HashiCorp Vault Secrets Manager

This tool is an identity-based secrets and encryption management system providing encryption services gated by authentication and authorization methods, enabling organizations to centralize and manage secrets, certificates, and encryption keys across distributed infrastructure. Created by Mitchell Hashimoto and Armon Dadgar at HashiCorp in 2015, the project has over 31,000 stars as of 2026 and is widely adopted by Fortune 500 companies for managing credentials, API keys, certificates, and encryption operations. Key features include: secrets storage (key-value secrets with versioning for static credentials, dynamic secrets generated on demand for databases, cloud platforms, and PKI certificates, and transit secrets engine for encryption as a service), authentication methods (token, AppRole, LDAP, OIDC, Kubernetes service accounts, AWS IAM, GCP, Azure, TLS certificates, and JWT/OAuth for machine and human identity), secrets engines (database dynamic credentials, AWS and GCP dynamic credentials, PKI certificate authority, SSH certificate signing, Transit encryption, Identity entity and group management, and Transform data tokenization), audit logging (recording every request and response with hash-based sensitive data redaction for compliance), lease management (automatic revocation and rotation of dynamic secrets with configurable TTL and max TTL), replication (performance replication for multi-region read replicas and disaster recovery replication for backup clusters), namespaces (multi-tenant isolation with separate administrative boundaries and mount paths), Shamir's Secret Sharing (unseal key split into N shares requiring quorum to reconstruct the master key), auto-unseal (cloud KMS-based unsealing using AWS KMS, GCP KMS, Azure Key Vault, or Transit auto-unseal), ACL policies (path-based access control with CRUD and list permissions), and identity-based access (entities and groups tying authentication methods to consistent identities with policy assignment).