HashiCorp Vault

Vault is a secrets management tool built for teams that need tight control over who can access sensitive data and when. It handles tokens, passwords, API keys, certificates, and encryption keys across applications, infrastructure, and services. Access is controlled through policies, and every interaction is logged, giving security teams full visibility.

The core use cases break down into a few distinct areas:

• Key/Value secrets engine: A straightforward store for persisting arbitrary secrets in Vault's configured backend storage.
• Database credentials: Rather than storing static database passwords, Vault generates short-lived credentials on demand based on pre-configured roles. Credentials expire automatically, reducing the blast radius of a breach.
• Encryption as a service: The Transit secrets engine encrypts data in transit without storing it, so your application can offload encryption without managing keys directly.
• Data tokenization: An enterprise feature that replaces sensitive values with cryptographically secure tokens, useful for protecting things like payment card data.

Vault fits teams running complex infrastructure who need more than a basic secrets management solution. It integrates with cloud providers, Kubernetes, databases, and identity systems, and supports a zero-trust architecture where no service is implicitly trusted.

You can interact with Vault through its web UI, a CLI, or a REST API, making it adaptable to both human operators and automated pipelines. A managed cloud option (HCP Vault Dedicated) is available for teams that don't want to run their own cluster. For lighter-weight or developer-focused alternatives, tools like Keyshade or Phase cover simpler secret-sharing workflows.