openbao

Open source alternative to HashiCorp Vault, CyberArk, Akeyless, Doppler, CyberArk Conjur, AWS Secrets Manager and Azure Key Vault

8.6K stars
MPL-2.0
Active this week
Last commit 1 day ago

Last verified Oct 21, 2026

Manage secrets, certificates, and keys with an open source, MPL-2.0-licensed fork of HashiCorp Vault governed by the Linux Foundation.

Visit website GitHub8.6K Deploy on Hostinger

Read the full breakdownWho it is for, how it works, trade-offs, the quick start and the FAQ

who it's for

Who openbao is for#

DevOps teams migrating off HashiCorp Vault Enterprise

OpenBao preserves the Vault API and ships from the same MPL-2.0 codebase, so existing Vault configurations, Terraform providers, and client libraries work without code changes. Teams that froze on the last OSS Vault release to avoid BSL licensing can move to an actively maintained fork with a clear governance path.

Skip if:

If your team depends on Vault Enterprise features like HSM integration, Vault Secrets Operator, or specific enterprise plugins, verify those are available in OpenBao before migrating.

Platform engineers standardizing secrets management

Dynamic credentials eliminate long-lived static secrets from application config. OpenBao's unified ACL system lets platform teams define access policies once and apply them across Kubernetes, AWS IAM, database credentials, and other backends from a single control plane.

Skip if:

If your platform requires a managed, zero-ops secrets service, OpenBao requires self-hosting expertise. A managed service like Akeyless may reduce operational burden at the cost of a SaaS dependency.

Security teams centralizing encryption and key management

The encryption-as-a-service API lets applications encrypt data without owning or managing keys. Security teams define rotation policies, audit every key access via built-in audit logging, and revoke keys centrally without touching application deployments.

Skip if:

If your compliance requirements mandate a FIPS-validated HSM and you have no engineering bandwidth for integration, evaluate whether OpenBao's PKCS11 working group output meets your requirements before committing.

Kubernetes operators managing dynamic database credentials

OpenBao integrates with Kubernetes service accounts and can issue short-lived database credentials directly to pods via sidecar or init-container patterns. Credentials are scoped per workload and automatically revoked at TTL expiry, removing permanent database users from the equation.

Skip if:

If your Kubernetes cluster relies on Vault Secrets Operator as a Vault-native integration, verify OpenBao's compatibility with that operator before adopting it in production.

the problem

The problem it solves#

Managing secrets across modern infrastructure is one of the hardest operational problems in DevOps. An application stack might span multiple databases, cloud providers, Kubernetes clusters, and third-party APIs, each with credentials that need to be rotated, audited, and revoked without downtime. Handling this manually means secrets get stored in environment files, version-controlled config, or team wikis, creating security gaps that are hard to detect until something goes wrong.

When HashiCorp changed Vault's license from MPL-2.0 to the Business Source License in 2023, teams running Vault at scale lost the right to use future versions under an OSI-approved license. Many organizations faced a choice: pay for Vault Enterprise, migrate to a proprietary service like CyberArk or Akeyless, or freeze on the last open source release. None of those options preserved both open governance and Vault API compatibility.

how openbao solves it

How it solves it#

Secure Secret Storage

Stores arbitrary key/value secrets with encryption before writing to persistent storage, so access to the raw storage backend does not expose the secrets. Supports multiple storage backends including disk and PostgreSQL.

Dynamic Secrets for Cloud and Databases

Generates on-demand credentials for systems like AWS S3, SQL databases, and Kubernetes. Each set of dynamic credentials carries a TTL lease and is automatically revoked when the lease expires, reducing the window for credential misuse.

Encryption as a Service

Encrypts and decrypts data without storing it, providing centralized key management across clouds and datacenters. Applications call the API to encrypt data before persisting it, offloading key management from application code.

