# Infisical vs HashiCorp Vault: ops, license, encryption > Infisical and HashiCorp Vault compared: what you run, MIT vs BSL licensing, server-side decryption, CI, dynamic secrets and pricing model, from both docs. URL: https://crunu.com/compare/infisical-vs-hashicorp-vault Language: en Updated: 2026-10-30 Both are self-hostable secrets servers that decrypt on the server, and both offer certificates and key management. Infisical is MIT-licensed outside ee/, starts as one container and puts projects, environments and syncs first. Vault, under the BSL 1.1, has more secrets engines and a seal to operate. Infisical and HashiCorp Vault solve the same core problem in the same basic way: a server you can run yourself stores encrypted secrets, decrypts them when an authorized client asks, and controls access with policies and machine identities. The differences are in focus, license and how much there is to operate. Infisical is an MIT-licensed application built around projects, environments and syncs for application teams, with separate products for certificates and key management. Vault is a security platform under the Business Source License, built around secrets engines and auth methods, with a seal that someone has to manage. If your secrets are mostly app configuration and API keys, Infisical has less to set up. If you depend on Vault's secrets engines and policies, the extra operations are the price. > **Note:** Crunu wrote this comparison. We make a third option, described near the end, and we compared Infisical and Vault using only their own documentation, license files and pricing pages, checked on October 30, 2026. Sources are listed with this page. If something is out of date, tell us at . ## Who each one fits **Infisical fits** product and platform teams that want projects, environments, secret versioning and syncs into GitHub, Vercel, AWS and other services, with a web app built around them. It runs as Infisical Cloud or self-hosted, from a single packaged container to a high availability cluster. Pricing counts identities: in Infisical's words, "an identity is any human or machine that authenticates to Infisical". **HashiCorp Vault fits** organizations that want one platform for secrets, certificates, encryption and identity across many clouds and data centers, and have people to run it. HashiCorp is an IBM company. Vault Community edition is self-managed and free to run under its license; Vault Enterprise adds namespaces, replication and secrets sync, self-managed or as HCP Vault Dedicated. ## Side by side | | Infisical | HashiCorp Vault | | --------------------------- | ------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------ | | Where values are decrypted | On the Infisical server, which decrypts requested data before responding | On the Vault server, whose barrier decrypts data once Vault is unsealed | | Key hierarchy | Data keys per organization and per project, under a root key the operator provides as an environment variable | One encryption key protects all Vault data, under a root key released at unseal | | Starting the server | Starts with the root key from its configuration | Starts sealed; unseal with key shares, or auto unseal through a cloud KMS | | License | MIT outside the `ee/` directories, which have their own license | Business Source License 1.1 from version 1.15; each version converts to MPL 2.0 after four years | | Deployment options | Infisical Cloud; self-hosted as one container, Docker Compose, Helm, a Linux package, ECS or GKE | Community or Enterprise self-managed; HCP Vault Dedicated managed by HashiCorp | | CI sign-in | OIDC Auth with checks on subject, audiences and claims from any OIDC provider | JWT/OIDC auth method with bound claims | | Dynamic secrets | Advanced plan | Database and cloud engines, including Community | | Certificates and encryption | Separate products: Certificate Management for X.509 certificates and KMS for encryption and signing | PKI engine for certificates and the transit engine for encryption as a service | | Syncs | Secret Syncs to third-party services on every plan, with a sync limit per plan | Secrets sync on Enterprise or HCP Vault Dedicated | | Audit | 30 days on Pro, 90 on Advanced, custom on Enterprise | Audit devices record all requests and responses, with most strings HMAC-hashed | | SSO and SCIM | SAML SSO from Pro, SCIM on Enterprise | OIDC and other auth methods for sign-in; SCIM in Vault Enterprise 2.x | | Kubernetes | Infisical Operator, installed with Helm | Helm chart, Vault Secrets Operator, CSI provider and Agent Injector | | Pricing model | Free plan with 5 identities; paid plans