Is HashiCorp Vault still open source?

No, not by the OSI definition. Vault moved from MPL 2.0 to the Business Source License 1.1 on 10 August 2023, first shipping under it in version 1.15.0. BUSL 1.1 is source-available: you can read, modify and run the code in production, but you may not offer it to third parties on a hosted or embedded basis in competition with IBM's paid versions. That field-of-use restriction is why BUSL is not OSI-approved, and why OpenBao exists.

When does Vault become open source again?

Each release converts individually, four years after that release is published, at which point it becomes MPL 2.0. This is a rolling per-release Change Date, not a single calendar date, and most write-ups get it wrong. Vault 1.15.0, published September 2023, converts around September 2027. Vault 2.1.1, published September 2026, does not convert until September 2030. So Vault as a shipping product never becomes open source under this arrangement; only individual four-year-old releases do.

Is OpenBao a real drop-in replacement for Vault?

It is the closest thing available. OpenBao is the fork created after the BUSL relicensing, governed under the Linux Foundation and, since June 2025, OpenSSF. It is materially mature: v2.6.2 shipped in August 2026, and the v2.7 beta in September 2026 added external key support for PKI and Transit via KMS plugins plus ML-DSA post-quantum signatures and pure post-quantum TLS. The v2.6 cycle drew 42 first-time contributors. Notably it is now diverging from Vault rather than merely tracking it, shipping post-quantum cryptography and namespace sealing ahead of upstream.

What do I lose by moving off Vault?

Breadth, mostly. Vault documents 26 secrets engines, 21 auth methods and 23 storage backends, which is wider than any alternative here. Six secrets engines and three auth methods are Enterprise-only, including SAML, SPIFFE and Transform. If you use a niche engine or an unusual storage backend, check parity before committing. You also lose the ecosystem: Terraform integration, the volume of existing runbooks, and the depth of community answers.

Which alternative is cheapest?

That depends entirely on the billing unit, and the units are not comparable. Vault Community is free to self-host. HCP Vault Dedicated bills per cluster-hour plus per unique active client per month. Infisical bills per identity at 20 dollars (Pro) or 40 dollars (Advanced) per identity per month annually, where an identity is any principal that authenticates, human or machine, so cost tracks workload count rather than headcount. AWS Secrets Manager bills per secret per month plus API calls. Model your actual machine identity population before comparing headline numbers.

Did IBM change Vault after the acquisition?

Structurally more than functionally so far. IBM completed the acquisition on 27 February 2025 at 6.4 billion dollars, and business operations moved to IBM on 1 September 2025. The LICENSE file now names IBM as licensor, compliance requests route to IBM, and the self-managed product is sold as IBM Vault Self-Managed under product ID 5900-BJF. Support moved to IBM Support Cycle-2 from April 2026, guaranteeing a minimum of two years of standard support per major release. One product was killed: HCP Vault Secrets reached end of life on 1 July 2026, so any comparison listing it as a current tier is out of date.

Is Vault FIPS 140-3 validated?

Not exactly, and the distinction matters when answering a compliance questionnaire. Vault Enterprise ships FIPS builds using BoringCrypto, which holds NIST CMVP certificate 4735. However HashiCorp's own documentation states that the 140-3 certificate belongs to the BoringCrypto module rather than to Vault, and that Vault's own full 140-3 evaluation is pending. Accurate phrasing: Vault Enterprise ships validated cryptography; Vault as a product is not itself 140-3 validated.

Tools

HashiCorp Vault Alternatives: 7 Options Compared

Vault is source-available under BUSL, not open source, and now sits inside IBM. Seven alternatives compared on licensing, operational burden and what you actually lose by moving.

By SWI Community TeamUpdated 2026-09-2011 min read

Key takeaways

Vault has been source-available under BUSL 1.1 since 2023, not open source, and each release only converts to MPL 2.0 four years after publication, so current releases convert in 2030.
OpenBao is the closest drop-in: a Linux Foundation fork of Vault under OpenSSF governance, now diverging rather than tracking, having shipped post-quantum ML-DSA support in September 2026.
If licensing is the objection, OpenBao is the answer. If operational burden is the objection, a managed platform is the answer, and those are different problems with different alternatives.
Check the billing unit before comparing prices: Infisical bills per identity, where an identity is any principal that authenticates, human or machine.

Most people searching for a HashiCorp Vault alternative are solving one of two entirely different problems, and the right answer differs completely depending on which.

The licence is the problem. Vault has been source-available under BUSL 1.1 since August 2023, and IBM has owned it since February 2025. If your objection is that Vault is no longer open source, you want a licence-compatible fork, and there is essentially one credible answer.

The operational burden is the problem. Running Vault well means owning high availability, seal and unseal, upgrades and policy design. If your objection is that you do not have platform engineers to spare, a different licence does not help you at all; you want a managed product.

Sorting which problem you have takes five minutes and saves a migration.

