"HashiCorp Vault pricing" is a confusing search because the answer is three different things depending on which Vault you mean, and the headline answer — the community edition is free — is the least useful of them.
Three products:
- Vault Community Edition — free to download and self-host, under the Business Source Licence
- HCP Vault Dedicated — HashiCorp's managed service, hourly per cluster
- Vault Enterprise — self-hosted with enterprise features, priced by sales conversation
Two of the three have no published price you can act on, which is itself informative about who the product is for.
Vault Community Edition
Free to download, no licence fee, and it does the core job: key/value secrets, dynamic secrets for databases and cloud providers, PKI, encryption as a service, policies, audit devices.
Licence caveat. In 2023 HashiCorp moved from the Mozilla Public Licence to the Business Source Licence. In practice it means you can use Vault freely unless you are offering a competing hosted Vault service. For almost everyone that changes nothing legally, but it prompted the OpenBao fork under the Linux Foundation for organisations that want an OSI-approved licence. HashiCorp was acquired by IBM in 2025, which has not changed the licence but is worth knowing when you assess long-term direction.
The real cost is operational. Vault is not a thing you install and forget:
- Servers. A production Vault runs in high availability, so three or five nodes, plus storage. On modest cloud instances that is roughly $100 to $300 a month before anything else.
- Unsealing. Vault starts sealed and needs unsealing before it serves requests. Auto-unseal with a cloud KMS is the sensible approach and adds a small KMS cost and setup work.
- Upgrades, backups, monitoring. Yours to own.
- Someone who understands it. This is the big one. Vault has real depth — policies, auth methods, secret engines, leases, tokens. Somebody on the team has to hold that model in their head, and that person's time is the dominant cost.
For an organisation with a platform team, this is normal infrastructure. For four developers who want to stop sharing a .env file, it is a second product to run alongside the one you are trying to ship.
HCP Vault Dedicated
HashiCorp's managed offering, billed hourly per cluster, so the cost depends on tier, size and region. There is a free development tier for evaluation, and production tiers run from roughly a few hundred dollars a month upward for a small production cluster. Check HashiCorp's pricing page for current figures; they are tiered and change.
What you get is the operational burden removed. What you do not get is a cheaper Vault — managed Vault is priced as infrastructure, not as a small-team tool.
Vault Enterprise
No public pricing. Adds replication, disaster recovery, namespaces, HSM support, FIPS compliance and support SLAs. It is sold to organisations, and if you are reading this to work out whether you can afford it, you almost certainly do not need it.
Comparing on a small-team basis
Take five developers who need shared secrets across three environments.
| Option | Monthly cost | What you run |
|---|---|---|
| Vault Community, self-hosted HA | ~$100–300 infra, plus your time | Everything |
| HCP Vault Dedicated | Hundreds, tier-dependent | Nothing |
| Doppler Team | $105 at $21/user | Nothing |
| AWS Secrets Manager | ~$12 for 30 secrets | Nothing, but no team workflow |
| Krypt | £10 flat | Nothing |
The comparison is slightly unfair in both directions. Vault does things nothing else on that list does — dynamic database credentials with short TTLs, PKI, transit encryption. And the others do things Vault does not, like a workflow designed for a developer syncing a .env to a laptop.
Which is really the point. The question is not whether Vault is expensive. It is whether you need what Vault does.
When a small team should use Vault
- You need dynamic secrets: credentials generated on demand, expiring after an hour, so a leak has a short blast radius
- You need to issue and rotate internal TLS certificates
- You have a compliance requirement naming Vault or requiring HSM-backed keys
- You already run Kubernetes and have someone who owns platform infrastructure
When it is the wrong tool
- The problem is "our four developers share a .env file over Slack" — the everyday secrets management case, not the enterprise one
- Nobody on the team wants to own another piece of infrastructure
- You need it working this week
- The main thing you want is a CLI that pulls the right environment variables onto a laptop
If that is you, the comparison post covers the alternatives, including Krypt, which we build. We would rather say plainly that Vault is a more capable product than pretend otherwise — it is aimed at a different problem, and using it for a small team's .env sync is a lot of machine for a small job.
OpenBao
Worth knowing: OpenBao is the community fork created after the licence change, now under the Linux Foundation. Same core functionality, OSI-approved licence, growing independently. If your objection to Vault is the BSL rather than the complexity, it is the direct answer. It does not reduce the operational burden.
FAQ
Is HashiCorp Vault free? The Community Edition is free to download and self-host under the BSL. Running it in production costs infrastructure and engineering time. HCP Vault Dedicated and Vault Enterprise are paid.
How much does HCP Vault cost? Billed hourly per cluster with tiered pricing. There is a free development tier; production tiers start in the hundreds per month. Check HashiCorp's current pricing page.
What is the BSL and does it affect me? The Business Source Licence permits use except for offering a competing hosted service. It affects almost nobody in practice, and OpenBao exists for those who need an OSI-approved licence.
Is Vault overkill for a small team? Usually, yes, if your problem is sharing environment variables. If you need dynamic credentials or PKI, it is the right tool regardless of team size.
What is the cheapest way to run Vault? A single-node instance with file storage is cheapest and is not production-safe. Real HA means three or five nodes plus storage plus auto-unseal.
Did IBM buying HashiCorp change the pricing? The acquisition completed in 2025 and did not change the licensing model. Long-term direction is worth watching if you are committing to it.