Vault is HashiCorp's open-source tool for secrets management, encryption as a service, and privileged access management, written in Go. It provides a unified interface for securely storing, accessing, and managing secrets such as API keys, passwords, certificates, and database credentials across modern infrastructure environments.
The core functionality of Vault centers on secure secret storage with encryption at rest. Vault encrypts all data before writing it to persistent storage, whether that storage is local disk, Consul, or other backends, ensuring that raw storage access alone does not compromise secrets. Beyond static storage, Vault generates dynamic secrets on demand for systems like AWS and SQL databases. When an application requests credentials, Vault creates temporary keypairs with appropriate permissions and automatically revokes them after the lease expires, eliminating the need to manage long-lived credentials.
Vault implements a leasing and renewal system where every secret carries an associated lease. Clients can renew leases through built-in APIs, and Vault automatically revokes secrets when leases expire. The platform also supports encryption and decryption of data without storing it, allowing security teams to define encryption parameters while developers store encrypted data in external systems like SQL databases without designing custom encryption schemes. Revocation capabilities extend beyond individual secrets to entire trees of secrets, enabling administrators to revoke all secrets accessed by a specific user or all secrets of a particular type, which is critical for incident response and key rolling.
The repository shows active development and maintenance.
Development of Vault requires Go and uses Go Modules for dependency management. The repository includes comprehensive testing infrastructure with standard unit tests invoked via make test, acceptance tests for secret and auth methods that create and modify real resources, and Docker-based testing mechanisms for more complex scenarios. The project publishes two importable libraries: github.com/hashicorp/vault/api and github.com/hashicorp/vault/sdk, though importing the main Vault product itself is not a supported use case.
The repository maintains strong security practices with a dedicated security contact at [email protected] for responsible vulnerability disclosure. Documentation is extensive, available at developer.hashicorp.com/vault, with getting started guides, tutorials, and certification exam materials available through HashiCorp's learning platform. The project also maintains example repositories and sample applications demonstrating Vault integration across different programming languages. An enterprise version of Vault is available with additional features beyond the open-source offering.
