Secrets management just had its busiest quarter in years. OpenBao shipped v2.7 on October 5, 2026, HashiCorp followed with Vault 2.2, and Infisical pushed three self-hosted releases between October 21 and October 23 while it answered a certificate-authority compromise. If you run Vault today and wonder whether OpenBao, Infisical or Doppler deserves a pilot, this OpenBao vs Vault comparison lines up the current facts for all four tools.
The headline: the two Vault lineages now differ on features, not just on licence. Vault 2.2 adds AI-agent and non-human identity support, SCIM lifecycle automation and post-quantum cryptography in PKI. OpenBao 2.7 adds PostgreSQL horizontal scalability, external HSM and KMS-backed keys, and its own post-quantum cryptography. HashiCorp also shipped Enterprise maintenance releases 1.21.13 and 1.19.24 next to the 2.x line, as HashiCorp’s Vault release notes show.
We already ran a HashiCorp Vault vs AWS Secrets Manager vs Doppler matchup for cloud-native teams. This piece asks a different question: what does the open-source fork change, and where do Infisical and Doppler fit around it? One honest limit up front. We found no neutral, cross-vendor throughput benchmark, so we cite vendor-reported scale claims, label them as such, and give you a harness to test your own workload.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
The Short Answer: Who Should Pick Which
Most teams land in one of four camps, and the data points to a clear default for each. The list below gives the quick version before the details.
- OpenBao v2.7 fits platform teams that already run Vault, want an open-source licence, and can live without a public price list or a first-party support contract.
- Vault 2.2 fits regulated enterprises that want vendor support, a managed cloud option (HCP Vault Dedicated) and the widest set of identity and PKI features.
- Infisical v0.167 fits product-led engineering teams that want secrets, certificates, privileged access and agent credential brokering in one platform, with a self-hosted option.
- Doppler fits small and mid-size teams that want a hosted, per-seat service and quick setup over deep self-hosted control.
The sharpest split sits between the two Vault lineages and the two newer platforms. OpenBao and Vault share a design: a server you operate, seal and unseal, with policies, dynamic secrets and PKI engines. Infisical and Doppler start from the developer workflow and treat the server as an implementation detail. Pick the model first. Pick the vendor second.
If you only remember one number from this section, make it the date gap. OpenBao 2.7 landed on October 5, Vault 2.2 followed within weeks, and Infisical shipped v0.167.2 on October 23. All four projects are alive and moving, so none of them is a safe choice by default and none is a risky one.
What Changed in the Last 90 Days
The July to October 2026 window rewrote the comparison. Before it, the Vault fork looked like a licence story. Now it looks like a product story with its own roadmap. The table lists the dated events we could confirm against vendor pages.
| Date (2026) | Product | What happened |
|---|---|---|
| July 23 | Infisical | Introduced Infisical PAM for controlled access to production infrastructure |
| July 27 | OpenBao | Open Source@Siemens talk described Secretz Enterprise, a commercial subscription with 24/7 support |
| August 18 | OpenBao | v2.6.0 added per-namespace sealing, external auto-unseal plugins and distroless container images |
| October 5 | OpenBao | v2.7 added PostgreSQL horizontal scalability, external HSM and KMS-backed keys, post-quantum cryptography |
| October 5 | Infisical | Documented on-prem machine-identity attestation with SPIRE and TPM |
| October | Vault | Vault 2.2 expanded AI-agent identity, SCIM, post-quantum PKI and ACME automation |
| October 15 | OpenBao | 2.7.x maintenance fixes for singleton mount-backend reloads and gRPC transaction context |
| October 21 to 23 | Infisical | v0.167.0, v0.167.1 and v0.167.2, plus a response to the eMudhra CA compromise |
| October 22 | Infisical | Agent Vault v0.40.1 shipped |
| October 23 | Vault | Vault 2.2.1 and Enterprise maintenance releases 1.21.13 and 1.19.24 |
Two patterns stand out. First, every vendor now talks about machine and agent identity, not just application secrets. Second, post-quantum cryptography moved from roadmap slide to shipped feature in both Vault lineages within the same month. Doppler’s own documentation also saw activity through October 23, covering workplace settings, SCIM and project tags, but it publishes no version numbers we can line up with the others.
