Security & Privacy · Identity & Access Management (IAM)
OpenBao
Open-source secrets, certificates, and key management under community governance
OpenBao is an open-source service for managing machine secrets, certificates, and keys. It provides encrypted storage, dynamic credentials, leases, revocation, cryptographic APIs, PKI, and ACME integration. Hosted under the Linux Foundation OpenSSF and licensed under MPL-2.0, it supports packages, containers, binaries, source builds, and Kubernetes deployments. No first-party hosted service price is documented.
Key facts
- License
- MPL-2.0
- Main language
- Go
- Maintainer
- OpenBao community under the Linux Foundation OpenSSF
- Latest release
- v2.7.1, October 1, 2026
- GitHub stars
- 8,489, October 2026
- Hosted option
- No first-party hosted service or public price stated s
What OpenBao is
OpenBao is hosted under the Linux Foundation OpenSSF and governed through a Technical Steering Committee with contributors from Adfinis, ControlPlane, GitLab, IOTech, SAP, WALLIX, and independent maintainers. It began as a HashiCorp Vault fork in late 2023 after Vault's license changed, and its repository was created on November 9, 2023. The project is licensed under MPL-2.0 and lists 8,489 GitHub stars. Its multi-organization governance gives teams a community-controlled option, while commercial vendors can contribute engineering, support, assurance, and development services without owning the community project.
How it works
OpenBao centralizes machine credentials, certificates, keys, and related sensitive data behind a server, HTTP API, and command-line interface. Teams can move arbitrary key-value secrets out of application configuration, where OpenBao encrypts them before persistent storage. An application can authenticate, receive a policy-authorized secret, and use a lease that expires or can be renewed. Dynamic engines generate credentials for systems such as AWS and SQL databases and revoke them after lease expiration. Operators can revoke one secret or a tree after suspected compromise. Transit-style encryption and decryption lets applications protect data without receiving stored key material, while signing and certificate workflows extend the same control plane.
Architecture and recent releases
The Go-based repository contains the application, API and SDK libraries, documentation, website, and web interface code. Installation is available through package managers, container registries, precompiled binaries, source builds, and Helm for Kubernetes. The Helm chart supports development, standalone, high-availability, and external modes, but the default standalone configuration uses one server and file storage and is not appropriate for production. OpenBao supports integrated storage and PostgreSQL, while project describe namespaces, horizontal read scalability in version 2.5, and external keys and seal pluginization in version 2.6. Release v2.7.1, published October 1, 2026, included security fixes and storage, renewal, packaging, and cluster corrections.
License and pricing
MPL-2.0 permits commercial use, modification, redistribution, and commercial services subject to its license obligations. The project do not describe an open-core split, a server subscription requirement, or a first-party hosted service price. Teams therefore budget separately for infrastructure, operations, security controls, backups, monitoring, and any external support. Adfinis describes Secretz Enterprise as an enterprise subscription providing 24/7 support, software assurance, and continuous OpenBao development. That product is separate from the community project, and its price is not stated. This distinction matters during procurement because licensing the server, operating the security-sensitive control plane, purchasing support, and selecting hosting are separate decisions. Teams should confirm contractual scope, deployment responsibilities, and applicable fees directly with each provider.
Limitations and how it compares
OpenBao is most appropriate when a team wants self-managed control over machine secrets, certificates, and cryptographic operations while retaining substantial Vault API compatibility. Adoption requires more than installing a binary: operators must establish TLS, authentication, policies, audit devices, storage protection, backups, monitoring, upgrade sequencing, and initialization or unsealing procedures. Kubernetes users should replace the insecure default chart settings with a secured high-availability design and follow backup guidance before upgrades. HashiCorp Vault is the named compatible alternative, while Infisical, Conjur, SOPS, and Gopass are also named in the material without complete comparisons. The project fits organizations able to run this security-sensitive control plane.
Main features
- Encrypted Secret Storage. Stores arbitrary key-value secrets encrypted before writing them to persistent storage.
- Dynamic Credentials. Generates credentials for AWS and SQL databases, then revokes them after their leases expire.
- Leases and Renewal. Associates leases with secrets, supports renewal APIs, and automatically revokes secrets after expiration.
- Revocation. Revokes individual secrets or entire secret trees to support key rotation and intrusion response.
- Cryptographic Operations. Encrypts and decrypts application data without storing it, supporting API-based cryptographic workflows.
- PKI and ACME. Provides certificate management with PKI capabilities and ACME integration for automated certificate workflows.
- External Keys. Lets PKI and Transit use KMS plugins and external key material for selected cryptographic operations.
- Kubernetes Deployment. Supports development, standalone, high-availability, and external modes through the official Helm chart.
Self-hosting OpenBao
OpenBao can be installed through package managers, container registries, precompiled binaries, source builds, or Helm for Kubernetes. The chart supports development, standalone, high-availability, and external modes. Its default standalone mode uses one server with file storage and is explicitly unsuitable for production. A production deployment requires TLS, protected persistent storage, authentication, policies, audit devices, backups, monitoring, upgrades, and initialization or unsealing procedures. Operators remain responsible for cluster operation, including backup and upgrade sequencing. The documentation also recommends protecting swap because memory paging can undermine secret protection. No universal CPU or memory requirement is stated .
