a $500 credit for the first 60 days, checked October 2026. Enterprise self-managed plans are custom quote-based, so there is no official fixed monthly price.[1][2]
Can you self-host HashiCorp Vault?
Yes. Official guides document single-binary installs, Linux packages, Docker images, and Kubernetes deployment via the Helm chart and Secrets Operator, on macOS, Windows, Linux, and FreeBSD. The BSL-1.1 licence permits production use but bars offering Vault itself as a competing hosted service.[1][2][3]
Sources and editorial review
Source research. Reviewed on October 11, 2026. Written by Sanjib Sah. AI assisted; reviewed by a human editor.
We have not run or tested this product.
Inspected G2 HashiCorp Vault review listing (4.6 out of 5, 156 reviews) plus two short labelled excerpts from named individual reviews, observed October 2026. Two individual G2 reports only; no prevalence claim can be made. G2 reviewers skew toward teams invested enough to review, and full review texts were not reproduced.
- What is Vault? - HashiCorp Developer
official · Observed October 5, 2026
Core definition, engines, auth, audit, HA, HCP managed offering, and obtain methods used across the article.
- Install Vault - HashiCorp Developer
official · Observed October 5, 2026
Platform list and active release lines supporting install and self-host claims.
- HTTP API - HashiCorp Developer
official · Observed October 5, 2026
HTTP API coverage supporting the API/CLI/UI feature claim.
- Auth Methods - HashiCorp Developer
official · Observed October 5, 2026
Auth method index supporting the authentication feature claim and Enterprise gating.
- Run Vault on Kubernetes - HashiCorp Developer
official · Observed October 5, 2026
Kubernetes delivery and Enterprise replication supporting Agent/operator and HA claims.
- LICENSE - hashicorp/vault (main)
official · Observed October 5, 2026
Licence text supporting BSL-1.1 classification and the competing-hosted-service restriction.
- hashicorp/vault repository record - GitHub API
official · Observed October 5, 2026
Repository identity, language, and activity supporting name, stack, and active-status fields.
- hashicorp/vault - GitHub
official · Observed October 5, 2026
Repository identity confirmation.
- HashiCorp Vault product page
official · Observed October 5, 2026
Product-page identity anchor alongside the docs hub.
- HashiCorp Vault Reviews - G2
community · Observed October 11, 2026
Inspected review listing and the two selected short excerpts used as testimonials and community analysis.
- HCP Vault Dedicated Pricing - HashiCorp
official · Observed October 11, 2026
Pay-as-you-go posture, credit, tier features, and quote-based Enterprise plans supporting the cost FAQ.
Compared with these products
No explicit proprietary baseline is recorded.