One more change deserves a flag. OpenBao discontinued its HSM distribution on October 5 because the PKCS#11 plugin moved out of the core project. If you used that build, you now follow the external plugin route. We cover the upgrade impact in the OpenBao section below.
OpenBao vs Vault vs Infisical vs Doppler: Specs Side by Side
The table below sticks to facts we could confirm on vendor pages fetched on October 24, 2026. Where a cell says “not stated,” the vendor material we reviewed does not say, and we refuse to guess. For depth on how Vault stacks up against the hyperscaler key stores, see our Vault vs AWS vs Azure Key Vault test.
| Spec | OpenBao | HashiCorp Vault | Infisical | Doppler |
|---|---|---|---|---|
| Current release | v2.7 (Oct 5, 2026) | 2.2 line, 2.2.1 maintenance | v0.167.2 (Oct 23, 2026) | Hosted service, no public version number |
| Prior branches | 2.6 | Enterprise 1.21.13 and 1.19.24 | Agent Vault v0.40.1 as separate component | Not applicable |
| Deployment | Self-hosted | Self-managed Enterprise or HCP Vault Dedicated | Cloud, dedicated instances, self-hosted | Vendor-hosted |
| Openness | Open source, MPL 2.0 code, LF Projects | Commercial product from HashiCorp | Open-source-oriented platform | Commercial service |
| Pricing model | No official price list | Hourly cluster rate plus per-client fee on HCP | Published on vendor pricing page | Per-seat, no agent fees |
| Post-quantum | Yes, shipped in v2.7 | Yes, in PKI with 2.2 | Not stated | Not stated |
| AI-agent angle | Not a stated focus | Agent and non-human identity support | Agent Vault and Agent Proxy | Positioned for humans and AI agents |
| Certificates | PKI engine from Vault lineage | PKI with ACME orchestration | Private CAs, ACME, expiry alerts | Not stated |
| Key management | External HSM and KMS-backed keys | Transit crypto-agility, FF1 encryption | Not stated | Enterprise Key Management by demo |
| Ops tooling | Distroless images, auto-unseal plugins | Upgrade Analyzer, dashboard updates | Helm charts, Terraform provider | Sync integrations such as Vercel |
| Support | Community, plus Secretz Enterprise | Vendor support | Support SLAs advertised | Plan-based, EKM by demo |
| Newest feature theme | Scale and cryptography | Identity security and PKI | Platform breadth | Integrations and org controls |
Read the table by rows, not columns. The Post-quantum row shows parity between the two Vault lineages. The AI-agent row shows that every vendor except OpenBao now markets to agent workloads, though OpenBao users can still run agents against the Vault-compatible API. The Pricing row shows the real fault line: only HashiCorp and Doppler publish a clear model, while OpenBao has no list price by design.
OpenBao v2.7: The Open-Source Vault Fork Grows Up
OpenBao started as a fork of Vault in late 2023, taking the code from the last open MPL-2.0 release. Its site now carries a copyright line for OpenBao, a Series of LF Projects, LLC, and its FAQ still addresses the question of whether the MPL 2.0 licensed code could move to another license. For anyone who left Vault over licensing, that governance trail matters as much as any feature.
The feature story has caught up. Horizontal read scalability arrived in version 2.5. Version 2.6 added per-namespace sealing, external auto-unseal plugins, cross-plugin workflows and distroless container images, and it replaced deprecated unauthenticated root-generation endpoints with authenticated ones. Version 2.7 on October 5 added PostgreSQL horizontal scalability, external HSM and KMS-backed keys, and post-quantum cryptography. Maintenance fixes followed on October 15 for singleton mount-backend reloads, gRPC transaction context and one dependency update.
What the roadmap says
The v2.7 announcement carries Alex Scheel’s byline and tells readers that v2.8.0 will be a slower release focused on security and stability, with probable authentication improvements. That is a useful signal. A project that promises a slow, stability-first release is not racing to match every Vault Enterprise feature, and operators who value predictability should read that as good news.
