HashiCorp Vault Pricing: What It Actually Costs in 2026

Try to answer a simple question — "how much does HashiCorp Vault cost?" — and you'll quickly discover why so many teams get stuck. There are three different editions with three completely different pricing models. Enterprise has no public price list at all. The managed cloud tiers have been renamed more than once. One product (HCP Vault Secrets) is being retired entirely this year. And since HashiCorp became part of IBM, the pricing pages themselves have been reshuffled.

This guide cuts through that. We'll explain what each Vault edition actually costs, where the published numbers are (and what they say), which costs are quote-only, and — most importantly — the cost drivers that determine your real bill: clusters, clients, support tiers, and the operational overhead that never shows up on a pricing page.

One honest note up front: we build EnvManager, a lighter-weight secrets manager that competes with Vault for some use cases. We'll flag where our perspective is relevant, but the pricing facts below come from HashiCorp's own published pages and pricing tables, current as of June 2026. Pricing changes — always confirm against HashiCorp's pricing page before budgeting.

The Three Vault Editions Explained

Vault isn't one product with one price. It's three distinct offerings:

Vault Community Edition (free, but no longer open source)

The self-hosted Community Edition is free to download and run. Since August 2023, however, it's licensed under the Business Source License (BSL 1.1), not the open-source MPL 2.0 it used before. According to HashiCorp's license FAQ, you can still use BSL-licensed Vault in production — including commercially — unless you're embedding it in a product that competes with HashiCorp's own offerings. For the vast majority of internal use, nothing changes. But "free" here means free license, not free to run — more on that in the total-cost section below.

Vault Enterprise (self-hosted, quote-based)

Vault Enterprise adds the features large organizations typically need at scale: namespaces for multi-tenancy, disaster recovery and performance replication, HSM auto-unseal, Sentinel policy-as-code, and the Advanced Data Protection module (transform encryption, tokenization, KMIP). There is no published price. Licensing is sold through HashiCorp/IBM sales on an annual or multi-year contract, typically sized by the number of clients (unique users, apps, and services that authenticate to Vault). Public reports of Enterprise contracts vary so widely — from tens of thousands to well into six figures annually — that any specific number we quoted here would be misleading. If a vendor blog tells you exactly what Vault Enterprise costs, be skeptical; it's a negotiated quote.

HCP Vault Dedicated (managed cloud, published hourly pricing)

HCP Vault Dedicated is HashiCorp's managed offering: they run single-tenant Vault clusters for you on AWS or Azure. This is the one edition with genuinely published pricing — billed per cluster-hour plus per client — and we'll break it down next.

What happened to HCP Vault Secrets? HashiCorp's simpler, cheaper SaaS secrets product was end-of-sale on June 30, 2025 and is being retired — pay-as-you-go service ended in August 2025, and remaining contract customers must migrate by July 1, 2026. If you were evaluating it as the "affordable Vault," it's no longer an option. HashiCorp's recommended paths are Community Edition or HCP Vault Dedicated.

Edition comparison at a glance

HCP Vault Dedicated Pricing

HCP Vault Dedicated bills two meters: clusters (per hour, metered by the minute, from creation until deletion) and clients (unique apps, services, or users that authenticate during a monthly billing period).

A warning before the numbers: HashiCorp has renamed these tiers repeatedly. The Starter SKU was discontinued, and the current tier documentation describes Development, Essentials, and Standard tiers, while the published Flex consumption pricing table (effective July 2025) lists rates under the names Development, Standard, and Plus. The structure is the same — a cheap single-node dev tier, a production tier, and a premium tier with replication — but verify the current names and rates in the HCP portal before you commit.

Published rates from HashiCorp's Flex pricing table, as of our June 2026 review (US/EU regions, Silver support):

Gold support raises each rate slightly (e.g., a small Standard cluster goes from $1.578 to $1.647/hour).

The per-client charge is the part people miss

For production tiers, every unique client that authenticates in a month is billed. Under Flex contracts, HashiCorp's published table starts at ~$112 per client per month for the first 9 clients, stepping down in volume bands (roughly $87 for clients 10–24, $84 for 25–49, falling to ~$27 at 10,000+). Pay-as-you-go billing expresses this as a flat hourly rate per client instead — the HCP portal shows the exact figure for your region and tier.

A worked example at the published Flex rates: a small Standard cluster with 25 active clients costs roughly $1,150/month for the cluster plus about $2,400/month in client charges — around $3,500/month, or $42,000/year, before support upgrades or a second cluster. And note the multiplier: a client that authenticates to two production clusters counts as two clients.

The good news: new HCP accounts get $500 in credits, and the Development tier at ~$22/month is a genuinely cheap way to evaluate Vault properly. The sticker shock only arrives when you go to production.

Vault Enterprise Pricing: What Drives the Quote

Since Enterprise is quote-only, the useful thing to understand is what moves the number. Based on HashiCorp's packaging, expect your quote to be shaped by:

• Client count — the primary licensing metric. Every unique human, app, and machine identity that authenticates counts. Dynamic infrastructure (ephemeral CI runners, autoscaling services) can inflate this fast if not architected carefully.
• Clusters and replication topology — DR and performance replicas mean more clusters under license.
• Namespaces — multi-tenant setups for large orgs are an Enterprise differentiator and factor into sizing conversations.
• Modules — Advanced Data Protection (transform encryption, tokenization, KMIP) is premium functionality.
• Support tier and contract length — multi-year commitments and higher support SLAs change the math in both directions.

Practical advice: go into the sales conversation knowing your real client count (run Community Edition's usage metrics first), and budget for the renewal, not just year one.

The Hidden Costs: Vault's Total Cost of Ownership

Here's the part no pricing page shows, and for self-hosted Vault it's usually the largest line item.

