Repolode
Submit
hashicorp

hashicorp/vault

Open-source tool for securely storing, accessing, and auditing secrets such as API keys, passwords, and certificates, with encryption as a service.

Open-source alternative to:1PasswordAWS Secrets Manager

View on GitHubWebsite
Stars
36,410
Forks
4,795
Open issues
1,474
Last commit
12 hours ago

What is it?

Vault is a tool for controlling access to secrets such as API keys, passwords, and certificates. It offers a unified interface to these secrets, enforces access control policies, and records a detailed audit log of who accessed what.

Vault encrypts data before writing it to persistent storage, so direct access to the storage backend does not expose secret values. It can store arbitrary key/value pairs, generate short-lived dynamic credentials for systems such as AWS and SQL databases, and automatically revoke them when their lease expires. Leases can be renewed through built-in APIs, and revocation can apply to single secrets or to a whole tree of secrets.

Vault also provides data encryption and decryption without storing the data itself, so applications can keep encrypted data in their own databases without designing their own cryptography. The repository includes the server and CLI, plus the Go `api` and `sdk` libraries for integrating with it.

Key features

  • 01Stores arbitrary secrets with encryption at rest.
  • 02Generates dynamic credentials for systems such as AWS and SQL databases.
  • 03Attaches leases to secrets and revokes them automatically on expiry.
  • 04Revokes individual secrets or trees of secrets.
  • 05Provides encryption and decryption as a service.
  • 06Records detailed audit logs of secret access.

Use cases

  • Replacing hard-coded credentials in applications and CI pipelines with short-lived secrets.
  • Issuing temporary database or cloud credentials to services on demand.
  • Encrypting sensitive fields in application databases without custom cryptography.
  • Auditing and revoking access to secrets during key rotation or a security incident.

Quick start

  1. 1

    Install Go and set up GOPATH and GOBIN as described in the README

  2. 2

    Bootstrap the environment to download build tools

    make bootstrap
  3. 3

    Compile a development version of Vault

    make dev
  4. 4

    Run the compiled Vault binary

    bin/vault

Things to know

  • The metadata reports no clearly identified license, so check the license terms before use.
  • Building from source requires Go, and running the test suite requires Docker.
  • Acceptance tests create and modify real resources and may incur costs.

Topics

#secrets-management#encryption#security#access-control#audit-logging#go#dynamic-credentials#secrets#vault

FAQ

What is vault?
Open-source tool for securely storing, accessing, and auditing secrets such as API keys, passwords, and certificates, with encryption as a service. Vault is a tool for controlling access to secrets such as API keys, passwords, and certificates. It offers a unified interface to these secrets, enforces access control policies, and records a detailed audit log of who accessed what.
Is vault free to use? What license does it have?
vault is open source under the Other license. Check the license terms before using it in commercial products.
Is vault still maintained?
Actively maintained. The last commit to vault was on Oct 20, 2026.
What can I use vault for?
Replacing hard-coded credentials in applications and CI pipelines with short-lived secrets. Issuing temporary database or cloud credentials to services on demand. Encrypting sensitive fields in application databases without custom cryptography. Auditing and revoking access to secrets during key rotation or a security incident.
How do I install vault?
Install Go and set up GOPATH and GOBIN as described in the README Bootstrap the environment to download build tools: make bootstrap Compile a development version of Vault: make dev Run the compiled Vault binary: bin/vault
Where can I get vault?
The source code and installation instructions are on GitHub: https://github.com/hashicorp/vault

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects