HashiCorp Vault
Hacker ApprovedRanked 3 of 20 secrets managers by recommenders
Recommended for fine-grained secret access, audit logs and a long track record. Common caveat: it needs setup, maintenance and separate infrastructure.
Recommended for fine-grained secret access, audit logs and a long track record. Common caveat: it needs setup, maintenance and separate infrastructure.
36 people gave an opinion
- recommend it
- 26
- criticize it
- 10
- approval share
- 72%
Recommended in 10 of 13 months
- November 2025: recommended
- December 2025: not recommended
- January 2026: recommended
- February 2026: recommended
- March 2026: recommended
- April 2026: recommended
- May 2026: recommended
- June 2026: recommended
- July 2026: recommended
- August 2026: not recommended
- September 2026: recommended
- October 2026: recommended
- November 2026: not recommended (month in progress)
Why it carries the badge
- 26 people recommend itNeeds 10 or more, met.
- 2.6 recommenders for every criticNeeds 2 to 1 or better, met.
- Recommended in 10 of 13 monthsNeeds 4 or more, met.
The same three rules apply to every product, and the badge can’t be bought. How the badge works
What people say about it
The reasons people give, with the number of comments that give each one. Open a reason to read what they said.
Why people recommend it
Each mark is one comment
Fine-grained access and audit logs
“All these have native audit logs and access logs, which can help you pin point exactly when did your AI Agent requested and accessed your secrets at Runtime.”
Comment from 13 Apr 2026 in “Ask HN: Do you trust AI agents with API keys / private keys?” “Hashicorp Vault solves these problems by giving you fine-grained access to keys and expiry of each token”
Comment from 9 Feb 2026 in “Treat OpenClaw as untrusted intern with Persistent Id and Ephemeral credentials” Trusted security design
“it's been around for years. I think we can safely say they know what they are doing.”
Comment from 7 Feb 2026 in “Show HN: If you lose your memory, how to regain access to your computer?” “by people whose understanding of security is far poorer than HashiCorp's”
Comment from 12 Mar 2026 in “Show HN: OneCLI – Vault for AI Agents in Rust” “about the safest mechanism possible for this sort of secrets management”
Comment from 21 Apr 2026 in “A Roblox cheat and one AI tool brought down Vercel's platform” Little maintenance once running
“it worked beautifully for years with little to no maintenance”
Comment from 15 Jun 2026 in “You probably don't need private PKI for internal infrastructure” “consul and vault are pretty brainless to operate.”
Comment from 16 Jun 2026 in “What job interviews taught me about Kubernetes” Fits on-prem and high-assurance needs
“it's used a lot in high assurance environments given it is easily integrated with Thales HSMs and has FIPS compliance”
Comment from 10 Jul 2026 in “Interview with Mitchell Hashimoto about Ghostty and Zig” “on prem, there are limited options and Vault fits the bill”
Comment from 10 Jul 2026 in “Interview with Mitchell Hashimoto about Ghostty and Zig”
What people warn about
Each mark is one comment
Needs separate infrastructure and maintenance
“they require to be placed on a separate server, and come with their own infra management”
Comment from 10 Apr 2026 in “Show HN: Keeper – embedded secret store for Go (help me break it)” “Too many broken upgrades and manual click-ops tasks just to keep them online.”
Comment from 16 Jun 2026 in “What job interviews taught me about Kubernetes” “are excellent but require setup, maintenance, and infra”
Comment from 25 Feb 2026 in “Show HN: KeyEnv – manage team secrets without scattered .env files” Licence change worries users
“I was really not happy with Hashi's licensing change”
Comment from 17 Mar 2026 in “Enterprise for OpenBAO – Open Source HashiCorp Vault alternative” “is still limited by their license”
Comment from 30 Oct 2026 in “We're releasing the weights of Mistral Large 4”
Other secrets managers people recommend
The four most recommended other secrets managers, with the same counts for each, so you can compare like for like. The tick on each bar marks the 2 to 1 line the badge needs.
| Product | Recommend | Criticize | Approval | Months | Owned | Badge |
|---|---|---|---|---|---|---|
| OneCLI | 39 | 8 | 83% | 6 | — | Approved |
| SOPS | 28 | 5 | 85% | 10 | — | Approved |
| HashiCorp VaultThis page | 26 | 10 | 72% | 10 | — | Approved |
| fnox | 20 | 4 | 83% | 9 | — | Approved |
| Agent Vault | 20 | 3 | 87% | 5 | — | Approved |
What people said
36 of the 38 comments that mention it, newest first. Each links to the original comment.
“move the secrets to a different server running hashicorp”
“is still limited by their license”
“I really want a local hashicorp-like vault”
“Terraform and Vault->OpenTofu and OpenBao”
“Vault is not that hard to stand up and utilize.”
“we didn't use most of its features and it wasn't worth the cost”
“on prem, there are limited options and Vault fits the bill”
“it was so fun when vault wouldn't let me store a 4096bit private key”
“it's used a lot in high assurance environments given it is easily integrated with Thales HSMs and has FIPS compliance”
“the HashiCorp products were a game changer in a world that had very little”
“consul and vault are pretty brainless to operate.”
“Too many broken upgrades and manual click-ops tasks just to keep them online.”
“it worked beautifully for years with little to no maintenance”
“Vault is fine though, but I prefer OpenBao now”
“switch to SOPS or Vault or whatever to keep these out if plaintext except exactly when needed”
“about the safest mechanism possible for this sort of secrets management”
“I think this is probably more solid.”
“All these have native audit logs and access logs, which can help you pin point exactly when did your AI Agent requested and accessed your secrets at Runtime.”
“they require to be placed on a separate server, and come with their own infra management”
“even with vault/boa holding the encryption keys for us”
“I was really not happy with Hashi's licensing change”
“This should be solved by the vaults”
“by people whose understanding of security is far poorer than HashiCorp's”
“Hashicorp Vault can do this and agents can be instructed to get secrets, which are set without the agent's knowledge.”
“are excellent but require setup, maintenance, and infra”
“It works really well, is convenient to manage secrets for multiple environments”
“Most small teams look at Vault's setup guide and go back to .env files.”
“Hashicorp is a devops company, not a cryptography company.”
“Hashicorp Vault solves these problems by giving you fine-grained access to keys and expiry of each token”
“it's been around for years. I think we can safely say they know what they are doing.”
“Tools like Hashicorp Vault were certainly worth paying for the Enterprise tier.”
“the size of the layer it adds is unviably big”
“at least use something like Vault”
“I would love a way to have vault/openbao be fully configuration-as-code and version controlled, and only have the actual secret values”
“It's a bit complicated to understand and get to work at first, but it's powerful”
“I miss Vault and Sierra Mist.”
Counts come from 1,795,640 Hacker News comments, November 2025 to November 2026. How we count. Report a mistake.