Lease-Based Secret Lifecycle

Every secret in OpenBao has a lease. At lease expiration, the secret is automatically revoked. Clients can renew leases via built-in API endpoints, and administrators can revoke individual secrets or entire trees, such as all secrets issued to a specific user.

Unified Identity and ACL System

Brokers access to secrets using a unified ACL system that merges identities across multiple cloud providers, Kubernetes service accounts, and authentication methods. Eliminates identity sprawl when infrastructure spans multiple providers.

strengths · trade-offs

Strengths and trade-offs#

Strengths

MPL-2.0 License Under Linux Foundation GovernanceShips under the MPL-2.0 license, an OSI-approved open source license, with governance by the Linux Foundation. Unlike Vault Enterprise or CyberArk, there are no commercial tiers, per-node fees, or license compliance gates. Active backers include SAP (EU-funded), GitLab, Proton, ControlPlane, and Fermilab.
Vault API CompatibilityForked from HashiCorp Vault's MPL-2.0 codebase, OpenBao preserves the Vault API surface. Teams migrating from Vault can repoint existing clients and tooling without rewriting integration code, lowering the migration cost compared to switching to a different secrets manager architecture.
Active Development With Diverse Sponsorship8,009 GitHub stars, 590 forks, and a last push in September 2026. Multiple working groups are active on namespaces, PKCS11, scalability, supply chain, and UI. Sponsored development from SAP (EU NextGenerationEU funding), GitLab, and others means the project is not dependent on a single backer.
Broad Contributor and Backer BaseBacked by a mix of commercial companies (SAP, GitLab, ControlPlane, Liquid Reply), research institutions (Fermilab), and infrastructure providers (Blendbyte for packages). This mix reduces the risk of a single company influencing the project's direction or its funding being withdrawn.

Trade-offs

-Production deployment requires infrastructure expertiseRunning OpenBao in production requires configuring storage backends, TLS, audit logging, and HA setup. The development server mode is a single command, but a production deployment with proper unsealing, replication, and access policies takes meaningful ops effort. Not a zero-configuration install.
-Active issue backlog from an ongoing forkWith 327 open issues, OpenBao carries a backlog typical of a project actively inheriting from a large codebase while managing its own roadmap. Not all issues are bugs, but teams should check the tracker for any items in their specific use area before adopting.
-Fork launched in late 2023; ecosystem is still maturingOpenBao was created in November 2023. Some integrations, plugins, and enterprise patterns that Vault Enterprise has built over nearly a decade are still in progress or undocumented in OpenBao. Teams with niche Vault integration requirements should verify support before migrating.

versus alternatives

openbao vs alternatives#

OpenBao vs HashiCorp Vault

OpenBao and HashiCorp Vault share the same origin codebase up to the MPL-2.0 fork point, but diverge on licensing, governance, and enterprise feature availability.

Feature	OpenBao	HashiCorp Vault
License	MPL-2.0 (OSI-approved)	BSL 1.1 (post-1.13.x)
Self-hosting	Yes	Yes
Enterprise features	Community-developed	Paid enterprise tier
Governance	Linux Foundation	HashiCorp / IBM
API compatibility	Fork-point compatible	Full

OpenBao is the better choice when you need an OSI-approved license, open governance, and Vault API compatibility without paying for Vault Enterprise. HashiCorp Vault Enterprise is still the better fit when you need specific enterprise features like Vault Secrets Operator, HSM integration, or commercial support SLAs, and are already paying for the HashiCorp stack.

OpenBao vs CyberArk

CyberArk is an enterprise privileged access management platform focused on human and machine identity security, while OpenBao is a developer-facing secrets manager built around API-accessible credential storage and dynamic secrets.

Feature	OpenBao	CyberArk
License	MPL-2.0 (open source)	Proprietary
Self-hosting	Yes	Yes (appliance-based)
Primary focus	Developer secrets, dynamic creds	Privileged access management
API-first design	Yes	Partial

OpenBao fits developer and platform teams building cloud-native infrastructure; CyberArk fits enterprise security teams managing privileged human accounts and session recording. CyberArk's market is compliance-heavy enterprises with dedicated security operations teams.

