HashiCorp Vault alternatives: where to go and how to migrate without breaking prod

Why move to OpenBao. OpenBao forked Vault from the last MPL 2.0 release (1.14), right before the switch to the Business Source License. It sits under the Linux Foundation with open governance and joined the OpenSSF Sandbox. You keep everything that makes Vault worth running: dynamic secrets (database or Kubernetes credentials minted on demand and revoked later), encryption as a service, leases and revocation. The API stays compatible, so your scripts, your Terraform provider and your agents keep working. The GitHub repo has passed 8,800 stars, which tells you the community is real.

Who it's for. Platform teams already running Vault Community in house who are uneasy about the license or the IBM acquisition. Swiss hosting company VSHN picked it in a published architecture decision for exactly those reasons: the only true open source option of the bunch, a compatible API, foundation backing.

Who it's not for. Anyone leaving Vault because it's too heavy to operate. OpenBao keeps the same operational load: unsealing, Raft storage, upgrades, policies. If nobody on your team wants the pager, look at Infisical or a cloud vault instead.

The catch. No official managed offering. You self-host, full stop. Some companies sell commercial support, but there is no "create cluster" button anywhere.

How to migrate to OpenBao. The official guide documents and verifies an in-place migration from Vault 1.14.1 Community to OpenBao 2.2.0, with Raft storage and Shamir unseal. Maintainers only promise seal compatibility up to Vault Community 1.14.8. On anything newer, or on Vault Enterprise, it's technically a downgrade: stand up a fresh OpenBao cluster and copy secrets over (through the API, Terraform or sys/raw). Old tokens stay valid until their TTL runs out; new ones carry the s., b. or r. prefixes.

Pricing. Free, MPL 2.0. Your real cost is servers plus the engineering time to run them.

Why move to Infisical. Infisical comes at the problem from the developer side. Instead of a vault you have to babysit, you get a clean dashboard where each project has its environments (dev, staging, prod) and syncs that push secrets out to your platforms. The core is MIT licensed and free to self-host; only an enterprise folder stays under a commercial license. Self-hosting forums tell the same story: a quick Docker install and a Kubernetes integration that just works.

Who it's for. Dev teams that mostly used Vault as a big key-value store for environment variables, and former HCP Vault Secrets customers looking for a similar managed product.

Who it's not for. Anyone relying on Vault's transit engine: Infisical doesn't have one, and the vendor says so itself. No Vault-compatible API either, and no comparable internal PKI.

The catch. Advanced features sit behind paid tiers: rotation, dynamic secrets, fine-grained RBAC, SAML SSO. Some self-hosters were annoyed to see features move to paid plans in a patch release. And the bill scales per identity, human or machine.

How to migrate to Infisical. There's no guaranteed automatic import from Vault. Export your static secrets with the Vault CLI or API, rebuild the same tree as projects and environments, then swap Vault calls in your code and deploys for the Infisical CLI, agent or Kubernetes operator. Leave dynamic secrets and encryption for last: they need a different answer.

Pricing. Free at $0 (5 identities, unlimited projects, 3 environments, 10 syncs). Pro at $20 per identity per month billed yearly ($23 monthly), Advanced at $40 ($46 monthly), Enterprise on quote. 30-day trial, no card.

Why move to AWS Secrets Manager. No cluster, no unsealing, no upgrades: AWS runs it. Access goes through IAM, which your team already knows, and rotation for AWS database credentials is built in. For a company that lives entirely on AWS, it's usually the quickest path out of Vault.

Who it's for. Teams that only use Vault for static secrets and a few rotations, with no multi-cloud plans. One reviewer described exactly this move: per-user pricing elsewhere ended up costing more than their servers, so they went back to AWS Secrets Manager.

Who it's not for. Companies spread across several clouds or their own data centers. You'd be trading a neutral tool for one that ties you to a single provider.

