Comparison
Shortspan vs HashiCorp Vault
Vault is a secrets platform you build on. Shortspan is a broker that gets developers onto servers, databases, and cloud accounts without handing them the credentials. They overlap on storing secrets and differ on almost everything else.
The short answer
If you need credentials generated on demand, PKI, encryption as a service, or an independently audited platform, Vault does far more than Shortspan does today. If your problem is a small team sharing SSH keys, database passwords, and .env files, and you want approvals and an audit trail without operating a cluster, Shortspan is the shorter path.
Choose HashiCorp Vault if
- You need dynamic secrets: database users, AWS credentials, or Kubernetes tokens created per lease and revoked automatically.
- You need PKI, transit encryption, or one of Vault’s many other secrets engines.
- You must self-host, or want source you can read and run yourself.
- You need SSO through OIDC, LDAP, or another identity provider today.
- Procurement needs a SOC 2 or ISO 27001 report from the vendor (HCP Vault Dedicated).
- Your workloads authenticate to the secret store, not only your people.
Choose Shortspan if
- You want developers to open an SSH session or database client with one command, without ever holding the key or password.
- You want time-boxed access requests with approval without buying an Enterprise licence.
- You want versioned, approval-gated runbooks next to the credentials they use.
- You do not want to operate a stateful, security-critical cluster for a small team.
- You want predictable pricing: Team is $49 per month · 5 users included.
Side by side
HashiCorp Vault and Shortspan, capability by capability.
| Capability | HashiCorp VaultHashiCorp, an IBM company | Shortspan |
|---|---|---|
| Primary job | Secrets management and encryption as a platform: storage, dynamic credentials, PKI, and encryption as a service through pluggable engines. Source | One broker for application secrets and infrastructure access (SSH, databases, AWS, Kubernetes), used from a single CLI. |
| How it runs | Self-managed (Community or Enterprise), or HashiCorp-managed as HCP Vault Dedicated. HCP Vault Secrets stopped taking new customers on 30 June 2025. Source | Hosted service. Self-hosting is listed as coming soon for Enterprise. Source |
| Source code and licence | Source available under the Business Source License 1.1 since version 1.15; not an OSI open source licence. Each release converts to MPL 2.0 four years after publication. Source | Proprietary. The source code is not public. |
| Pricing | Community Edition is free to self-host. Vault Enterprise and HCP Vault Dedicated are commercial; see HashiCorp for current pricing. Source | Free for one user. Pro $12 per month. Team $49 per month · 5 users included. Enterprise is quoted. |
| Application secrets | Versioned key/value secrets engine, plus Vault Agent to render secrets into files or environments. Source | Encrypted, versioned, project-scoped secrets with typed templates and named groups injected into a process with |
| Credentials generated per request | Yes - its defining feature. Engines generate leased, revocable credentials for databases, AWS, Kubernetes, SSH, PKI, and more. Source | No. Stored credentials are released for a short-lived grant; the credential itself stays valid until you rotate it. Dynamic credentials are listed as coming soon. Source |
| SSH server access | SSH secrets engine issues signed SSH certificates or one-time passwords. Servers are configured to trust Vault’s CA. Source | Brokers the stored key or password into the CLI’s memory for one session. Nothing is installed on the server, and traffic does not pass through Shortspan. Per-server host-key pinning, exec, and port-forwarding policy. Source |
| Database access | Database secrets engine creates per-lease database users for many databases through plugins. Connecting the client is up to you. Source | PostgreSQL and MySQL. Connects directly, through a registered SSH bastion, or by running the client on the server. Source |
| Kubernetes access | Kubernetes secrets engine generates service account tokens, and optionally service accounts, roles, and bindings, removed when the lease expires. Source | Releases a stored kubeconfig to a temporary file for one subshell and removes it on exit. Source |
| AWS access | AWS secrets engine generates IAM users or temporary STS credentials (assumed role, federation token, session token). Source | Releases stored AWS access keys into one subshell’s environment; nothing is written to ~/.aws. It does not mint temporary STS credentials. Source |
| Access requests with approval | Control groups add approval factors before a request is satisfied - Enterprise and HCP Vault Dedicated only. Source | Yes, on the Team plan. A required reason, a 1–72 hour window, approval by someone else, and automatic expiry. Source |
| Session recording | Not a Vault feature. Vault issues credentials; it does not sit in the session. | No. SSH session contents are not recorded; Shortspan records that a session was opened and how long the command ran. Listed as coming soon. Source |
| SAML / OIDC single sign-on | OIDC and JWT auth methods are available in Community Edition, alongside LDAP and many other auth methods. Source | Not yet. Sign-in is password plus optional TOTP or passkeys. SAML, OIDC, and SCIM are listed as coming soon. Source |
| Audit log | Audit devices log every request and response, with sensitive values hashed. Source | Append-only, including refusals, on the Team plan. Records that a credential was released, never its value. Source |
| Approved operational runbooks | Not a Vault feature. | Versioned runbooks with optional approval before each run. Steps run on the executor’s machine and are not sandboxed. Source |
| Independent compliance report | HCP Vault Dedicated is covered by HashiCorp’s SOC 2 Type 2 report and ISO 27001 certification. Self-managed Vault is audited as part of your own environment. Source | None yet. Controls are built with SOC 2 in mind, but no audit has been completed. Source |
Every claim on this page - about Shortspan and about the other products - was checked against the linked public source on . Products change; if something here is out of date, tell us at info@shortspan.dev and we will correct it.
