Crunu vs HashiCorp Vault for team secrets
Crunu and HashiCorp Vault compared: where decryption happens, dynamic secrets, policies, agents, Kubernetes, hosting and what each asks you to run.
Comparison in detail
On this page
HashiCorp Vault is a general-purpose secrets platform. It stores static secrets, generates credentials on demand, issues certificates and offers encryption as a service, with policies and many authentication methods around all of it. Crunu does one part of that job: static secrets for a team, meaning .env files, cloud credentials and API keys, organized by project and environment.
The deeper difference is where values are decrypted. Vault encrypts data before writing it to storage, and an unsealed Vault server decrypts it to answer requests. Crunu's server never holds a decryption key: values are encrypted and decrypted only in the browser and in the crunu agent. That choice is also why Crunu cannot do some of what Vault does best.
Who each one fits
Vault fits platform and security teams that need dynamic database or cloud credentials, certificates, encryption as a service, or Kubernetes integration. It fits organizations with engineers who can own the design, deployment, scaling and upgrades of a critical service, or that buy the managed HCP Vault Dedicated.
Crunu fits teams that mostly need static secrets in one place, with per-environment access, delivery to machines and CI, and a clean process when someone leaves. It fits teams that want the server to be unable to read values, and that would rather not operate a Vault cluster.
Side by side
| HashiCorp Vault | Crunu | |
|---|---|---|
| Where values are decrypted | On the Vault server. Storage is untrusted; Vault encrypts before writing and decrypts once unsealed. | Only in the browser and the crunu agent. The server stores ciphertext and signed documents. |
| Kinds of secrets | Static key/value, dynamic credentials, certificates (PKI), Transit encryption, SSH and more | Static: env files, INI files such as ~/.aws/credentials, flat YAML and plain text |
| Dynamic credentials | Yes. Database credentials are generated per client, leased and revoked when the lease ends. | No, by design. Generating credentials needs a key on the server. |
| Access model | Path-based policies, deny by default | Per-environment roles: Editor, Reader, Specific files and Operator, with signed access lists |
| Machine identity | Many auth methods. Tokens have a TTL and can be bound to CIDR ranges. | Enrolled machines with a lease, plus service tokens with a lease, a usage limit and optional network binding |
| CI with OIDC | JWT/OIDC auth method with bound claims. GitHub documents the setup for Actions. | Service tokens bound to repository, branch and deployment environment on GitHub Actions, GitLab CI, Bitbucket Pipelines or any OIDC issuer |
| Agent | Vault Agent: auto-auth, caching, templates to files, and a mode that runs a child process with secrets as environment variables | crunu daemon keeps decrypted environments in memory, and crunu run can restart a program when values change. crunu pull writes files with mode 0600. |
| Kubernetes | Helm chart, Vault Secrets Operator, CSI provider and Agent Injector | Not available |
| Version history | KV v2 keeps 10 versions per key unless configured otherwise | 100 versions per environment, up to 64 MB |
| Audit | Audit devices record requests and responses, with HMAC-hashed string values | Hash-chained log with one-click verification and JSONL export. No secret values in the log. |
| Hosting | Community Edition, self-managed. Enterprise self-managed or as HCP Vault Dedicated on AWS or Azure. | Crunu cloud at app.crunu.com, or your own server on Docker, Cloudflare Workers, Vercel or Google Cloud Run |
| Pricing model | HCP Vault Dedicated bills per cluster hour plus per active client | Free during early access |
Where Vault is stronger
- Dynamic secrets. Vault can create a database user for each service on request and revoke it when the lease ends, with a default TTL of one hour and a maximum of 24 hours. Crunu stores values; it does not mint them.
- Breadth. PKI, Transit, SSH and cloud credential engines cover far more than static secrets. Crunu is deliberately smaller.
- Kubernetes. Vault ships a Helm chart, the Vault Secrets Operator, a CSI provider and an Agent Injector. Crunu has no Kubernetes integration.
- Scale features. Vault Enterprise adds namespaces, performance and disaster recovery replication, secrets sync, control groups and Sentinel policies.
- Managed option. HCP Vault Dedicated is Vault Enterprise operated by HashiCorp on AWS or Azure. Crunu's cloud is new, in early access, and has no external audit published.
What Crunu does differently
The server cannot read secrets. In Vault, protecting the storage backend is not enough: the unsealed server holds the key that decrypts stored data. Crunu removes that key from the server. A full copy of its database is not useful for guessing passwords, because the account key also depends on a Secret Key the server never receives. Access lists and versions are signed, so the server cannot quietly add itself as a recipient.
Less to run. A self-hosted Crunu server can run on serverless platforms like Cloudflare Workers with D1, or Vercel with Postgres, as well as on a single Docker host. It moves between them with one archive that holds no plaintext values.
People leaving. Removing a member rotates the keys of every environment they could read. The member removal flow lists what they received and which values to reissue at providers.
Network restrictions with a delay. An environment network policy serves content only to allowed networks. Tightening is immediate; relaxing waits 15 minutes with an alert, or needs a second signature. This is enforced by the server, not by cryptography, as Crunu's limitations page explains.
Moving to Crunu
- Create an account and save your Emergency Kit.
- Create projects and environments that match how your Vault paths are organized.
- On a trusted machine, write the static values you need into
.envor INI files. - Drag the files into each environment, then delete the plaintext copies.
- Enroll your servers as machines with a single-use enrollment code, and give pipelines service tokens with OIDC binding.
Dynamic credentials, PKI and Transit have no equivalent in Crunu. If you depend on them, keep Vault for those jobs.
Sources
Every page this comparison relies on, and the day we last verified it.
- Vault: Architecture · checked October 27, 2026
- Vault: What is Vault? · checked October 27, 2026
- Vault: Secrets engines · checked October 27, 2026
- Vault: Database secrets engine · checked October 27, 2026
- Vault: KV v2 API · checked October 27, 2026
- Vault: Policies · checked October 27, 2026
- Vault: Tokens · checked October 27, 2026
- Vault: JWT/OIDC auth method · checked October 27, 2026
- GitHub Docs: OpenID Connect in HashiCorp Vault · checked October 27, 2026
- Vault Agent · checked October 27, 2026
- Vault on Kubernetes · checked October 27, 2026
- Vault: Audit devices · checked October 27, 2026
- Vault: Available editions · checked October 27, 2026
- HCP Vault Dedicated overview · checked October 27, 2026
- HCP pricing definitions · checked October 27, 2026
- Vault license · checked October 27, 2026
Questions about Crunu and HashiCorp Vault
Something else? Write to support@crunu.com
Is Crunu a replacement for Vault?
For static team secrets, it can be. For dynamic credentials, certificates or encryption as a service, no. Crunu leaves those out on purpose, because they need a key on the server.
Can Vault be used without trusting the server?
Vault treats its storage backend as untrusted and encrypts data before it reaches storage. The Vault server itself decrypts data once it is unsealed, so the running server is trusted with plaintext.
What license is Vault under?
Vault 1.15 and later is released under the Business Source License 1.1. Each version converts to MPL 2.0 four years after it is published.
Does Crunu work with Kubernetes?
No. There is no operator, Helm chart or CSI provider. On Linux machines, the crunu agent runs as a systemd service.