Where OpenBao still asks more of you
There is no official OpenBao price list, and the project does not run a hosted service we could confirm. Commercial backing exists through Secretz Enterprise, which an official community presentation on July 27 described as a subscription offering 24/7 support, software assurance and continued development. No price appeared in that source. You should treat support as a procurement task rather than a checkbox.
Compatibility also deserves a test, not a leap of faith. GitLab’s presentation says its existing Vault integration made OpenBao an easy fit, and OpenBao positions itself as Vault-compatible, but your own clients, plugins and Enterprise-only features may behave differently. Run your top ten integrations against a staging instance before you commit. The discontinued HSM distribution is another migration speed bump for anyone who built on it.
For teams that mostly want an open-source secrets engine with PostgreSQL scaling and namespace isolation, OpenBao 2.7 is now a serious candidate rather than a hedge. For teams that need a vendor to call at 3 a.m., it is a project plus a contract you still have to buy.
HashiCorp Vault 2.2: The Incumbent Adds Agent Identity
Vault remains an actively developed product. HashiCorp’s official material describes it as identity-based management of secrets, certificates, encryption keys and other sensitive data, and it places the product inside the IBM HashiCorp ecosystem with IBM Power support and hybrid-cloud integrations. Nothing we found says Vault was renamed, retired or discontinued.
Vault 2.2 is the release to evaluate. Its confirmed additions include AI-agent and non-human identity support, SCIM user and group lifecycle automation, post-quantum cryptography in PKI, NIST-approved FF1 format-preserving encryption, Azure credential-rotation improvements, KV v2 secret recovery and Secrets Sync enhancements. It also brings an Upgrade Analyzer plus dashboard and dark-mode improvements. According to HashiCorp’s release notifications, Vault 2.2.1 arrived together with 1.21.13 and 1.19.24.
Security fixes worth reading
The HCP Vault Dedicated changelog lists a fix for CVE-2026-105818, a PKI and ACME issue that could let certificates carry unverified identities under the default ACME directory policy. Vault 2.x documentation also records an RSA modulus limit tied to CVE-2026-39829, according to one summary of its changes. Read both entries before you pick a PKI strategy, because certificate automation is where Vault 2.2 invests most heavily.
Managed option and support lines
HCP Vault Dedicated is the hosted route, with Development, Essentials and Standard tiers on AWS or Azure. HashiCorp’s documentation says Vault’s agentic-workflow features need Vault Enterprise 2.1.0 or later, and the HCP service added native support for securing agentic workflows on Standard and Essentials clusters in mid-October.
If you want to stand up a test cluster before deciding, our HashiCorp Vault setup guide walks through the basics in 13 steps. Pair that with a parallel OpenBao instance and you can compare behavior on your own data in an afternoon.
The strategic read: Vault 2.2 is the feature-complete choice, and the licence trade-off is the cost of that completeness. If your security team values a vendor SLA and a managed service on AWS or Azure, nothing in the open-source world matches that package today.
Infisical v0.167: A Platform Play Under Pressure
Infisical shipped v0.167.0 for self-hosted deployments on October 21, v0.167.1 on October 22 and v0.167.2 on October 23. That cadence alone sets it apart from the other three. The company also released Agent Vault v0.40.1 on October 22 and, on October 23, published a response to the eMudhra certificate-authority compromise. Its documentation overview was updated on October 22.
The eMudhra response, step by step
Infisical said its Cloud and dedicated instances were already updated on October 21 and that hosted customers needed to take no action. Self-hosted users had to upgrade to v0.167.0 and refresh the operating system’s ca-certificates package. Cloud and dedicated instances now run Node.js 26.12.1, which no longer trusts the affected certificates, and Infisical rebuilt its Go products on Go 1.26.10 or later, which rejects chains containing the affected intermediates.
