Teams look for a HashiCorp Vault alternative for three reasons: the licence changed from open source to a source-available one after IBM took over the company, running a Vault cluster is a job in itself, or the quote for the paid editions is out of proportion to what they use. They move to the open source fork, to a hosted secrets manager priced per person or per identity, or to the secret store of the cloud they already run on.
Sebastiaan SmitsFounderShort answer: The first three alternatives to HashiCorp Vault in our secrets management tool ranking are OpenBao, Infisical and Phase. Places 1 to 3 go to challengers, vendors outside the best-known brands in a category, wherever the category has them; the established names follow from place 4 in their ranked order. Choose OpenBao if you keep the Vault design but want a licence no single company controls. All 11 alternatives below are ranked products from Best Secrets Management Tools in 2026, and each says where it differs from HashiCorp Vault.
Vendors can pay for visibility on this site; it never changes what we say about a product. How that works.
The Vault repository now carries the Business Source Licence 1.1 for version 1.15.0 and later, with IBM as licensor. Production use is allowed, but not offering Vault to third parties, hosted or embedded, in competition with IBM's paid versions. For an end user running it internally that rarely bites. For a managed-service provider or a software vendor that bundles Vault, it is the reason to look at the MPL-2.0 fork OpenBao.
Vault's own documentation recommends integrated storage and at least two audit devices, because Vault refuses to serve requests when every enabled audit device is unavailable. The same page on when not to use Vault says it can be overwhelming for limited or simple secret management needs and points to the hosted HCP Vault Dedicated. A team with fifty secrets and no platform engineer feels that sentence.
HashiCorp's own pages, which we could not read in full from outside a browser, do not publish Enterprise or HCP prices. The competing tools mostly do: per identity, per user or per secret. A buyer who wants to compare monthly cost before a call finds that Vault is the one product on the shortlist without a number.
| Alternative | Headquarters | Free option | Pricing | Key difference | Switch if | Our rank |
|---|---|---|---|---|---|---|
| OpenBao | United States | Yes | Free, open source (MPL-2.0); you run it yourself | Community fork of Vault under the Linux Foundation, licensed MPL-2.0 | you keep the Vault design but want a licence no single company controls | #2 |
| Infisical | United States | Yes | Per identity per month, published; free tier; 30-day trial on paid plans | Secrets manager with per-identity pricing and a perpetual free plan | you want published per-identity prices and a modern dashboard instead of a quote | #4 |
| Phase | Not stated by the vendor | Yes | Per human user per month, published; free tier; 14-day trial on paid plans | Per-user secrets manager where service accounts are not billed | many pipelines and services read secrets but few people log in | #1 |
| Doppler | United States | Yes | Per user per month, published; free for three users; 14-day trial on Team | Hosted secrets manager priced per user with a small free plan | you want a hosted service that costs by headcount and needs no servers of your own | #5 |
| Akeyless | Israel | Yes | Usage-based annual contracts, quoted per organisation; no prices shown | SaaS secrets platform with a starter tier and quoted enterprise plans | you want a vendor-operated service that can also sit on top of an existing Vault estate | #6 |
| SOPS | Not stated by the vendor | Yes | Free, open source (MPL-2.0); no hosted plans | Encrypts values inside YAML and JSON files, with no server | your secrets are configuration files in a repository and a server would be overkill | #3 |
| Pulumi ESC | United States | Yes | Per secret per month by edition, published; free tier of 25 secrets | Environments and secrets layer that pulls from other secret stores | you already use Pulumi and want one place to assemble secrets from several stores | #7 |
| AWS Secrets Manager | United States | No free tier | Per secret per month plus per 10,000 API calls, published; new-customer credits | Pay-per-secret store inside AWS, billed per secret and per call | your workloads run on AWS and the secret count is modest | #9 |
| Azure Key Vault | United States | No free tier | Per 10,000 transactions plus per-key HSM charges, published by tier | Secrets, keys and certificates store tied to Microsoft Entra ID | you run on Azure and want secrets, keys and certificates under one cloud contract | #11 |
| Idira Secrets Manager | United States | No free tier | Quoted per organisation; demo on request | Former CyberArk secrets product, now sold by Palo Alto Networks | you want a supported enterprise vendor and may be buying Palo Alto products anyway | #12 |
| Delinea Secret Server | United States | No free tier | Quoted per organisation; 30-day trial | Privileged credential vault for admin, service and root accounts | the real need is controlling admin and service accounts, not feeding secrets to applications | #8 |
United States · Free, open source (MPL-2.0); you run it yourself
OpenBao is the fork run through the OpenSSF at the Linux Foundation under MPL-2.0, with the same design: key/value storage, dynamic secrets, leases, revocation and encryption as a service. It has no vendor, no price and no hosted offer, and it is a Sandbox project, so you operate it yourself.