Strengths
- MPL-2.0 supports commercial use, modification, redistribution, and self-managed operation under its terms.
- Dynamic credentials and leases reduce the lifetime of credentials issued to machine workloads.
- OpenBao supports packages, containers, binaries, source builds, and Kubernetes deployments.
- Vault API compatibility can support migration assessment for existing Vault-oriented tools and workflows.
Drawbacks
- Production operation requires teams to manage security, availability, backup, upgrade, and recovery procedures.
- The default Kubernetes standalone configuration is unsuitable for production and needs deliberate hardening.
- No first-party hosted service or public hosted price is stated in the official material.
What teams replace with it
Teams usually evaluate OpenBao when they want to move off HashiCorp Vault Enterprise, Akeyless, Delinea Secret Server.
For side-by-side commercial comparisons, browse our alternatives hub.
Open-source alternatives to OpenBao
- HashiCorp Vault
- Infisical
- Conjur
- SOPS
- Gopass
Frequently asked questions
Is OpenBao free to use?
The repository identifies OpenBao as licensed under MPL-2.0, and the official texts do not state a server subscription or project charge. Infrastructure and operational costs still apply. The project does not publish a first-party hosted-service price. Commercial offerings such as Secretz Enterprise are separate vendor services, so their support scope and fees must be assessed independently.
Can companies use OpenBao commercially?
MPL-2.0 supports commercial use, modification, redistribution, and commercial services subject to its license obligations. Companies should review the complete license terms for changes and redistributed files. The project also describe Adfinis Secretz Enterprise, an enterprise subscription for support, software assurance, and development. That subscription is separate from OpenBao and has no stated general price.
How can OpenBao be deployed?
OpenBao can be installed through package managers, container registries, precompiled binaries, or source builds. Kubernetes users can use the official Helm chart in development, standalone, high-availability, or external mode. The chart's default standalone mode uses one server and file storage, and the documentation explicitly says it is not appropriate for production deployments.
How does OpenBao relate to HashiCorp Vault?
OpenBao was forked from HashiCorp Vault in late 2023 and remains largely API compatible according to the project presentation. Existing Vault-oriented tools and workflows may therefore be migration candidates, but each integration requires testing. The texts do not provide a complete current comparison of Vault features, support, pricing, or licensing.
What security controls does OpenBao provide?
OpenBao encrypts secrets before persistent storage and provides leases, renewal, revocation, authentication methods, policies, audit devices, cryptographic APIs, and certificate capabilities. Production operation still depends on secure configuration, restricted storage access, TLS, backups, monitoring, and incident procedures. Kubernetes users must also handle initialization, unsealing or auto-unsealing, and safe upgrade sequencing.
Similar projects to compare
- InfisicalMIT for core; ee directories require an Infisical commercial licenseInfisical is an open-core security platform for secrets, certificates, privileged access, and AI-agent credentials. Its core is MIT licensed and self-hostable, while enterprise features in ee directories require a commercial license. Infisical Cloud exists with a free plan, Pro pricing at $20 per identity monthly when billed annually, and Advanced pricing at $40.
- AuthentikMIT (core), mixed repository; enterprise code under separate enterprise licenseAuthentik is an open-source identity provider for teams needing OIDC, OAuth2, SAML, LDAP, RADIUS, SCIM, and proxy access in one self-hosted service. Its core is MIT licensed, while enterprise code is separately licensed. There is no general hosted cloud product advertised, and enterprise pricing starts at $0.02 per external user monthly when billed annually.
- AuthgearApache-2.0Authgear is an Apache-2.0 open-source authentication and user-management platform maintained by Skymakers Digital Ltd. It supports self-hosting and Authgear Cloud, with a Free plan priced at $0 monthly. Documented capabilities include passwordless login, passkeys, MFA, social and enterprise login, SSO, user management, APIs, customizable interfaces, user import, and export.
- Better AuthMITBetter Auth is an MIT licensed, framework agnostic authentication and authorization framework for TypeScript. It embeds authentication in an application backend, supports application managed databases and stateless sessions, and offers email, password, social sign on, passkeys, magic links, usernames, and extensible plugins. Better Auth joined Vercel on July 7, 2026, while its open source framework remains framework and platform agnostic.
- CerbosApache-2.0Cerbos is an open-source authorization layer with a stateless Policy Decision Point that evaluates context-aware YAML policies for applications, gateways, workloads, services, and AI agents. It exposes HTTP and gRPC APIs, runs in customer infrastructure, and supports Git, disk, cloud, and database policy storage. Cerbos Hub adds hosted authoring, testing, distribution, and audit management from $25 per month.
- HankoAGPL-3.0 for backend; MIT for Hanko Elements and hanko-frontend-sdkHanko is an open-source authentication and user-management system built around an API. It supports passwords, passkeys, passcodes, MFA, social login, SAML SSO, sessions, webhooks, and customizable web components. The backend is AGPL-3.0, while Hanko Elements and the frontend SDK are MIT licensed. Hanko is available for self-hosting or Hanko Cloud, whose free plan includes 10,000 monthly active users.