HCP Vault Secrets is retired: what to move to
Short answer: HashiCorp announced the end of HCP Vault Secrets, and the dates in its notice have now passed. If you still depend on it, confirm with HashiCorp what state your applications are in and export your values now. HashiCorp points to HCP Vault Dedicated or Vault Community edition; other routes include a cloud provider's store, an open-source fork, or a lighter delivery tool such as Dynv.
Disclosure: we make Dynv. This page sticks to what we could read: HashiCorp’s own notices (through Internet Archive copies, because the live pages were not reachable from our network) and product pages. We did not obtain current Vault Dedicated pricing, so there are no prices here; check HashiCorp’s pricing page.
What HashiCorp said
From the end-of-sale announcement (archived 2026-04-18): HCP Vault Secrets “will no longer be available for purchase by new customers after June 30th, 2025,” and “HashiCorp has decided to sunset HCP Vault Secrets.” It adds that this “does not impact Vault or HCP Vault Dedicated.”
From HashiCorp’s support notice (archived 2026-04-19):
- End of sale: June 30, 2025. Existing customers could add new secrets until end of life.
- End of life: the “earlier of the Flex contract expiry or July 1, 2026.” At that point “HCP Vault Secrets applications will be deleted.”
- Alternatives named: HCP Vault Dedicated, or Vault Community edition, with a migration guide for each. Contact: [email protected].
Today is after July 1, 2026. We cannot see your account, so we cannot tell whether your data is still available. If you have not exported, ask HashiCorp support first, today.
Your options
| Route | Good for | Trade-offs |
|---|---|---|
| HCP Vault Dedicated | Staying with HashiCorp’s managed service | Per HashiCorp, a hosted Vault Enterprise on single-tenant clusters on AWS or Azure; a much bigger product than a simple secrets store (docs). Check pricing and operational fit |
| Vault Community edition (self-hosted) | Full control, no vendor | You run, unseal, back up and upgrade it |
| OpenBao | An open-source fork of Vault under open governance | Self-hosted; check feature parity with what you use (project) |
| Cloud provider store (AWS, GCP, Azure) | Everything already in one cloud | Tied to that cloud; not a developer workflow for local environments |
| A secrets platform (Doppler, Infisical, others) | Hosted, developer-focused | See our comparison |
| Dynv | Small teams that mostly need values delivered to services, live updates, and a server that cannot read them | Young: no SSO yet and team workspaces are coming soon; no dynamic secrets or PKI |
Choose by what you actually used. HCP Vault Secrets was a key-value store with apps and integrations, so if that was all, a heavyweight Vault cluster may be more than you need. If you used dynamic secrets, PKI or transit encryption, those are Vault features, and a key-value tool will not replace them.
Moving values to Dynv
Export from HashiCorp however you can (the CLI, API or their migration tooling) into a dotenv or JSON file, then preview the import. Nothing is written until you confirm, and values stay masked:
dynv admin import billing secrets.json --dry-run
dynv admin import billing secrets.json --yesDynv’s importer reads dotenv or flat JSON, or goes through a locally installed vendor CLI for Doppler, Infisical and Heroku; there is no HCP Vault importer, so a file export is the route. Keep one service per app and environment, move one service at a time, run it under dynv run before cutting over, and delete the export file afterwards (walkthrough). Then plan to rotate secrets that sat in a system you are leaving (how).
Limits
- We could not verify HashiCorp’s live pricing or current account behaviour; all HashiCorp facts above come from the archived notices cited.
- We did not run the Dynv import against an HCP Vault export; the importer commands come from
dynv admin import --help. - Dynv’s server cannot read values, which also means it cannot run rotation hooks that need plaintext; those run on your machines.
Facts last verified . Spotted an error? Tell us.