Alternatives
HashiCorp Vault alternatives
There is no single replacement for Vault, because people leave it for different reasons. Start from yours: the licence, the operating burden, the price, or the fact that you only ever used a fraction of it.
Shortspan is one of the options below. It is listed with its limits, the same as everything else.
Why teams look
The licence changed
Vault 1.15 and later are under the Business Source License 1.1 rather than an OSI open source licence. For teams with an open source requirement, OpenBao - the MPL 2.0 fork under the Linux Foundation’s OpenSSF - is the closest like-for-like option.
HCP Vault Secrets is being retired
HashiCorp stopped selling its lighter hosted product to new customers on 30 June 2025, pointing users to HCP Vault Dedicated or Community Edition. Teams that chose it for simplicity are looking for something similarly simple.
Operating it is a job
Self-managed Vault is a security-critical, stateful cluster: storage, unsealing, upgrades, and backups. Small teams that use it as a shared password store often want a hosted product instead.
The shortlist
5 alternatives to HashiCorp Vault
A community-driven, open source fork of HashiCorp Vault, governed under the Linux Foundation’s Open Source Security Foundation.
Best for: Teams that want Vault’s model and APIs under an open source licence, and are prepared to run it.
Trade-offs: You still operate the cluster. There is no managed service from the project, and its core documentation has no AWS secrets engine.
An open-core platform covering secrets management, certificate management, and privileged access, available as a cloud service or self-hosted.
Best for: Teams that want an open-core platform, hosted or self-hosted, with dynamic secrets, rotation, PKI, and privileged access.
Trade-offs: Enterprise features are under a commercial licence, and secrets and privileged access are priced as separate products.
AWS’s managed secrets store, controlled with IAM and integrated with other AWS services.
Best for: Workloads that run entirely on AWS and are already governed by IAM.
Trade-offs: No dynamic credentials per request, no access workflow beyond IAM, and per-secret pricing that grows with the number of secrets.
A hosted secrets manager for application configuration that syncs secrets to the platforms and CI systems where code runs.
Best for: Application configuration across many services, platforms, and CI pipelines.
Trade-offs: Proprietary and hosted; dynamic secrets are Enterprise-only, and it does not broker access to servers or databases.
A credential broker: secrets, SSH servers, databases, AWS accounts, and Kubernetes clusters are registered once, encrypted, and reached through one CLI, with every release recorded.
Best for: Small teams whose real problem is shared SSH keys, database passwords, and .env files, and who want approvals and an audit trail without operating anything. Team is $49 per month · 5 users included.
Trade-offs: No dynamic secrets, PKI, or SSO yet, no compliance report, proprietary, and hosted only for now. It replaces the credential-store part of Vault, not the platform.
At a glance
HashiCorp Vault and its alternatives.
| Capability | HashiCorp VaultHashiCorp, an IBM company | OpenBaoOpenBao, an OpenSSF project | Infisical | AWS Secrets ManagerAmazon Web Services | Doppler | Shortspan |
|---|---|---|---|---|---|---|
| How it runs | Self-managed (Community or Enterprise), or HashiCorp-managed as HCP Vault Dedicated. HCP Vault Secrets stopped taking new customers on 30 June 2025. Source | Self-hosted software. The project itself does not sell a managed service. Source | Infisical Cloud in US and EU regions, or self-hosted. Source | A managed AWS service in your AWS account. | Hosted. The Enterprise plan lists an on-premises option. Source | Hosted service. Self-hosting is listed as coming soon for Enterprise. Source |
| Source code and licence | Source available under the Business Source License 1.1 since version 1.15; not an OSI open source licence. Each release converts to MPL 2.0 four years after publication. Source | Open source under MPL 2.0. Source | Open core: MIT licence outside the | Proprietary AWS service. | The platform is proprietary. The CLI is open source under Apache 2.0. Source | Proprietary. The source code is not public. |
| Pricing | Community Edition is free to self-host. Vault Enterprise and HCP Vault Dedicated are commercial; see HashiCorp for current pricing. Source | Free. You pay for the infrastructure and the people who run it. | Secrets: Free (5 identities), Pro $20 and Advanced $40 per identity per month billed annually. Privileged access: Pro $20 per user per month. Enterprise is quoted. Source | $0.40 per secret per month plus $0.05 per 10,000 API calls. Source | Developer: free for 3 users, then $8 per additional user per month. Team: $21 per user per month. Enterprise is quoted. Source | Free for one user. Pro $12 per month. Team $49 per month · 5 users included. Enterprise is quoted. |