Where they differ
Generating credentials versus brokering them
Vault’s defining capability is dynamic secrets. Its database, AWS, Kubernetes, and SSH engines create a credential when it is asked for and revoke it when the lease ends, so no long-lived password exists to leak.
Shortspan does not do this. It stores the credential you register, encrypts it, and releases it for a session that is authorized and recorded. The grant to use it is short-lived; the credential itself stays valid until you rotate it. If eliminating long-lived credentials is the goal, Vault is built for it and Shortspan is not.
Who connects to the server
Vault hands you a credential - a signed SSH certificate, a database username and password - and connecting is your job. That is the right design for a platform, and it is why teams pair Vault with other tools for human access.
Shortspan is the connection step. shortspan ssh prod-web brokers the key into the CLI’s memory and opens the session; shortspan db launches your database client, directly, through an SSH bastion, or on the server itself. Nothing is installed on the server, and traffic does not pass through Shortspan.
Approvals
Vault’s approval mechanism, control groups, requires Vault Enterprise or HCP Vault Dedicated.
Shortspan’s access requests are part of the Team plan: a required reason, a window from one to 72 hours, approval by someone other than the requester, and automatic expiry.
Licensing and operations
Since version 1.15 Vault is source available under the Business Source License, not an OSI open source licence; OpenBao is the community fork that stayed on MPL 2.0. Running Vault yourself means operating a security-critical cluster: storage, unsealing, upgrades, and backups. HCP Vault Dedicated moves that work to HashiCorp.
Shortspan is proprietary and, today, hosted only - self-hosting is listed as coming soon for Enterprise. There is nothing to run, but there is also no source to audit and no way to keep it inside your own network yet.
Maturity
Vault is one of the most widely deployed secrets platforms, with a large ecosystem of integrations and an independently audited managed service. Shortspan is a young product with no compliance report yet, sign-in by password with TOTP or passkeys rather than SSO, and database support limited to PostgreSQL and MySQL. Weigh that honestly.
Common questions
HashiCorp Vault or Shortspan?
- Is Shortspan a drop-in replacement for HashiCorp Vault?
- No. Shortspan has no dynamic secrets, PKI, or encryption as a service, and no auth methods for workloads beyond scoped API tokens. It replaces the part of Vault some small teams use - a shared store for credentials - and adds brokered SSH and database sessions, approvals, and runbooks that Vault does not provide.
- Can I use Shortspan and Vault together?
- They do not integrate: Shortspan cannot read from or write to Vault. Some teams could reasonably keep workload secrets in Vault and use Shortspan for people reaching servers and databases, but that means two systems to manage.
- Is Vault still open source?
- Not by the OSI definition. Vault 1.15 and later are under the Business Source License 1.1, and each release converts to MPL 2.0 four years after it is published. OpenBao, a Linux Foundation project, is an MPL 2.0 fork.
- What happened to HCP Vault Secrets?
- HashiCorp stopped selling HCP Vault Secrets to new customers on 30 June 2025 and is retiring it, pointing existing users to HCP Vault Dedicated or Vault Community Edition.
Keep comparing
Related comparisons
Try it on one project.
The free plan is enough to register a server and a secret and see whether the workflow fits.