COMPARE
ARCA vs HashiCorp Vault
HashiCorp Vault is a cluster you unseal. ARCA is a file you unlock. Free vault. $0 forever. Broker credentials to local coding agents with no Vault token, no network daemon, and a $99 Pro license.
| ARCA | HashiCorp Vault | |
|---|---|---|
| Operations | Unlock a local file | Run and unseal a cluster |
| Agent and CLI access | arca agent: dummy env, real token on the wire | Token plus policy API |
| Network in the crypto core | Zero, enforced in CI | Network service by design |
| Identity | No account, no Vault token | Auth methods and policies |
| Portability | One encrypted file | Storage backend and servers |
| License | Free vault. $0 forever. Pro $99 once | Open core with enterprise licensing |
No unseal ceremony.
ARCA opens with a password, Touch ID, or Windows Hello on the machine that holds the file. There is no Vault server, no seal status, and no unseal keys to shepherd. Named inner vaults still share that one envelope file.
Coding agents are first-class.
Vault policies serve infrastructure. arca agent serves the process in front of you: Claude Code, Cursor, Copilot. Dummy tokens in the child; real fields attached on the wire. terraform apply, docker compose, and pytest still use arca inject. Secrets never enter the prompt as pasted plaintext.
A core that cannot grow a listener.
CI blocks networking crates in arca-core. The published AGPL format uses Argon2id and XChaCha20-Poly1305. Duress and Shamir recovery are in the white paper. Cite that paper for cryptographic claims rather than this comparison.
Priced for a desk, not a fleet control plane.
Free vault. $0 forever. Unlock, search, store, CLI CRUD, and recovery. Pro is $99 once for inject, agent wrap / start, and ssh add. That is the path for a developer laptop, not a replacement story for an org-wide Vault estate. Infisical/Conjur self-host is a server you run. ARCA Free is a local vault file with no server. Agent wrap is Pro.
FAQ
ARCA vs HashiCorp Vault, in brief
ARCA. Unlock a vault file and wrap the tool with arca agent, or arca inject for scripts. No Vault cluster, no token, no unseal.
Yes for secrets that should never leave the machine. Wrap coding agents with arca agent. Store env branches locally and inject them into CLIs. Vault remains the cluster product for service identity at scale; this page is about the local workflow ARCA ships.
No. There is no Vault API. The CLI uses ~/.arca/ctl.sock on the same user. Agents receive a dummy env and a loopback proxy, not a cluster token.
arca-core (format, crypto, Shamir) is AGPL-3.0. The desktop shell, CLI, ssh-agent, and licensing are proprietary. Do not describe ARCA as fully open source. Cite the white paper for the threat model.
Shamir 3-of-5 paper cards from onboarding. ARCA Vision Labs cannot reset, bypass, or decrypt a forgotten vault password.
