Comparing Configuration and Secrets Management ToolsHashicorp VaultAdvantages and Disadvantages Compared to EnvKey

Popular and widely used. Especially at larger companies, Hashicorp Vault is a popular choice for secrets management. Hashicorp is respected for engineering quality across all its product offerings and Vault is no exception.

Open source. Vault's core features are free and open source under the MPL 2.0 license. Some advanced features are available in an enterprise version. Update: as of August 10th, 2023, Hashicorp has switched to the source available Business Source License, which is more restrictive.

Strong authentication, authorization, and network security. While not end-to-end encrypted (see disadvantages below), Vault is strong on other aspects of security. It is designed for deployment behind the firewall and supports a variety of authentication methods, as well as fine-grained authorization policies. It also has a 'seal' feature that causes the Vault server to immediately encrypt all its data, rendering it inaccessible to all clients until it is unsealed again.

Encryption-as-a-service. Apart from secrets management, Vault also offers a variety of encryption-as-a-service features, including management of certificates and keys, encryption/decryption, secrets generation, and tokenization.

Not end-to-end encrypted. Despite Vault's security and encryption features, the Vault server still has access to all your secrets. This means that if the Vault server is compromised, whether by an outside attacker or a rogue insider at your organization, your secrets will probably be compromised too. Though the 'seal' feature could be used to cut off access during a breach, in real-world scenarios it's generally very difficult to do this quickly enough.

Complex setup and integration. Setting up a secure, highly available Vault cluster is a complex process. Even seasoned DevOps teams can spend weeks or months getting it right. Getting secrets from Vault to your applications is also fairly complex and will add additional steps to your development and deployment processes across every project.

Lacks configuration management features. Vault is primarily focused on secrets management, and does not offer much in the way of config management features. It doesn't have built-in concepts for apps, environments, branches, or locals, instead relying on on a more ad-hoc approach to secrets organization and access control using namespaces and policies. It also lacks functionality for reacting to changes in secrets.

Hashicorp Vault is a strong, enterprise-focused solution for secrets management. But despite its focus on security, its lack of end-to-end encryption is a significant drawback in comparison to EnvKey. Ultimately, regardless of how secure your Vault server setup is, it still has access to all your secrets in plaintext, giving it a much larger attack surface than EnvKey. It doesn't do much to address insider threats, paricularly those that originate on a DevOps team. Any engineer with operational access to the Vault server will necessarily have to be trusted with access to all an organization's secrets.

Vault's complexity also introduces an ongoing maintenance burden and 'integration tax' that can slow down development and deployment processes. EnvKey's focus on developer productivity and ease of use makes it much easier to setup in the first place (minutes vs. weeks), and makes loading secrets for any environment, from development to production, something you'll rarely have to think about.

While Vault has some features that EnvKey lacks, like encryption-as-a-service and LDAP integration, overall EnvKey offers a simpler and more secure approach to configuration and secrets management for most organizations. And though Vault is well-established and trusted in the enterprise, EnvKey is no slouch on enteprise-focused features, offering high availability, audit logs, SSO, SCIM, teams, role-based access control, and scalability that can handle thousands of developers and servers.

Vault has (deservedly) reached "nobody gets fired for choosing it" status in the enterprise, and it could certainly make sense to reach for it if you need some of its more advanced features, but for many organizations, EnvKey will win out in a cost-benefit analysis.