Running Vault Community or Enterprise yourself means owning:

• Infrastructure: a production Vault deployment is typically a 3+ node HA cluster with integrated storage, plus separate clusters for DR and possibly per-region replicas. Add load balancers, monitoring, and backup storage.
• Operations: unsealing strategy (auto-unseal via KMS/HSM or manual key ceremonies), upgrades on Vault's release cadence, storage migrations, certificate rotation for Vault itself, audit log shipping, and break-glass procedures.
• Expertise: Vault has a real learning curve — policies are written in HCL, auth methods and secret engines each have their own configuration model, and mistakes are high-stakes by definition. Most teams running production Vault dedicate meaningful platform-engineering time to it. Even a conservative estimate — 10–20% of one senior engineer's time — adds $15,000–$40,000/year in fully-loaded cost, and many orgs spend far more.
• The seal-status pager duty: when Vault is down, everything that depends on it for credentials is degraded. That criticality is exactly why it demands serious operational investment.

This is the honest framing for "Vault Community Edition is free": the license costs nothing, while the system around it costs real infrastructure and real engineering hours. If you're weighing self-hosting in general, our guide to self-hosted secrets managers covers this trade-off in more depth.

When Vault Is Worth It — and When It's Overkill

Vault is a genuinely excellent piece of engineering, and for some teams it's clearly the right call. Vault earns its cost when you need:

• Dynamic secrets — short-lived, auto-generated database or cloud credentials created on demand and revoked automatically.
• Encryption as a service — apps offloading encryption/tokenization to Vault's transit and transform engines.
• PKI at scale — Vault as an internal certificate authority issuing short-lived certs.
• Multi-tenancy and compliance — namespaces, Sentinel policies, HSM integration, and the audit posture regulated industries require.
• Heterogeneous identity — dozens of auth methods (Kubernetes, cloud IAM, LDAP, OIDC) brokering access for thousands of machine identities.

Vault is probably overkill when your actual problem is: "our team needs to store API keys, database URLs, and tokens per environment, stop sharing them over Slack, sync them to our deployment platforms, and know who changed what." That's static secrets and environment configuration — the most common secrets problem there is — and it doesn't require dynamic credential generation, a dedicated HA cluster, or a five-figure annual commitment. If you're still mapping the problem space, start with what secrets management actually involves and the core secrets management best practices; you may find your requirements list is shorter than Vault's feature list.

Alternatives to HashiCorp Vault

If your needs sit below Vault's complexity threshold, honest alternatives worth evaluating:

• EnvManager (that's us): purpose-built for environment variables and static secrets across dev/staging/production. Client-side AES-256-GCM encryption, CLI sync, one-click integrations (GitHub Actions, Vercel, Railway, Render, Dokploy, Coolify), RBAC, and audit logs. Pricing is deliberately simple: a 14-day free trial (no credit card), then $9/month flat for unlimited team members — not per-seat, not per-client. We don't do dynamic secrets, PKI, or encryption-as-a-service; if you need those, use Vault. We compare the two honestly in HashiCorp Vault vs EnvManager.
• Infisical: an open-source secrets manager with a managed cloud option and self-hosting. A middle ground — more Vault-like features than EnvManager (secret rotation, K8s operator), less operational weight than Vault itself.
• Cloud-native managers (AWS Secrets Manager, Azure Key Vault, GCP Secret Manager): pay-per-secret/per-call pricing (AWS, for example, charges around $0.40 per secret per month plus API-call fees as of this writing). Great if you're single-cloud and your secrets only need to exist inside that cloud; weaker for cross-platform developer workflows.

Skip the Cluster. Keep the Security.

If your secrets problem is environment variables — not dynamic database credentials — you can have encrypted storage, RBAC, audit logs, and platform sync running this afternoon for less than the cost of one HCP Vault Dedicated cluster-day. See what EnvManager includes, or start the 14-day free trial — no credit card, no infrastructure, no key ceremony.

Frequently Asked Questions

Is HashiCorp Vault free?

Vault Community Edition is free to download and use, including in production. Since 2023 it's licensed under the Business Source License (BSL 1.1) rather than open source, which only restricts you from offering Vault as a competing product. The real cost of "free" Vault is operational: production deployments need HA clusters, monitoring, upgrades, and dedicated engineering time.

How much does HCP Vault cost per month?

As of June 2026, HCP Vault Dedicated's Development tier costs $0.03/hour (about $22/month) with no per-client fees. Production tiers run roughly $1.58–$9.41 per cluster-hour ($1,150–$6,900/month) depending on size and tier, plus per-client charges that start around $112/client/month at published Flex rates. Always confirm current rates on HashiCorp's pricing page or in the HCP portal.

How much does Vault Enterprise cost?

HashiCorp doesn't publish Vault Enterprise pricing — it's a custom quote based primarily on client count, plus clusters, replication, premium modules, support tier, and contract length. Expect an annual contract negotiated through HashiCorp/IBM sales.

Is HashiCorp Vault still open source?

No. In August 2023 HashiCorp moved Vault from the open-source MPL 2.0 to the Business Source License (BSL 1.1). The code is still publicly available and free to use for almost all purposes, but BSL is not an OSI-approved open-source license. Versions released before the change remain MPL 2.0.

What happened to HCP Vault Secrets?

HashiCorp retired it. HCP Vault Secrets — the lightweight SaaS option — stopped accepting new customers on June 30, 2025, ended pay-as-you-go service in August 2025, and shuts down for remaining customers by July 1, 2026. HashiCorp recommends migrating to Vault Community Edition or HCP Vault Dedicated.

Related Resources

• HashiCorp Vault vs EnvManager: Full Comparison
• What Is Secrets Management?
• Self-Hosted Secrets Managers Compared
• Secrets Management Best Practices