Infisical vs HashiCorp Vault: pricing, and when you actually need a cluster

People search this because both names show up in secrets manager roundups, and they are not the same product. Infisical is a secrets dashboard that grew PKI and SSH. Vault is a cluster you run, or pay HashiCorp to run, for dynamic credentials and encryption-as-a-service. If your actual problem is a .env in Slack, you don't start with a cluster.

We build EnvManager, so read the EnvManager bits knowing that. The Infisical numbers below are from their public pricing as of August 2026, same figures we use on /blog/infisical-pricing. The Vault numbers are from HashiCorp's published pages as of June 2026, same figures we use on /blog/hashicorp-vault-pricing. Confirm on their sites before you budget.

What you're actually choosing

Infisical Cloud is free for 5 identities, 3 projects, 3 environments. Pro is $18 per identity per month, and an identity is a human or a machine: CI, a deploy agent, a Kubernetes workload. Ten developers plus twenty machine identities is 30 × $18 = $540/month. Dynamic secrets, SCIM, and approval workflows sit in Enterprise. The open-source core is free to self-host, you take the ops.

Vault Community Edition is free to self-host under BSL. HCP Vault Dedicated is about $0.03/hour (about $22/month) for a dev cluster, then roughly $1.58 to $9.41 per cluster-hour in production plus about $112 per client/month at published Flex rates. Vault Enterprise is quote-only. You get dynamic database credentials, transit encryption, PKI at scale, and an ops burden if you run it yourself.

Same team, different bill

Ten humans, twenty machine identities, env vars across dev/staging/production, no dynamic DB credentials:

Infisical Pro: $540/month if you stay on the published slider. Vault: $0 license if you self-host Community, plus whoever is on call for unsealing and upgrades, or about $1,150 a month for a small production cluster on HCP before clients even count. EnvManager: $9/month for the whole team, 14-day Pro trial, no card, at /auth/register. Unlimited members, CI tokens do not add a line. We sync to GitHub, Vercel, Railway, Render, Dokploy, and Coolify. We do not do PKI, KMS, or dynamic secrets.

Pick Vault if you need dynamic credentials, transit encryption, or a private CA, and you have people to run a cluster (or money for HCP). Pick Infisical if you want open source plus a managed dashboard and you actually use the platform breadth, or your identity count stays small, and pick neither if you are still pasting .env files into Slack and deploying to Vercel.

When this comparison is the wrong page

If you already know you need Vault-class dynamic secrets, stop here and read the Vault pricing post. If you are modelling Infisical identities, read the Infisical pricing post. This page is for the team stuck between those two names when the job is environment variables.

Related: /blog/infisical-pricing, /blog/hashicorp-vault-pricing, /blog/infisical-alternatives, /compare/infisical, /pricing.