The notice also lists runtime fixes for customers. Node.js users need 22.23.4, 24.22.1 or 26.12.1, and Node.js 20 and earlier will not receive the update. Go users need 1.26.10 or 1.27.3 and a rebuild. Python users need certifi 2026.10.19 or later. A quick check on any host that talks to Infisical looks like this:
node --version
go version
python3 -c "import certifi; print(certifi.__version__)"This episode shows the practical value of a fast-moving platform. A vendor that patches hosted instances the same day, and publishes exact runtime versions for self-hosters, cuts your exposure window. It also shows the cost: self-hosters inherit a long to-do list.
Beyond secret storage
Infisical now describes itself as more than a store. Its official material names Infisical Secrets Management, Agent Proxy, Agent Vault, Infisical PAM and Certificate Management. Agent Vault began as a research preview on April 22 and later became a product. It brokers credentials to HTTP services through an HTTPS proxy so the agent never sees the underlying secret. Certificate management, introduced in an August 21 post, covers private certificate authorities, profiles, API and ACME requests, renewal, inventory, expiry alerts and revocation.
On the infrastructure side, Infisical documented on-prem machine-identity attestation with SPIRE and TPM on October 5. Its Terraform provider reached v0.20.6 on October 21, adding certificate-sync and certificate-manager capabilities. According to its own posts, folder-level permissions arrived in September and Kubernetes Operator v2 with new v1beta1 resources arrived in June, with the older v1alpha1 API planned for eventual deprecation. Those items come from single posts, so verify them in the docs before you build on them.
If your concern is leaked credentials rather than storage, pair a platform like this with a scanner. Our TruffleHog vs Gitleaks vs GitGuardian comparison covers that layer. For the agent angle, see how non-human identity security vendors frame the same problem.
Doppler: Hosted, Per-Seat and Focused on Workflow
Doppler’s homepage title reads “Secrets management for humans and AI agents,” and its pricing page title reads “Per-Seat Secrets Management. No Agent Fees.” Those two phrases summarize the pitch: charge for people, not for the machines and agents that read the secrets. Doppler says most teams finish setup within 30 minutes, which is a vendor claim but a plausible one for a hosted service.
Our sources confirm less about Doppler than about the other three, and we say so plainly. Public material does not give a version number, a full price list, executive titles or a complete changelog. Here is what the documentation does show. Project tags are available on every plan, with up to 100 tags per workplace and project, per October 6 documentation. Communication services need the Team plan or above. Enterprise Key Management requires booking a demo. Change requests and comparing secrets reportedly need a Team or Enterprise subscription.
Integrations and identity
Doppler’s integration work continues. A Vercel sync update on September 25 added new config and secret types plus a dynamic option. Documentation for Authentik SCIM and an Activity Log event schema appeared in late September and October, and OpenAI rotated-secret creation was documented in August. A community request for OpenRouter and Anthropic key rotation was still a feature request in mid-October, so do not assume that rotation exists.
Doppler’s own numbers
Doppler’s site states that 49% of breaches involve credentials, a claim the company does not source on that page. Its customer stories claim a 95% efficiency gain at Ada, 10 saved hours per week and over 90% shorter audit times at Traive, and 75% faster Kubernetes adoption at Paradox. These are vendor-published results, and your outcome will vary with team size and starting point.
Doppler fits best when you want to stop thinking about servers. It fits worst when policy requires the secrets store to sit inside your own network boundary, because the sources we reviewed describe a vendor-hosted service.
Pricing Compared: $0.62 an Hour to Custom Quotes
Pricing is where the four tools diverge most, and where public data runs thinnest. HashiCorp publishes hourly HCP rates. Doppler publishes a per-seat model. OpenBao publishes nothing, because the software has no list price. For Infisical, we did not capture a dated price during our review, so we point you to its pricing page rather than print a number we cannot verify.
