keephippo vs. Vault

keephippo is a clean-room, Vault-compatible secrets manager. It re-implements a useful subset of HashiCorp Vault's HTTP API so existing Vault clients keep working, while shipping its own console and branding. This page is a factual comparison — not a claim that keephippo replaces Vault.

⚠️ Not audited, not Enterprise. keephippo is an educational / portfolio project. It has not undergone a security audit and does not implement Vault Enterprise features. Vault remains the mature, audited, production-grade product.

At a glance

Capability	keephippo	Vault
Wire API (`/v1/*`, `X-Vault-Token`, JSON envelope)	✓ compatible	✓ (the reference)
Existing Vault/OpenBao CLI works against it	✓ for the implemented surface	✓
KV v1 & v2	✓	✓
Auth: token, userpass, approle, cert	✓	✓ (+ many more)
Transit (encryption as a service)	✓	✓
Policies, tokens, leases, identity	✓ core subset	✓ full
Audit devices, response wrapping, cubbyhole	✓	✓
Auto-unseal (transit seal)	✓	✓ (+ cloud KMS/HSM)
Embedded web console	✓	✓
Integrated Storage / HA (Raft)	— deferred	✓
Broad engine/auth catalogue (PKI, SSH, DB, AWS, OIDC, k8s…)	— curated subset	✓ extensive
Enterprise: replication, HSM, namespaces, Sentinel	— non-goal	✓ (Enterprise)
Security audit & production track record	— not audited	✓ mature

Why it exists

keephippo is a from-scratch build for learning and portfolio purposes: a way to understand how a secrets manager works end-to-end — barrier encryption, Shamir seals, the request/ACL pipeline, engines and auth methods — by re-implementing Vault's public interface rather than reading its source. It is a clean-room implementation against the public API spec, using the MPL-2.0 OpenBao project as a reference where needed, never Vault's BUSL-licensed source.

When to use which

Reach for Vault / OpenBao

Production secrets, compliance, HA at scale, the full engine catalogue, and a security-audited, supported product.

Reach for keephippo

Learning how a secrets manager is built, local development against a Vault-shaped API, or a small self-hosted store for non-critical data.

"Vault" and "HashiCorp" are trademarks of their respective owners. keephippo is independent and not affiliated with or endorsed by HashiCorp or IBM. "Vault-compatible" is a factual description of wire compatibility only.