Switch from HashiCorp Vault if you keep the Vault design but want a licence no single company controls.
United States · Per identity per month, published; free tier; 30-day trial on paid plans
Infisical charges per identity, human or machine, at $20 a month on Pro and $40 on Advanced when billed annually, with a free plan of five identities. Dynamic secrets start on Advanced, and self-hosting or dedicated infrastructure sits on Enterprise. The core is smaller than Vault's engine catalogue.
Switch from HashiCorp Vault if you want published per-identity prices and a modern dashboard instead of a quote.
Infisical, #4 of 12 in our secrets management tool ranking →
Not stated by the vendor · Per human user per month, published; free tier; 14-day trial on paid plans
Phase bills only human users, $10 a month on Pro and $25 on Enterprise, while service accounts are unlimited from Pro upward. A self-hosted free plan has unlimited users. Dynamic secrets, SCIM and OIDC single sign-on wait for Enterprise, so its depth is lower than Vault's.
Switch from HashiCorp Vault if many pipelines and services read secrets but few people log in.
United States · Per user per month, published; free for three users; 14-day trial on Team
Doppler is a hosted service billed per seat: free for three users, then $21 a month per user on Team, with AI agents and non-human identities not charged according to its pricing page. Dynamic secrets, key management and on-prem deployment are Enterprise only, so a self-run setup means a custom contract.
Switch from HashiCorp Vault if you want a hosted service that costs by headcount and needs no servers of your own.
Israel · Usage-based annual contracts, quoted per organisation; no prices shown
Akeyless runs as pure SaaS or as hybrid SaaS with gateways in your network, and it can govern other vaults, including HashiCorp Vault, through connectors counted per vault. Contracts are annual and quoted; the free tier holds five clients and 500 static secrets. Audit logs on it last three days.
Switch from HashiCorp Vault if you want a vendor-operated service that can also sit on top of an existing Vault estate.
Not stated by the vendor · Free, open source (MPL-2.0); no hosted plans
SOPS is not a server. It encrypts the values in YAML, JSON, INI and dotenv files so they can live in Git, with keys from age, PGP, a cloud KMS, Vault or OpenBao. It issues no short-lived credentials and keeps no access policy of its own. It is free under a CNCF Sandbox project.
Switch from HashiCorp Vault if your secrets are configuration files in a repository and a server would be overkill.
United States · Per secret per month by edition, published; free tier of 25 secrets
Pulumi ESC groups secrets and configuration into environments and pulls values from AWS Secrets Manager, Azure Key Vault, GCP Secret Manager, HashiCorp Vault and 1Password. Pulumi's pricing page bills ESC secrets per month by edition, from $0.50. It orchestrates stores and is not a vault with engines of its own.
Switch from HashiCorp Vault if you already use Pulumi and want one place to assemble secrets from several stores.
Pulumi ESC, #7 of 12 in our secrets management tool ranking →
United States · Per secret per month plus per 10,000 API calls, published; new-customer credits
AWS Secrets Manager has no cluster to run. The worked examples on its pricing page use $0.40 per secret per month and $0.05 per 10,000 API calls, with replicas billed as separate secrets. It serves AWS workloads; it is not a multi-cloud store and has no equivalent of Vault's engine catalogue.
Switch from HashiCorp Vault if your workloads run on AWS and the secret count is modest.
AWS Secrets Manager, #9 of 12 in our secrets management tool ranking →
United States · Per 10,000 transactions plus per-key HSM charges, published by tier
Azure Key Vault holds secrets, keys and certificates in Standard or Premium vaults, with a separate Managed HSM pool for HSM-backed keys. The pricing page bills operations per 10,000 transactions, but the figures did not render in our fetch. Access follows Azure identity, so it suits Azure estates only.