per identity | Community free to run; Enterprise and HCP Vault Dedicated paid | ## What you operate Infisical's self-hosting guide starts with "a single packaged container", and a Docker Compose template that runs Infisical with PostgreSQL and Redis. The root encryption key is an environment variable you provide, and it "never leaves the server's memory". Reading data takes both that key and the storage backend, so the variable needs the same care as the database. Vault takes more care. A Vault server starts sealed and cannot decrypt anything until it is unsealed. In the default configuration, operators enter a threshold of key shares, and each node in a cluster must be unsealed separately after a restart. HashiCorp's documentation calls that "a manual process" and recommends auto unseal through a cloud KMS for most users; Community edition supports cloud KMS auto unseal, and HSM auto unseal is an Enterprise feature. Community edition also lacks namespaces, performance and disaster recovery replication, and secrets sync. ## Who can decrypt Neither product keeps the server from reading values, and both say so. Infisical: "Before responding to a client request, the server securely retrieves and decrypts requested data from the storage backend." Its layered keys mean that "compromising the database alone is insufficient to decrypt sensitive data", but the running server holds the root key. *Figure: Diagram of who can decrypt Infisical values, split into your side and the provider side. On your side, your team’s devices, your machines, and CI runners can decrypt. On the provider side, the Infisical service holds the key and can decrypt values too.* Vault: "Once Vault retrieves the encryption key, it decrypts the data in the storage backend, and enters the unsealed state." From then on, the server returns plaintext to any client whose policy allows it. *Figure: Diagram of who can decrypt HashiCorp Vault values, split into your side and the provider side. On your side, your team’s devices, your machines, and CI runners can decrypt. On the provider side, the HashiCorp Vault server holds the key and can decrypt values too.* For both, your server's operators and anyone who controls the running process are inside the trust boundary of every secret. Self-hosting changes who those people are, not the model. ## Licensing Infisical's repository is MIT outside its `ee/` directories, and the code there has its own license, so some features need a paid plan even when you self-host. Vault moved to the Business Source License 1.1 with version 1.15: production use is allowed except for competing hosted offerings, and each version converts to the Mozilla Public License 2.0 four years after release. Teams that need an open-source Vault can look at OpenBao, which describes itself as "an open source, community-driven secrets manager and fork of Vault managed by the Linux Foundation's OpenSSF". ## Where Infisical is stronger - **Less to run.** One container to start, no seal to manage, and a web app organized by project and environment. - **Built for app environments.** Projects, environments and syncs to GitHub, Vercel, AWS and other services come first, rather than paths and secrets engines. - **MIT core.** Most of the code is under a permissive open-source license. - **Syncs on every plan.** Secret Syncs start at 10 on the Free plan and are unlimited on Enterprise, rather than reserved for an Enterprise license. ## Where Vault is stronger - **Secrets engines in one server.** Database and cloud credentials, PKI, transit encryption and response wrapping, with JWT/OIDC among many auth methods. - **Dynamic secrets in Community.** Database and cloud credentials created on demand, without a paid plan. - **Kubernetes options.** A Helm chart, the Vault Secrets Operator, a CSI provider and the Agent Injector. - **Enterprise depth.** Namespaces, performance and disaster recovery replication, and SCIM in Vault Enterprise 2.x. ## A third option: Crunu Crunu, which wrote this page, removes the decrypting server from the picture. Values are encrypted in the browser and the `crunu` agent, and the server stores only ciphertext, public keys and signed documents; there is no root key to protect and no seal to manage. Each environment has its own key, sealed to each person, machine and pipeline, and removing someone rotates the keys of every environment they could read. You can use the Crunu cloud or, on the Enterprise plan, [host the server yourself](https://crunu.com/self-hosting) on Docker, Cloudflare Workers, Vercel or Google Cloud Run, and move it between them with one archive. It is free during