The catch. Every secret is a billed object. Lots of small values add up fast. And Secrets Manager itself has no transit-style encryption service (you add KMS for that).

How to migrate to AWS Secrets Manager. Export your Vault paths, then create one secret per app and per environment rather than one per value: a single secret can hold a JSON object with many keys. Replace Vault calls with the AWS SDK or your orchestrator's integration. If you wire secrets into automations, our AWS KMS and Secrets with Make page lists the available modules.

Pricing. $0.40 per secret per month, plus $0.05 per 10,000 API calls. Example: 100 secrets cost $40 a month before calls. New AWS customers get up to $200 in Free Tier credits.

Why move to Azure Key Vault. If your company runs on Azure, Key Vault keeps secrets, encryption keys and certificates in one place, governed by Entra ID. Pricing is mostly usage-based: you pay for operations, not for a cluster idling overnight.

Who it's for. Microsoft shops that used Vault for certificates and keys as much as for secrets. The Premium tier adds HSM-protected keys, handy when an auditor asks for hardware-backed keys.

Who it's not for. Teams that want Vault-style dynamic secrets for every database. Key Vault stores and rotates; it doesn't mint a throwaway credential on each connection.

The catch. The same lock-in as AWS, plus a pricing page that barely renders its own numbers: you end up in the calculator or the pricing API.

How to migrate to Azure Key Vault. Create one vault per environment, copy static secrets with a script (Azure CLI or Terraform), then give apps a managed identity instead of a token. Handle certificates separately: automatic renewal is billed.

Pricing. In West Europe: $0.03 per 10,000 operations on both Standard and Premium, $1 per certificate renewal, $1 per HSM RSA 2048 key per month on Premium.

Why move to Doppler. Doppler is SaaS only: create a project, define environments, and the CLI injects secrets when your app starts. Non-human identities (service accounts, CI pipelines) are free, which sidesteps Vault's per-client pricing trap. Doppler also publishes a migration guide for HCP Vault Secrets customers, whose product HashiCorp shut down.

Who it's for. Small product teams that want secrets organized per environment in an afternoon, with no servers to watch.

Who it's not for. Companies that must keep secrets on their own infrastructure: the pricing page lists no self-hosted option. Same if you need encryption as a service or a PKI.

The catch. Per-user pricing. One reviewer said that at the per-seat rate the service ended up costing more than their servers. The free plan keeps the activity log for only 3 days.

How to migrate to Doppler. Export static secrets from Vault, import them project by project, then replace the Vault agent with the Doppler CLI or its syncs (to your cloud, your CI, Kubernetes). Move one environment at a time, starting with dev.

Pricing. Developer is free up to 3 users, then $8 per user per month (25 max). Team is $21 per user per month with a 90-day log and a 14-day trial. Enterprise on quote.

Why move to Bitwarden Secrets Manager. It's Bitwarden's machine-secrets product, separate from its password manager. It's open source, secret storage is unlimited, and the per-user price is the lowest on this page. Machines authenticate through machine accounts scoped to projects.

Who it's for. Small companies with a few dozen secrets for pipelines and servers that already use Bitwarden for team passwords. Leaving a password manager too? See our switch from Bitwarden and switch from 1Password guides. To read secrets from automations, see Bitwarden with n8n and Bitwarden with Make.

Who it's not for. Platform teams that need dynamic secrets, encryption as a service or fine path-based policies. It's not a feature-for-feature Vault replacement.

The catch. Self-hosting is only included on Enterprise, and machine accounts are capped: 20 on Teams, then $1 each.

How to migrate to Bitwarden Secrets Manager. Create one project per app, copy static secrets with the bws CLI or the API, then create one machine account per service with access limited to its project.

Pricing. Free at $0 (2 users, 3 projects, 3 machine accounts). Teams at $6 per user per month, Enterprise at $12 (50 machine accounts, SSO, SCIM, self-hosting), billed yearly, before tax.