HashiCorp Vault review

HashiCorp Vault stores and manages sensitive values such as passwords, tokens, certificates, and encryption keys. Teams control access through a UI, CLI, or HTTP API, according to the product homepage. The basic job is to keep secrets out of application code and make access to them centrally manageable.

Vault also goes beyond static storage. Its key-value secrets engine persists arbitrary values in Vault’s configured physical storage, while its database feature can generate credentials from preconfigured roles. Transit encryption provides encryption as a service. The Enterprise-only secret transformation feature maps sensitive data to cryptographically secure tokens.

Vault can be self-managed or bought as HCP Vault Dedicated, according to the listed plans. Those options carry different operating responsibilities and pricing; the product name alone does not tell you what you’ll pay or maintain.

Vault’s appeal is control: teams can centralize secrets and decide who or what can access them, rather than scattering credentials across application settings. It covers several jobs in one platform, including key-value storage, database credential generation, transit encryption, and access control. That can suit organizations with varied systems and security requirements better than a secrets store limited to one cloud provider or one kind of value.

The product offers UI, CLI, and HTTP API access, so teams can work with Vault through different interfaces. A commenter in a Reddit discussion also describes Vault as well integrated with HashiCorp’s other tools, though that is a user’s assessment rather than a guarantee about every setup.

The hosted plans include a development option capped at 25 clients, plus Essentials and Standard tiers. Essentials and Standard list a $500 HCP trial credit. Organizations that want to manage Vault themselves can ask sales about the Enterprise Self Managed plan; the listed terms are custom, not a published rate card.

The hosted pricing is hard to forecast from the published figures. Development starts at $0.62 per cluster per hour and allows up to 25 clients. Essentials starts at $1.58 per cluster per hour, and Standard at $1.85; both also list $73 per Vault client per month. Client caps for those tiers are not published, and monthly or annual totals are not published. Flex and Enterprise Self Managed have custom pricing and unpublished usage limits. The listed pricing has no free plan, though a Reddit commenter distinguishes it from a free self-hosted edition.

Self-managing Vault avoids the hosted cluster bill but leaves upkeep to your team. Reddit users report that an unmanaged installation can become a source of breakage, and one commenter says the open-source version lacks active-active cluster nodes. These are user reports, not a complete statement of current product limits. Reddit discussions also raise licensing concerns and point to OpenBao, a fork; check current terms before switching or upgrading. For a secrets store used only by CI/CD, the cost and maintenance may outweigh the additional control.

HCP Vault Dedicated pricing is hourly at the cluster level, with additional per-client fees on Essentials and Standard. Development starts at $0.62 per cluster per hour and includes up to 25 clients. Essentials starts at $1.58 per cluster per hour—about 2.5 times Development’s cluster rate—and adds $73 per Vault client per month. Standard starts at $1.85 per cluster per hour, with the same $73-per-client monthly charge. Client limits for Essentials and Standard are not published, so the total depends on cluster hours and client count.

Both Essentials and Standard list $500 in HCP trial credit; that is not a published free plan. Flex offers custom single- or multi-year terms, and Enterprise Self Managed is custom via sales. Prices and usage limits for both are not published. The billing gotcha: hourly cluster rates are not all-in monthly prices. Confirm client limits and expected charges before comparing hosted Vault with self-managed alternatives.

Switching to Vault means planning how secrets, access rules, and application connections will move—not just copying values into storage. Vault supports control through a UI, CLI, or HTTP API, and its features include dynamic database credentials and transit encryption. If you leave, applications using those workflows may need new integrations or replacement services. That can make a simple secrets-only move quite different from replacing a deeper Vault setup.

The published material does not specify a bulk export format, migration tooling, or supported import path. Confirm those details before planning a migration, and inventory secrets, roles, and dependent applications first. The product information also does not establish that Vault is difficult to leave; the integration work depends on how your team uses it. We don't have Reddit posts in the published sources, so we can't verify recurring reasons users leave or attribute specific complaints to Reddit.