Is HashiCorp Vault free? What it actually costs in 2026
Vault is free to run yourself — the community edition ships under the Business Source License 1.1 (source-available, no charge, no competing hosted offering). Managed HCP Vault Dedicated starts at $0.62 per cluster an hour for a 25-client development cluster; production tiers add $73 per client a month.
The free path is the self-hosted binary: BUSL 1.1 lets you use, modify and run it internally without paying; what it forbids is offering it as a competing commercial service. HCP gives new accounts a $500 credit; Vault Radar is free for 30 days then $7 per active contributor a month.
What the free tier actually includes
- Self-hosted only for $0 — the licence is BUSL 1.1, not OSI open source
- HCP Development cluster: up to 25 clients, from $0.62 an hour (about $450 a month)
- Essentials and Standard: $1.58–1.85 per cluster an hour plus $73 per client a month
Where the wall is
Running it well. The binary is free; a highly available cluster, unseal automation, audit devices and upgrades are the cost — which is exactly what HCP charges for, at about $1,150 a month for the smallest Essentials cluster before a single client's $73. That is the honest comparison with the open-source fork.
After that: HCP Vault Dedicated: Development from $0.62 per cluster an hour (25 clients); Essentials from $1.58 and Standard from $1.85 per cluster an hour, each plus $73 per Vault client a month; Vault Radar $7 per active contributor a month after a 30-day trial; Vault Enterprise (self-managed) custom. $500 HCP credit for new accounts.
Can you self-host HashiCorp Vault? Yes
Vault self-hosts. OpenBao is the community fork under an open-source licence; Infisical and SOPS are the other self-hosted secrets tools compared here.
What it actually takes to run one yourself
Real RAM against the documented minimum, monthly cost, setup time, and the one thing that catches people out.
When paying is still the right call
Stay if you use the parts nothing else matches: dynamic database credentials that expire, Vault's PKI engine as an internal certificate authority, transit encryption-as-a-service, or the breadth of auth backends. Stay if BSL genuinely does not affect you — and for most end users it does not, because the restriction targets competing hosted offerings rather than internal use. Read the licence against your own situation rather than the discourse. And stay if you have already paid for enterprise support and namespaces; the alternatives do not have an equivalent of that relationship.
What you are locked into
Lower than the operational effort implies, and this is the good news. Vault's HTTP API is well documented and OpenBao is a direct fork, so moving there is close to a drop-in — the paths, policies and tokens are the same shape. What actually holds you is the surrounding machinery: auto-unseal wired to a cloud KMS, dynamic database engines, PKI issuance, and the Terraform and Kubernetes integrations built around Vault's specific behaviour. Teams that use Vault as a key-value store move in an afternoon; teams using dynamic credentials and PKI have a project.
If you would rather not pay: OpenBao
OpenBao
Vault before the licence changed — forked, MPL-2.0, run by a foundation.
Free and open source. You run it on your own infrastructure.
See all 5 HashiCorp Vault alternatives comparedCompare the free options head-to-head
Read from HashiCorp (IBM)'s own pricing and documentation on 2026-09-27 — 33 days ago. Vendors change prices without notice; confirm before you commit.