| Offer | Price | What it covers |
|---|---|---|
| OpenBao community build | No official price list | Self-hosted open-source server, community support |
| Secretz Enterprise (OpenBao subscription) | Not published | 24/7 support, software assurance, continued development |
| Vault Enterprise, self-managed | Custom quote | Run Vault on your own infrastructure |
| HCP Vault Dedicated Development | From $0.62 per cluster per hour | Entry tier for testing |
| HCP Vault Dedicated Essentials | From $1.58 per cluster per hour, plus $73 per Vault client per month | Managed production tier |
| HCP Vault Dedicated Standard | From $1.85 per cluster per hour, plus $73 per Vault client per month | Higher managed tier |
| HCP Vault Radar Essentials | From $7.00 per active contributor per month | Secret scanning add-on |
| HCP trial credit | $500 across the HashiCorp Cloud Platform | Pay-as-you-go starter credit |
| Infisical | See the vendor pricing page | Cloud, dedicated and self-hosted options |
| Doppler | Per-seat, no agent fees | Hosted service, Enterprise Key Management by demo |
What the HCP rates mean per month
A cluster hour is not a monthly bill, so multiply it out yourself. HashiCorp’s published starting rates are $0.62 per cluster per hour for Development, $1.58 for Essentials and $1.85 for Standard, and Essentials and Standard also add $73 per Vault client per month. These are starting rates, not a HashiCorp quote, and real invoices depend on region, usage and contract terms.
The takeaway: client count, not cluster size, dominates HCP cost at scale. A platform team with thousands of workloads should model the per-client fee first. For a cloud-native alternative that charges per secret rather than per client, check our AWS Parameter Store vs Secrets Manager breakdown.
OpenBao looks cheapest on paper, since you pay for infrastructure and people, not licences. Do not skip the people math. Running a sealed, highly available secrets cluster is real work, and a support contract from Secretz Enterprise or another provider belongs in the budget if your team is small.
Scale and Benchmark Evidence: What Exists and What Doesn’t
Readers keep asking for a benchmark table, so here is the blunt answer. We found no independent, cross-vendor throughput or latency benchmark for these four tools dated 2025 or 2026. Anyone who prints a requests-per-second ranking without naming the test rig is selling something. What we can offer is three kinds of published evidence, each labeled by origin.
- Project release notes (OpenBao). The project lists horizontal read scalability as a shipped feature. It also lists a talk titled “OpenBao: Horizontally Scaling Secrets Management” from OSSNA 2026. These are feature claims, not measured numbers.
- Customer outcomes (Doppler). Doppler’s pages claim 95% efficiency gains at Ada, 10 hours saved weekly and 90% faster audits at Traive, and 75% faster Kubernetes adoption at Paradox. These measure workflow time, not server speed.
- Availability and operations claims (Infisical and HashiCorp). Infisical’s site advertises 99.99% uptime backed by support SLAs, and HashiCorp’s Vault 2.2 material stresses an Upgrade Analyzer and operator usability. Neither figure comes from an independent audit.
Three sources, three different units of measure. That mismatch is the finding. You cannot compare an architecture claim, a workflow saving and an uptime promise in one chart, and a vendor chart that tries to do it hides the gaps.
Run your own test in 30 minutes
A read-heavy KV workload is the fairest first test, because most production traffic is reads. Stand up each candidate with the same storage class, the same TLS settings and the same token policy, then hit the HTTP API with a load tool. Swap the address and token per target.
# Seed one KV v2 secret on the target
vault kv put secret/bench/key1 value=example
# 20,000 reads, 50 concurrent, against the HTTP API
hey -n 20000 -c 50 \
-H "X-Vault-Token: $TOKEN" \
"$VAULT_ADDR/v1/secret/data/bench/key1"Check that OpenBao accepts the same header and path layout in your build, since compatibility is the claim you are testing. Record p50, p95 and p99 latency, error counts and CPU on the server nodes. Then repeat with a write-heavy mix and with a leader failover, because failover behavior separates production-ready setups from demos. For Infisical and Doppler, use their CLIs or SDKs against the hosted endpoint and measure the end-to-end time your application actually sees, including network distance.
Publish your numbers internally with the hardware spec attached. Six months from now, when the next releases ship, you can rerun the same script and see what moved.
Security Posture: Advisories, Patch Cadence and Sprawl
Security teams care about three things: how fast fixes arrive, how clearly vendors communicate, and how much the tool reduces secret sprawl. The October 2026 data gives a useful snapshot on the first two.
