HashiCorp Vault pricing guide details
Pricing Overview
HashiCorp Vault has one free edition and two paid routes, and HashiCorp publishes a price for neither paid route.
The Community edition is free to download and self-host, including in production. Since Vault 1.15 it is licensed under the Business Source License 1.1, not an open-source licence. The licence allows production use as long as you do not offer Vault to third parties as a hosted or embedded service that competes with the paid versions. Each release converts to MPL 2.0 four years after it is published.
The paid routes are HCP Vault Dedicated, a cluster HashiCorp runs for you on the HashiCorp Cloud Platform, and Vault Enterprise, a licence for clusters you run yourself. HCP Vault Dedicated is billed by the hour: a base rate that depends on the tier, cluster size and region, plus a flat hourly rate per Vault client on the production tiers. HashiCorp shows those rates in the HCP portal and through sales; its public pricing page lists Terraform's prices, not Vault's. Vault Enterprise is quoted.
Plan Comparison
| Plan | Price | Who runs it | What it adds |
|---|---|---|---|
| Community edition | Free | You | Core secrets engines, dynamic secrets, encryption as a service, identity-based access |
| HCP Dedicated: Development | Hourly base rate, not published | HashiCorp | A managed cluster for testing; not covered by the HashiCorp Cloud SLA |
| HCP Dedicated: Essentials | Hourly base rate plus a per-client rate, not published | HashiCorp | Three-node production cluster, 99.9% SLA, Silver support, audit log streaming, cross-region disaster recovery |
| HCP Dedicated: Standard | Hourly base rate plus a per-client rate, not published | HashiCorp | Everything in Essentials, plus Gold support, performance replication and Sentinel policies |
| Vault Enterprise | Quoted | You | Namespaces, replication and HSM support on your own infrastructure |
The step that matters is Development to Essentials. That is where the SLA, audit log streaming and the per-client rate begin. Because the per-client rate applies on both production tiers, the HCP bill grows with the number of Vault clients (the people, machines and applications that authenticate), not with the number of secrets you store.
Hidden Costs and Considerations
- Self-hosting is free to license, not free to run. Community and Enterprise clusters need servers, a storage backend (integrated Raft storage or Consul) and load balancers. A production cluster usually means three or five nodes, and upgrades, backups and patching are your team's work.
- Unsealing has its own bill. Auto-unseal through a cloud key service is a small separate charge, and HSM appliances for Enterprise are bought from their own vendors.
- The bill follows adoption. On HCP's production tiers every new application or machine that authenticates adds client cost, so count the clients you expect before you ask for a quote.
- Unsourced rates circulate. Hourly HCP figures on other sites are on no current HashiCorp page; confirm them in the HCP portal first.
Cost Estimates by Team Size
HashiCorp publishes no Vault rate, so an honest estimate names what you pay for rather than a figure:
- Solo developer or evaluation: no licence cost on the Community edition. The HCP Development tier is the managed option, billed hourly.
- Small team (5 engineers, one production cluster): the Community edition on three nodes you already operate, or HCP Essentials if you want the SLA and do not want to run Vault. HCP trades your team's operating time for an hourly bill that rises with client count.
- Mid-size team (20 engineers, several environments): usually separate clusters for development, staging and production. On HCP that means one Development cluster plus production-tier clusters, each with its own base rate. Ask for a quote with your expected client count.
- Large organization: Vault Enterprise or HCP Standard, both quoted. Performance replication and Sentinel policies are the usual reasons to move up.
How HashiCorp Vault Pricing Compares
| Tool | Free option | Paid pricing | Billed on |
|---|---|---|---|
| HashiCorp Vault | Community edition, self-hosted | Not published; quoted | Cluster hours plus Vault clients (HCP) |
| AWS Secrets Manager | None beyond AWS Free Tier credits | — | Secrets stored and API calls |
| Infisical | Free tier with 5 identities | Pro $20 per identity per month billed annually ($23 monthly); Advanced $40 ($46 monthly) | Identities |
The billing unit is the real difference. AWS Secrets Manager charges for every secret, so cost grows with every secret stored, plus API calls. Infisical charges per identity. Vault's managed service charges for the cluster and its clients, so a team with many secrets but few applications can come out ahead on Vault's model. Without a published rate, though, you cannot check that until HashiCorp quotes you.