OpenBao vs Akeyless

Akeyless is a managed SaaS secrets manager with no self-hosting requirement, while OpenBao is fully self-hosted. Both support dynamic secrets and API-based access.

Feature	OpenBao	Akeyless
License	MPL-2.0 (open source)	Proprietary SaaS
Self-hosting	Yes (required)	No (managed)
Operational overhead	Medium (infra required)	Low
Dynamic secrets	Yes	Yes

OpenBao is the better choice when your team has the infrastructure expertise to self-host and wants full data control with an open source license. Akeyless fits teams that want secrets management without managing a server, accepting a SaaS dependency in exchange for reduced ops burden.

install · quick start

Quick start#

bash

Deploy by cloning the repository and building the binary with the Go toolchain.
```bash
git clone https://github.com/openbao/openbao
cd openbao && go build -o bin/bao .
```

tech stack · detected from GitHub

What it's built on#

Languages: GoJavaScriptTypeScript
Frameworks: React
Tooling: RollupWebpack

frequently asked

FAQ#

Why was OpenBao forked from HashiCorp Vault?

HashiCorp changed Vault's license from MPL-2.0 to the Business Source License (BSL) in August 2023, restricting commercial use without a paid license. OpenBao was created to continue Vault development under an OSI-approved open source license, governed by the Linux Foundation rather than a single commercial entity. The project's mission statement explicitly commits to maintaining an OSI-approved license under open governance.

Is OpenBao compatible with HashiCorp Vault's API?

Yes. OpenBao was forked from Vault's MPL-2.0 codebase and maintains API compatibility with the fork-point release. Existing Vault clients, SDKs, and Terraform providers work with OpenBao. Newer Vault Enterprise features introduced after the fork are not present, but the core API surface is compatible and OpenBao continues to evolve it under community governance.

What license does OpenBao use?

MPL-2.0 (Mozilla Public License 2.0), an OSI-approved open source license. You can run it on your own infrastructure, use it commercially, and modify the source code. The main obligation is that modifications to MPL-licensed files must be shared under MPL-2.0 if distributed, but you can combine it with proprietary code in the same project without that obligation extending to the proprietary parts.

How do I install OpenBao?

Build from source with the Go toolchain by running 'go build -o bin/bao .' from the cloned repository root. Pre-built RPM and DEB packages are available at pkgs.openbao.org. A dev-mode server for local testing starts with './bin/bao server -dev', but production deployments require configuring a storage backend, TLS, and an unsealing strategy.

Who maintains OpenBao?

OpenBao is a Linux Foundation project with a Technical Steering Committee running under open governance principles. Active contributors include developers from SAP (funded by the EU NextGenerationEU program), GitLab, ControlPlane, Fermilab, Adfinis, and Liquid Reply, among others. The project also has active working groups on namespaces, PKCS11, scalability, supply chain, and UI.

also worth a look

Similar open-source tools#

Nexion

Alternative toTermius

Web3 SSH manager that replaces passwords with crypto keys

17 GitHub stars
Licence Apache-2.0

Unkey

Alternative toKong Konnect

Unified API keys, gateways, and observability for developers.

5,471 GitHub stars
Licence FSL-1.1-ALv2

Gitdrive

Alternative toiCloud Drive

Your GitHub repos as a native drive in macOS Finder

130 GitHub stars
Licence MIT

Keda

Alternative toKedify

Event-driven Kubernetes autoscaling with 70+ scalers and scale to zero

10,646 GitHub stars
Licence Apache-2.0

Obtainium

InIT Management

Android app updates direct from GitHub and F-Droid

20,630 GitHub stars
Licence GPL-3.0

OpenShell

Alternative toE2B

Sandboxed runtime for autonomous AI agents, open source by NVIDIA

16,848 GitHub stars
Licence Apache-2.0

by category

Open source tools in these categories#

126

Hostinger

Run openbao on your own server

Self-host openbao on a Hostinger VPS.