Patch cadence. OpenBao shipped 2.7.x fixes soon after v2.7. Vault published 2.2.1 plus two Enterprise maintenance releases. Infisical shipped three self-hosted releases in three days during the eMudhra response. Cadence is not quality, but a project that ships quickly under pressure shows its release pipeline works.
Advisory handling. HashiCorp documents CVE-2026-105818 in the HCP changelog and an RSA modulus limit tied to CVE-2026-39829 in the 2.x notes. OpenBao’s 2.6 release replaced deprecated unauthenticated root-generation endpoints with authenticated ones, which closes a class of exposure by design. Infisical’s notice listed exact runtime versions to upgrade. Doppler’s public material, by contrast, gives us no comparable advisory trail, which may mean fewer incidents or less public reporting. We cannot tell which.
Sprawl is the bigger risk
Doppler’s claim that 49% of breaches involve credentials points to a familiar truth: the dangerous secret is often the one living in a repo, a CI variable or a chat message. Moving to any of these four tools only helps if you also scan for leaks and rotate what you find. Our Kubernetes secrets management guide covers the cluster side of that job in 12 steps.
A short hardening checklist applies to every tool here:
- Turn on audit logging before the first production secret lands.
- Use short-lived or dynamic credentials wherever the backend supports them.
- Auto-unseal with a KMS or HSM rather than storing unseal keys on staff laptops.
- Rotate every static secret on a schedule and after every personnel change.
- Rebuild your runtimes when a CA or library advisory lands, as the eMudhra notice shows.
Real-World Examples and What Practitioners Say
Vendor feature lists only go so far. These six cases show how teams and vendors have used, chosen or responded with these tools, each drawn from a named source.
- GitLab and OpenBao. At FOSDEM 2025, an OpenBao presentation said OpenBao suits GitLab because GitLab already supports a Vault integration, a compatibility argument that matters for any tool with Vault-shaped plugins.
- Siemens and sustainable secrets management. An Open Source@Siemens 2026 talk, published on OpenBao’s blog, shared slides on sustainable secrets management with OpenBao, evidence that the fork reaches large industrial engineering organizations.
- Infisical during the eMudhra compromise. The company patched hosted instances on October 21 and told self-hosters exactly which Node.js, Go and Python versions to adopt.
- Doppler at Ada, Traive and Paradox. Customer stories on Doppler’s site report 95% efficiency gains, 10 hours saved per week with audits over 90% faster, and 75% faster Kubernetes adoption.
- The 2020 Microsoft Teams outage. Infisical’s certificate-management post recalls that Teams went down for hours in February 2020 after an authentication certificate expired without renewal, the failure mode that ACME automation exists to prevent.
What the Vault authors said
Two statements from Vault’s co-founder explain why OpenBao’s fork keeps the same design. In a 2015 InfoQ interview, Armon Dadgar, then co-founder and CTO of HashiCorp, said “Vault was started with the goal of solving secret distribution, and it does that very well, but it also provides a complete solution for security related problems like auditing, certificate management, key rotation and encryption.” In the same interview he said, “Dynamic secrets provide an elegant solution to this problem,” referring to short-lived database credentials with leases and revocation.
Both statements are 11 years old, so read them as design intent. They still describe the shared core that OpenBao and Vault ship today: audit, certificates, rotation and dynamic credentials. Infisical’s PKI work and Doppler’s rotation docs chase the same goals from a different direction.
The OpenBao side adds one more voice. A FOSDEM 2025 presentation from OpenBao project representatives said, “OpenBao is a great choice for GitLab because we already support a HashiCorp Vault integration.” Treat that as the project’s own pitch, not an independent endorsement from GitLab.