| Credentials generated per request | Yes - its defining feature. Engines generate leased, revocable credentials for databases, AWS, Kubernetes, SSH, PKI, and more. Source | Dynamic credentials for databases, Kubernetes, LDAP, RabbitMQ, and SSH, plus PKI certificates. Source | Dynamic secrets from the Advanced plan; rotation (for public databases) from Pro. Its access product mints a short-lived SSH certificate per session. Source | Automatic rotation: managed rotation for secrets owned by AWS services and partners, a Lambda function for the rest. It does not issue a new credential per request. Source | Dynamic secrets on Enterprise. Automatic secret rotation from the Team plan. Source | No. Stored credentials are released for a short-lived grant; the credential itself stays valid until you rotate it. Dynamic credentials are listed as coming soon. Source |
| SSH server access | SSH secrets engine issues signed SSH certificates or one-time passwords. Servers are configured to trust Vault’s CA. Source | SSH secrets engine for signed certificates. Source | Privileged access product: certificate-based SSH through a browser terminal or the CLI, with a gateway for private networks. Source | Stores keys as secrets; it does not broker SSH sessions. | Doppler can store an SSH key as a secret, but it does not broker SSH sessions. | Brokers the stored key or password into the CLI’s memory for one session. Nothing is installed on the server, and traffic does not pass through Shortspan. Per-server host-key pinning, exec, and port-forwarding policy. Source |
| Database access | Database secrets engine creates per-lease database users for many databases through plugins. Connecting the client is up to you. Source | Database secrets engine generates per-lease database users. Source | Privileged access product: PostgreSQL, MySQL, SQL Server, MongoDB, and Redis. Source | Stores and rotates database credentials; it does not open connections. | Stores and rotates database credentials as secrets; it does not open database connections. | PostgreSQL and MySQL. Connects directly, through a registered SSH bastion, or by running the client on the server. Source |
| Access requests with approval | Control groups add approval factors before a request is satisfied - Enterprise and HCP Vault Dedicated only. Source | No built-in access request and approval workflow. | Access requests with approval in the privileged access product (Pro); secrets approval workflows on Enterprise. Source | Access is decided by IAM policy. There is no built-in request and approval workflow. | Change requests on Team and change-request policies on Enterprise - approval for changing secrets rather than for temporary access. Source | Yes, on the Team plan. A required reason, a 1–72 hour window, approval by someone else, and automatic expiry. Source |
| Audit log | Audit devices log every request and response, with sensitive values hashed. Source | Audit devices, as in Vault. Source | Audit logs: 30-day retention on Pro, 90 on Advanced, streaming and custom retention on Enterprise. Source | API activity is logged in AWS CloudTrail. Source | Activity logs: 3 days on Developer, 90 days on Team, custom retention on Enterprise. Source | Append-only, including refusals, on the Team plan. Records that a credential was released, never its value. Source |
Every claim on this page - about Shortspan and about the other products - was checked against the linked public source on . Products change; if something here is out of date, tell us at info@shortspan.dev and we will correct it.
How to choose
Start from what you actually use.
- If you rely on dynamic secrets, PKI, or transit encryption, shortlist OpenBao or Infisical - the hosted secrets stores will not replace them.
- If the licence is the issue and you are happy operating Vault, OpenBao is the smallest change.
- If everything runs on AWS, AWS Secrets Manager avoids a new vendor.
- If you only used Vault to share credentials among people, a smaller hosted tool will cost less to run. Choose by what people need to reach: application config (Doppler, Infisical) or servers and databases (Infisical, Shortspan).
Common questions
Moving off HashiCorp Vault
- What is the best open source alternative to HashiCorp Vault?
- OpenBao is the closest: a fork of Vault, licensed under MPL 2.0 and governed under the Linux Foundation’s OpenSSF. Infisical’s core is MIT-licensed but is a different product with a different model.
- Is there a hosted alternative to HCP Vault Secrets?
- HashiCorp itself points to HCP Vault Dedicated. Outside HashiCorp, Doppler, Infisical Cloud, AWS Secrets Manager, and Shortspan are hosted - compare them on what you actually stored in HCP Vault Secrets.
Keep comparing
Related comparisons
See whether Shortspan fits.
The free plan is enough to register a server and a secret and try the workflow on one project.