Deploy on Hostinger

Featured

rakazo

Alternative toGrok Bot

AI teammates you own: your keys, your model, your machine.

4,904 GitHub stars
Licence Apache-2.0
#AI Agents

Inbox Zero

Alternative toSuperhuman

AI email assistant that drafts replies and clears your inbox

12,712 GitHub stars
Licence AGPL-3.0
#Email

Omnara

Alternative toClaude Managed Agents

Open-source agent deployment API. Self-host or use Omnara Cloud.

2,957 GitHub stars
Licence Apache-2.0
#AI Agents

Feature your project

The projects we add and every new guide. Free, unsubscribe any time.

Find open source alternatives to paid software

OpenBao vs HashiCorp Vault

OpenBao and HashiCorp Vault share the same origin codebase up to the MPL-2.0 fork point, but diverge on licensing, governance, and enterprise feature availability.

Feature	OpenBao	HashiCorp Vault
License	MPL-2.0 (OSI-approved)	BSL 1.1 (post-1.13.x)
Self-hosting	Yes	Yes
Enterprise features	Community-developed	Paid enterprise tier
Governance	Linux Foundation	HashiCorp / IBM
API compatibility	Fork-point compatible	Full

OpenBao vs CyberArk

Feature	OpenBao	CyberArk
License	MPL-2.0 (open source)	Proprietary
Self-hosting	Yes	Yes (appliance-based)
Primary focus	Developer secrets, dynamic creds	Privileged access management
API-first design	Yes	Partial

OpenBao vs Akeyless

Akeyless is a managed SaaS secrets manager with no self-hosting requirement, while OpenBao is fully self-hosted. Both support dynamic secrets and API-based access.

Feature	OpenBao	Akeyless
License	MPL-2.0 (open source)	Proprietary SaaS
Self-hosting	Yes (required)	No (managed)
Operational overhead	Medium (infra required)	Low
Dynamic secrets	Yes	Yes

Who openbao is for#

DevOps teams migrating off HashiCorp Vault Enterprise

Skip if:

Platform engineers standardizing secrets management

Skip if:

Security teams centralizing encryption and key management

Skip if:

Kubernetes operators managing dynamic database credentials

Skip if:

The problem it solves#

How it solves it#

Secure Secret Storage

Dynamic Secrets for Cloud and Databases

Encryption as a Service

Lease-Based Secret Lifecycle

Unified Identity and ACL System

Strengths and trade-offs#

Strengths

Trade-offs

openbao vs alternatives#

OpenBao vs HashiCorp Vault

OpenBao vs CyberArk

OpenBao vs Akeyless

Quick start#

What it's built on#

FAQ#

Similar open-source tools#

Open source tools in these categories#

Security & Monitoring

Cloud & Hosting

Developer Tools

Find open source alternatives to paid software

Who openbao is for#

DevOps teams migrating off HashiCorp Vault Enterprise

Skip if:

Platform engineers standardizing secrets management

Skip if:

Security teams centralizing encryption and key management

Skip if:

Kubernetes operators managing dynamic database credentials

Skip if:

The problem it solves#

How it solves it#

Secure Secret Storage

Dynamic Secrets for Cloud and Databases

Encryption as a Service

Lease-Based Secret Lifecycle

Unified Identity and ACL System

Strengths and trade-offs#

Strengths

Trade-offs

openbao vs alternatives#

OpenBao vs HashiCorp Vault

OpenBao vs CyberArk

OpenBao vs Akeyless

Quick start#

What it's built on#

FAQ#

Similar open-source tools#

Open source tools in these categories#

Security & Monitoring

Cloud & Hosting

Developer Tools

Find open source alternatives to paid software