Use-Case Recommendations: Which Tool for Which Team
Six scenarios cover most of the questions engineering leads ask. The table gives the pick and the reason, and the prose below it adds the caveats.
| Scenario | Best fit | Why |
|---|---|---|
| Regulated enterprise with a vendor-support mandate | Vault 2.2 | Vendor support, HCP Vault Dedicated on AWS or Azure, broadest identity and PKI set |
| Platform team leaving Vault over licensing | OpenBao v2.7 | Vault-compatible design, LF Projects governance, PostgreSQL scalability |
| Product team that wants secrets, certificates and access in one place | Infisical | Secrets, PAM, certificate management and Agent Vault under one roof |
| Small team that wants a hosted service this week | Doppler | Per-seat model, 30-minute setup claim, no agent fees |
| AI-agent workloads that call external APIs | Infisical or Vault 2.2 | Agent Vault credential brokering, or agent and non-human identity support |
| Post-quantum readiness pilot | OpenBao v2.7 or Vault 2.2 | Both ship post-quantum features this quarter |
| Air-gapped site with hardware roots of trust | OpenBao with external HSM, or Infisical with SPIRE and TPM | External HSM and KMS keys, or documented on-prem attestation |
Kubernetes-heavy shops should decide how workloads fetch secrets before they pick a store. Our External Secrets Operator vs Sealed Secrets vs Vault comparison explains that layer, and OpenBao’s own documentation points to an External Secrets provider route. Infisical offers its own Kubernetes operator, and the older v1alpha1 API faces eventual deprecation, so new installs should start on v2.
Two cautions apply to the scenario table. First, the agent rows are the youngest part of every product, so pilot them before you route production credentials through them. Second, “best fit” assumes you already have staff who can run what you choose. A two-person startup that installs a self-hosted HA cluster has bought a second job.
Migration Guide: Vault to OpenBao in Eight Steps
Most migrations start from Vault, so this guide uses that source. The plan assumes a KV-heavy estate on Raft storage. Adapt the details if you use other engines, and rehearse everything in staging first.
- Inventory the cluster: secrets engines, auth methods, policies and audit devices.
- List every client: applications, CI jobs, Kubernetes operators and plugins.
- Snapshot the source cluster before any change.
- Build an OpenBao 2.7 test instance with the same storage type, TLS and auto-unseal approach.
- Recreate configuration as code, ideally in Terraform, so you can apply it twice.
- Copy a representative slice of KV data and run your clients against it.
- Run both clusters in parallel and shift workloads in waves, lowest risk first.
- Keep the source cluster read-only for a rollback window, then decommission it.
The commands below cover steps 1, 3 and 6. The copy loop moves only the latest version of each KV v2 secret and skips metadata, so treat it as a rehearsal tool and check how version history matters for your audits.
# Step 1: inventory
vault secrets list -detailed
vault auth list -detailed
vault policy list
vault audit list
# Step 3: snapshot (Raft storage)
vault operator raft snapshot save pre-migration.snap
# Step 6: copy one KV path into a test OpenBao instance
export BAO_ADDR=https://bao-test.internal:8200
for p in $(vault kv list -format=json secret/apps | jq -r '.[]'); do
vault kv get -format=json "secret/apps/${p}" \
| jq '.data.data' \
| bao kv put "secret/apps/${p}" -
doneWatch these three traps
The first trap is Enterprise-only features. If you rely on something that only Vault Enterprise provides, confirm that OpenBao ships an equivalent before you start. The second trap is the HSM distribution that OpenBao discontinued on October 5, which matters if you planned around it. The third is plugin drift. Plugins built against Vault internals may need rebuilding, so test them early. Anyone who needs a second target in the same rehearsal can stand up the managed alternative described in our AWS Secrets Manager setup guide.
Moving to Infisical or Doppler instead
The path to a developer platform is shorter but different. You export secrets by environment, create projects and environments in the new tool, then switch applications to its CLI or SDK. With Infisical, infisical login and infisical run -- your-command inject secrets at start-up. With Doppler, doppler setup and doppler run -- your-command do the same. Dynamic database credentials and PKI engines do not map one to one, so list which Vault engines you use before you commit to either.
A realistic timeline for a mid-size estate: two weeks of inventory and staging tests, two to four weeks of wave-based cutover, and a rollback window of at least one release cycle. Faster plans usually skip the client inventory and pay for it later.