early access. The server still sees metadata such as names, email addresses and timestamps, as the [limitations page](https://crunu.com/security/limitations) explains. Crunu is not a fit if you need dynamic secrets, PKI, encryption as a service, syncs to other platforms, a Kubernetes operator or SSO; it has none of these, and its source code is not published. The full comparisons are [Crunu vs Infisical](https://crunu.com/alternatives/infisical) and [Crunu vs HashiCorp Vault](https://crunu.com/alternatives/hashicorp-vault). The guide to [self-hosting a secrets vault](https://crunu.com/guides/self-hosting-a-secrets-vault) covers what each option asks you to run. ## FAQ ### Is Infisical a replacement for HashiCorp Vault? For application secrets organized by project and environment, it can be: Infisical covers storage, syncs, machine identities, rotation and dynamic secrets on higher plans, and has separate Certificate Management and KMS products. If you depend on specific Vault secrets engines or auth methods, check each one before you move. ### Is Infisical open source? Mostly. Infisical's repository is MIT-licensed outside the `ee/` directories, which have their own license. Vault, from version 1.15, uses the Business Source License 1.1, which allows production use except for competing hosted offerings. ### Do Infisical or Vault encrypt end to end? No. Both decrypt on the server. Infisical's server decrypts requested data before responding, using keys under a root key the operator provides. An unsealed Vault server decrypts data from its storage backend to answer requests. ### Which is easier to self-host? Infisical has the smaller starting point: a single packaged container, or a Docker Compose template with PostgreSQL and Redis. Vault needs a storage backend and an unseal strategy, either key shares entered by operators or auto unseal through a cloud KMS. ### What is OpenBao? OpenBao describes itself as an open source, community-driven secrets manager and fork of Vault, managed by the Linux Foundation's OpenSSF. Teams that want Vault's model under an open-source license can evaluate it alongside Vault and Infisical. ## Sources - [Infisical security internals](https://infisical.com/docs/internals/security) (accessed 2026-10-30) - [Infisical self-hosting overview](https://infisical.com/docs/self-hosting/overview) (accessed 2026-10-30) - [Infisical license](https://github.com/Infisical/infisical/blob/main/LICENSE) (accessed 2026-10-30) - [Infisical pricing](https://infisical.com/pricing) (accessed 2026-10-30) - [Infisical OIDC Auth](https://infisical.com/docs/documentation/platform/identities/oidc-auth/general) (accessed 2026-10-30) - [Infisical Secret Syncs](https://infisical.com/docs/integrations/secret-syncs/overview) (accessed 2026-10-30) - [Infisical dynamic secrets](https://infisical.com/docs/documentation/platform/dynamic-secrets/overview) (accessed 2026-10-30) - [Infisical Kubernetes Operator](https://infisical.com/docs/integrations/platforms/kubernetes/overview) (accessed 2026-10-30) - [Vault architecture](https://developer.hashicorp.com/vault/docs/internals/architecture) (accessed 2026-10-30) - [Vault seal and unseal](https://developer.hashicorp.com/vault/docs/concepts/seal) (accessed 2026-10-30) - [Vault editions](https://developer.hashicorp.com/vault/tutorials/get-started/available-editions) (accessed 2026-10-30) - [Vault license (BSL 1.1)](https://github.com/hashicorp/vault/blob/main/LICENSE) (accessed 2026-10-30) - [Vault JWT/OIDC auth method](https://developer.hashicorp.com/vault/docs/auth/jwt) (accessed 2026-10-30) - [Infisical Certificate Management](https://infisical.com/docs/documentation/platform/pki/overview) (accessed 2026-10-30) - [Infisical KMS](https://infisical.com/docs/documentation/platform/kms/overview) (accessed 2026-10-30) - [Vault database secrets engine](https://developer.hashicorp.com/vault/docs/secrets/databases) (accessed 2026-10-30) - [Vault PKI secrets engine](https://developer.hashicorp.com/vault/docs/secrets/pki) (accessed 2026-10-30) - [Vault transit secrets engine](https://developer.hashicorp.com/vault/docs/secrets/transit) (accessed 2026-10-30) - [Vault response wrapping](https://developer.hashicorp.com/vault/docs/concepts/response-wrapping) (accessed 2026-10-30) - [Vault audit devices](https://developer.hashicorp.com/vault/docs/audit) (accessed 2026-10-30) - [Vault release notes](https://developer.hashicorp.com/vault/docs/updates/release-notes) (accessed 2026-10-30) - [Vault on Kubernetes](https://developer.hashicorp.com/vault/docs/deploy/kubernetes) (accessed 2026-10-30) - [OpenBao](https://openbao.org/) (accessed 2026-10-30)