If the licence is the problem: OpenBao

OpenBao is the fork created after the relicensing, now governed under the Linux Foundation and OpenSSF. It is the only option here with genuine drop-in ambitions, and it has stopped being a mere mirror: v2.6.2 shipped August 2026, and the v2.7 beta in September 2026 added external key support for PKI and Transit through KMS plugins, ML-DSA post-quantum signatures and pure post-quantum TLS. That is capability Vault does not have.

The trade is ecosystem depth. Vault has more integrations, more runbooks and more answered questions.

If operational burden is the problem

Infisical is the most approachable, with a genuinely unrestricted MIT core and published prices. Watch the unit: it bills per identity, and an identity is any principal that authenticates, human or machine, so an estate with far more workloads than people prices differently than the headline suggests. Dynamic secrets, a core free Vault feature, sit behind its 40 dollar Advanced tier.

Akeyless and Doppler both target the same lower operational floor with managed-first models.

If you are single-cloud

AWS Secrets Manager and Azure Key Vault are the lowest-effort options available, and a poor fit the moment you are genuinely multi-cloud. The integration with native IAM is the whole argument; if you will not use it, the argument disappears.

If you need enterprise privileged access alongside secrets

CyberArk Conjur fits where secrets management has to sit inside an established privileged access programme. Note it is now sold as Idira Secrets Hub following Palo Alto Networks' acquisition and rebrand of CyberArk in May 2026.

What to check before you commit

Count your secrets engines and auth methods first. Vault's breadth is real, and parity gaps are where migrations stall. Compare Akeyless vs Vault, AWS Secrets Manager vs Vault and Vault vs Conjur for the pairwise detail, and read the full HashiCorp Vault review for what you would be leaving.

Frequently asked questions

Is HashiCorp Vault still open source?: No, not by the OSI definition. Vault moved from MPL 2.0 to the Business Source License 1.1 on 10 August 2023, first shipping under it in version 1.15.0. BUSL 1.1 is source-available: you can read, modify and run the code in production, but you may not offer it to third parties on a hosted or embedded basis in competition with IBM's paid versions. That field-of-use restriction is why BUSL is not OSI-approved, and why OpenBao exists.
When does Vault become open source again?: Each release converts individually, four years after that release is published, at which point it becomes MPL 2.0. This is a rolling per-release Change Date, not a single calendar date, and most write-ups get it wrong. Vault 1.15.0, published September 2023, converts around September 2027. Vault 2.1.1, published September 2026, does not convert until September 2030. So Vault as a shipping product never becomes open source under this arrangement; only individual four-year-old releases do.
Is OpenBao a real drop-in replacement for Vault?: It is the closest thing available. OpenBao is the fork created after the BUSL relicensing, governed under the Linux Foundation and, since June 2025, OpenSSF. It is materially mature: v2.6.2 shipped in August 2026, and the v2.7 beta in September 2026 added external key support for PKI and Transit via KMS plugins plus ML-DSA post-quantum signatures and pure post-quantum TLS. The v2.6 cycle drew 42 first-time contributors. Notably it is now diverging from Vault rather than merely tracking it, shipping post-quantum cryptography and namespace sealing ahead of upstream.
What do I lose by moving off Vault?: Breadth, mostly. Vault documents 26 secrets engines, 21 auth methods and 23 storage backends, which is wider than any alternative here. Six secrets engines and three auth methods are Enterprise-only, including SAML, SPIFFE and Transform. If you use a niche engine or an unusual storage backend, check parity before committing. You also lose the ecosystem: Terraform integration, the volume of existing runbooks, and the depth of community answers.
Which alternative is cheapest?: That depends entirely on the billing unit, and the units are not comparable. Vault Community is free to self-host. HCP Vault Dedicated bills per cluster-hour plus per unique active client per month. Infisical bills per identity at 20 dollars (Pro) or 40 dollars (Advanced) per identity per month annually, where an identity is any principal that authenticates, human or machine, so cost tracks workload count rather than headcount. AWS Secrets Manager bills per secret per month plus API calls. Model your actual machine identity population before comparing headline numbers.
Did IBM change Vault after the acquisition?: Structurally more than functionally so far. IBM completed the acquisition on 27 February 2025 at 6.4 billion dollars, and business operations moved to IBM on 1 September 2025. The LICENSE file now names IBM as licensor, compliance requests route to IBM, and the self-managed product is sold as IBM Vault Self-Managed under product ID 5900-BJF. Support moved to IBM Support Cycle-2 from April 2026, guaranteeing a minimum of two years of standard support per major release. One product was killed: HCP Vault Secrets reached end of life on 1 July 2026, so any comparison listing it as a current tier is out of date.
Is Vault FIPS 140-3 validated?: Not exactly, and the distinction matters when answering a compliance questionnaire. Vault Enterprise ships FIPS builds using BoringCrypto, which holds NIST CMVP certificate 4735. However HashiCorp's own documentation states that the 140-3 certificate belongs to the BoringCrypto module rather than to Vault, and that Vault's own full 140-3 evaluation is pending. Accurate phrasing: Vault Enterprise ships validated cryptography; Vault as a product is not itself 140-3 validated.

Last reviewed September 20, 2026By SWI Community TeamSuggest a correction How we research

Independent editorial review, no sponsorship. See more in our articles and rankings.