Pros, Cons and Verdict: Which Secrets Manager Wins in October 2026
No tool wins every column. The table condenses the trade-offs from the sections above.
| Tool | Strengths | Weaknesses |
|---|---|---|
| OpenBao v2.7 | Open-source code under MPL 2.0, PostgreSQL scalability, external HSM and KMS keys, post-quantum support | No official price list, support through a separate subscription, parity with Enterprise features needs testing |
| Vault 2.2 | Widest feature set, managed HCP option, AI-agent identity, SCIM, post-quantum PKI | Per-client HCP fees add up, commercial licence, Enterprise quotes are custom |
| Infisical v0.167 | Fast releases, secrets plus PAM plus certificates, Agent Vault, self-host or cloud | Rapid change means more upgrades, self-hosters carry patch work |
| Doppler | Per-seat pricing with no agent fees, quick setup, active integrations | Hosted only in our sources, thin public changelog and version data |
The Verdict
For most teams already running Vault, the best next move is a two-week OpenBao 2.7 pilot next to the existing cluster, not an immediate switch. The data supports that call. OpenBao shipped two meaningful releases in under two months, 2.6 on August 18 and 2.7 on October 5, and its roadmap promises a stability-first 2.8. That is a project with momentum and a cautious plan.
Vault 2.2 still wins on completeness. It offers vendor support, a managed cloud service at published rates from $0.62 per cluster per hour, and a feature list that covers agent identity, SCIM and post-quantum PKI. If your auditors want a named vendor and an SLA, choose Vault and stop second-guessing.
Infisical wins for teams that value breadth and speed over server control. Three releases in three days during the eMudhra response is the strongest operational signal in this comparison. Doppler wins for teams that want a hosted per-seat service and do not need to own the server, though its public data is the thinnest of the four.
My ranking by situation: Vault for regulated enterprises, OpenBao for open-source platform teams, Infisical for product engineering teams, Doppler for small hosted-first teams. Revisit the call when the next OpenBao release lands and when Infisical’s pricing and Doppler’s version data become easier to verify. For more tooling coverage, browse our cybersecurity section.
Frequently Asked Questions
Is OpenBao a drop-in replacement for HashiCorp Vault?
It is built to be Vault-compatible, and GitLab’s FOSDEM 2025 presentation leaned on that compatibility. Drop-in is a strong word, though. Test your clients, plugins and any Enterprise-only features in staging first, and note that OpenBao discontinued its HSM distribution on October 5, 2026.
What are the newest versions of each tool?
As of October 24, 2026, OpenBao’s newest major release is v2.7 from October 5. Vault is on the 2.2 line, with 2.2.1 released October 23. Infisical’s newest self-hosted release is v0.167.2 from October 23. Doppler is a hosted service and does not publish a comparable version number.
Does OpenBao cost money?
The software has no official price list. A commercial subscription called Secretz Enterprise offers 24/7 support, software assurance and continued development, but no price was published in the source we reviewed. You also pay for infrastructure and operations.
How much does HCP Vault Dedicated cost?
HashiCorp lists the Development tier from $0.62 per cluster per hour, Essentials from $1.58 per hour plus $73 per Vault client per month, and Standard from $1.85 per hour plus $73 per client per month. A $500 credit is available to new accounts. Self-managed Enterprise is a custom quote.
What did Infisical say about the eMudhra compromise?
Infisical said Cloud and dedicated instances were already updated and required no customer action. Self-hosted users should upgrade to v0.167.0 and refresh their ca-certificates package. The notice also lists minimum Node.js, Go and Python certifi versions.
Does OpenBao support post-quantum cryptography?
Yes. The v2.7 release on October 5, 2026 added post-quantum cryptography alongside PostgreSQL horizontal scalability and external HSM and KMS-backed keys. Vault 2.2 added post-quantum support in PKI the same quarter.
Is Doppler cheaper than Infisical?
We cannot say. Doppler describes its model as per-seat with no agent fees, but we did not capture a dated Infisical price or a full Doppler price list. Compare both pricing pages against your seat and workload counts before you decide.
Is HashiCorp Vault still actively developed?
Yes. Vault 2.2 became the newest line in October 2026, and HashiCorp’s official material describes the product as part of the IBM HashiCorp ecosystem. Nothing we found shows it was retired or renamed.
