Comparison

SecretStash vs. HashiCorp Vault

By , founder of SecretStash

For a small team storing app config like API keys and database passwords, SecretStash is the faster fit: it's hosted, costs a flat $10-$40/month, and takes minutes to set up. Choose HashiCorp Vault if you need dynamic secrets, PKI, or transit encryption and have the operations capacity to run it, or budget for HCP Vault Dedicated.

Diagram of how SecretStash handles a secret: your machine encrypts each .env value with AES-256-GCM and pushes it, SecretStash servers store only ciphertext they cannot read, and a teammate pulls and decrypts it with their own device key into a normal .env file.
SecretStash is hosted, but values are encrypted on your machine first, so there is no Vault cluster to run and no server that can read your secrets.
FeatureSecretStashHashiCorp Vault
Setup timeMinutes — sign up, install CLI, pull secretsHours to days — cluster provisioning and configuration
HostingFully hosted by SecretStashSelf-hosted (Community/Enterprise) or HCP Vault Dedicated
Pricing modelFlat rate per organization tierFree to self-host (ops time) or hourly/per-cluster HCP pricing
Dynamic secrets / PKI / transit encryptionNot availableCore feature set
Operational overheadNone — no infrastructure to runRequires dedicated ops/SRE capacity for self-hosted Vault
Best fitSmall dev teams managing app configOrganizations needing enterprise secrets infrastructure

Pricing at a glance

  • HCP Vault Secrets, the lightweight hosted offering, is discontinued. End of sale was June 30, 2025; end-of-life was July 1, 2026.
  • HCP Vault Dedicated is hosted Vault Enterprise. A development tier starts around $22/month. Production clusters run roughly $1,150-$6,900+/month, plus per-client fees.
  • Vault Community Edition is free to self-host under the Business Source License. You provide the infrastructure and operations.
  • SecretStash is a flat $10-$40/month hosted plan with no infrastructure to run.

Which one fits your team?

Choose SecretStash if…

You want a hosted secrets manager you can set up in minutes, with no infrastructure to operate. You don't need Vault's dynamic secrets, PKI issuance, or transit encryption engines.

Choose HashiCorp Vault if…

You need enterprise-grade dynamic secrets, PKI, or multi-cloud identity federation. Vault Community Edition is free to self-host if you have the operations capacity. HCP Vault Dedicated is the hosted path if you want HashiCorp to run it for you.

How do you switch from HashiCorp Vault to SecretStash?

If you're on HCP Vault Secrets, it has reached end-of-life, so you need somewhere new for those values. If you run Vault for dynamic secrets or PKI, keep it: SecretStash only replaces the static app config part.

  1. Read each app secret out of Vault and write it into a .env file per environment (for example .env.staging and .env.production).
  2. Create an account at secretstash.cloud. New organizations start with a 14-day trial. In the dashboard, click "New application" and create one environment per file you exported (for example, local, staging, production).
  3. In your Laravel app, run composer require dniccum/secret-stash-cli, then php artisan secret-stash:login to authorize the CLI in your browser. Set SECRET_STASH_APPLICATION_ID in your .env to the ID shown for your application.
  4. Run php artisan secret-stash:install. This creates the key that encrypts your values on your machine. It lives in ~/.secret-stash/device_private_key.pem, so keep that directory safe.
  5. Push each exported file into its environment, for example php artisan secret-stash:variables push --environment=production --file=.env.production. Values are encrypted before they leave your machine.
  6. Invite teammates to your organization from the dashboard. Each one installs the CLI, runs php artisan secret-stash:login, and runs php artisan secret-stash:keys init once on their machine.
  7. Sharing works one environment at a time. Run php artisan secret-stash:share --environment=production for each environment (staging, local, and so on), then teammates pull with php artisan secret-stash:variables pull --environment=production.
  8. Delete the plaintext export files once everything is pushed, so they don't end up in Slack or Git later.

What doesn't SecretStash do yet?

Check these before you switch. If one is a hard requirement, HashiCorp Vault may be the better fit today.

  • No dynamic secrets, PKI issuance, or transit encryption. SecretStash stores static environment variables only.
  • No self-hosted option. SecretStash runs as a hosted service.
  • No SAML SSO yet. Enterprise SSO via WorkOS is on the roadmap, not shipped.
  • Not SOC 2 certified.
Start Free
FAQ

Common questions about HashiCorp Vault

Sources

HCP Vault Secrets end-of-life confirmed via HashiCorp Support (support.hashicorp.com) and IBM Support. Vault Community Edition licensing and HCP Vault Dedicated pricing verified via hashicorp.com and third-party pricing analyses. Figures current as of September 2026 and subject to change.

Related pages

SecretStash vs. DopplerFlat pricing vs. per-seat pricing for small teams.SecretStash vs. dotenv-vaultTwo CLI-first .env sync tools, different seat limits.FeaturesClient-side encryption, environments, team access, and CLI sync.