OpenBao
Community-governed, truly open-source secrets manager — a Linux Foundation fork of Vault, born when Vault went source-available.
🔗 Visit OpenBao
Description
Applications need passwords, API keys and certificates to talk to other systems, and storing those directly in code or config files is a classic security mistake. OpenBao is a free, open tool whose entire job is to store that sensitive data safely, hand it out only to what's authorized to have it, and automatically expire it when it's no longer needed. OpenBao is an open-source secrets management platform: a community-driven fork of HashiCorp Vault, created after Vault relicensed to the Business Source License (BSL) in 2023, and now governed by the Linux Foundation under the OpenSSF umbrella. It encrypts all data before persistent storage, generates dynamic, short-lived credentials on demand for systems like databases and Kubernetes rather than relying on static long-lived secrets, and offers encryption-as-a-service with centralized key management so applications can encrypt/decrypt data without ever storing the key themselves. Access control is identity-based across multiple pluggable authentication providers, with automatic secret leasing, renewal and hierarchical revocation. Written mostly in Go with a web UI, it's MPL-2.0 licensed — a genuinely open-source license, unlike Vault's current BSL — with active development (6,700+ GitHub stars, 20,000+ commits).
💬 Our review
The short version: if the reason you wanted HashiCorp Vault was specifically that it was open source, OpenBao is now the more honest answer to that need — same core capability, real open governance, no BSL restrictions.
OpenBao's entire reason to exist is a license event: when HashiCorp moved Vault to the Business Source License in 2023, it stopped being freely redistributable and commercially usable the way true open source is, which is exactly the trigger that spun off OpenTofu from Terraform too. OpenBao inherited Vault's architecture and most of its capability — dynamic secrets, encryption as a service, identity-based access, leasing/revocation — while moving governance to the Linux Foundation and licensing under MPL-2.0. That's a meaningfully different trust model for organizations (especially ones building products on top of it) that need certainty their infrastructure dependency won't get relicensed out from under them again. The trade-off: as a fork, it necessarily lags slightly behind Vault's newest proprietary/enterprise features, and migration tooling from an existing Vault deployment, while documented, is still real work. For teams currently paying HashiCorp for Vault Enterprise purely to stay compliant with BSL terms, or teams starting fresh who want secrets management with zero license risk, OpenBao is the credible free alternative; teams deeply invested in Vault Enterprise's newest features may find migration not yet worth it.
💰 Pricing
📊 Global score
🤖 AI-enriched data
Pros
True open-source license (MPL-2.0) vs Vault's BSL
Linux Foundation / OpenSSF governance, no single-vendor lock-in
Same core capability as Vault: dynamic secrets, encryption as a service
Cons
Lags newest Vault Enterprise features as a fork
Migration from existing Vault deployments takes real effort
🔄 Alternatives to OpenBao
See all alternatives to OpenBao →❓ Frequently asked questions
- Why does OpenBao exist when HashiCorp Vault already does this?
- HashiCorp relicensed Vault to the Business Source License (BSL) in 2023, which restricts redistribution and some commercial use. OpenBao is a fork that kept the original open-source (MPL-2.0) approach, now governed by the Linux Foundation instead of a single vendor.
- Can I migrate an existing Vault setup to OpenBao?
- Yes, migration paths are documented since OpenBao shares Vault's core architecture, but expect real migration work — test thoroughly before switching production secrets infrastructure.
- What are dynamic secrets?
- Instead of storing a permanent database password, OpenBao generates short-lived, on-demand credentials that automatically expire — so a leaked credential has a limited window of usefulness, unlike a static one.
- Is it worth the money compared to alternatives?
- It's free with no license fee, directly avoiding what HashiCorp Vault Enterprise charges for. Compared to managed SaaS options like Doppler or Infisical Cloud, self-hosting OpenBao costs only your infrastructure time — worth it if you have the ops capacity and want zero vendor lock-in.
- Which secrets manager should you pick for your case?
- Want Vault's capability with true open governance, self-hosted: OpenBao. Want a simpler, dev-friendly SaaS with a generous free tier: Infisical or Doppler. Already deep in AWS: AWS Secrets Manager. Staying on Vault and fine with BSL terms: HashiCorp Vault.