Switch from HashiCorp Vault if you run on Azure and want secrets, keys and certificates under one cloud contract.
Azure Key Vault, #11 of 12 in our secrets management tool ranking →
United States · Quoted per organisation; demo on request
Idira Secrets Manager is the secrets product of Palo Alto Networks, deployable as SaaS or self-hosted, with policy-driven rotation, expiry and a universal cryptographic identity for each workload. No price is shown, only a demo request, and it is sold alongside a wider security portfolio.
Switch from HashiCorp Vault if you want a supported enterprise vendor and may be buying Palo Alto products anyway.
Idira Secrets Manager, #12 of 12 in our secrets management tool ranking →
United States · Quoted per organisation; 30-day trial
Delinea Secret Server is a privileged-credential vault with account discovery, password rotation, check-in and check-out, approval workflows and session recording. It targets administrator, service and root accounts rather than application secrets fetched at runtime. A 30-day trial is offered; pricing is by contact.
Switch from HashiCorp Vault if the real need is controlling admin and service accounts, not feeding secrets to applications.
Delinea Secret Server, #8 of 12 in our secrets management tool ranking →
Vault stays the right choice when you need what the other products only partly cover: dynamic credentials for databases and clouds, a catalogue of secrets engines and authentication methods, encryption as a service, and replication across clusters under one policy language. If a platform team already runs it and the BSL terms do not touch your use, the licence is a footnote and a move would cost months. The cases for switching are the competing-offer clause, the operational load for a small team, or a quote that does not fit.
Key/value data can be exported and re-imported by script. The dynamic part is different: database and cloud credentials generated on demand by Vault engines have to be rebuilt in the new product, and several alternatives here (Doppler, Phase, Infisical) hold dynamic secrets back for their higher plans. List which engines you actually use before comparing.
Vault policies are path-based rules attached to tokens, and applications log in through methods such as AppRole, LDAP or cloud identity. Only OpenBao keeps that model. For every other tool, expect to redo access rules in its own role system and change each application's login code or agent configuration.
Run the new store next to Vault for one release cycle and cut services over one at a time. Keep the Vault audit log for as long as your retention rules require, since the new product's log is a different format and some free tiers keep logs for only three days.
No for current versions. The Vault repository states the Business Source Licence 1.1 for version 1.15.0 and later, with IBM Corp as licensor.
It allows production use and source access, but not offering Vault to third parties on a paid hosted or embedded basis that competes with IBM's paid versions. The licence names MPL 2.0 as the change licence four years after each version is published.
OpenBao. It is a fork of Vault managed by the Linux Foundation's OpenSSF, licensed MPL-2.0, and listed as a Sandbox project.
It keeps Vault's concepts of tokens, path-based policies, leases and dynamic secrets. Nobody sells it as a service in its own name, so you run and upgrade it yourself.
Infisical gives five identities, Doppler three users, Phase five users or service accounts in the cloud and unlimited users when self-hosted, and Akeyless five clients.
AWS gives new customers up to $200 in Free Tier credits that can apply to Secrets Manager. OpenBao and SOPS are free software, with your own running costs.
HashiCorp sells HCP Vault Dedicated, a hosted Vault Enterprise operated by HashiCorp on AWS or Azure. Among the alternatives, Infisical, Doppler, Phase and Akeyless offer hosted services, and AWS Secrets Manager and Azure Key Vault are managed by the cloud provider.
Yes. Akeyless offers connectors that govern other vaults including HashiCorp Vault, Pulumi ESC can import secrets from Vault, and SOPS can use Vault or OpenBao as a key store.
These add a layer without a migration, but they also add a second bill and a second system to understand.
For a handful of people, Phase and Doppler cost nothing within their free limits and then charge per human user. AWS Secrets Manager is cheap at low secret counts: fifteen secrets cost about $6 a month in AWS's own example.
At large counts of short-lived secrets the per-secret meter climbs; the same page shows $2,850 a month for five million hourly secrets.
Founder of The Knowledge Engineers and of 2 Steps Ahead, an AI search visibility agency. Editorially responsible for every page on this site; research and drafting are AI-assisted.
Written, edited and fact-checked by Sebastiaan Smits. Last reviewed 27 October 2026. How we review.
