OpenBao

What is OpenBao?

OpenBao is an open source secrets management tool that stores and controls access to secrets — API keys, database passwords, tokens, and certificates — and can generate short-lived credentials on demand. It is a community-driven fork of HashiCorp Vault, created after HashiCorp relicensed Vault away from open source, and is now hosted under the Linux Foundation’s OpenSSF.

What is OpenBao best for?

OpenBao suits teams that already run Vault or want Vault’s capabilities without its license terms. Because it forked from Vault 1.14 (the last MPL-2.0 release), its API, CLI, and storage are largely compatible, so it is a natural landing spot for anyone leaving Vault over the Business Source License while keeping the same secrets workflows.

What can OpenBao do?

• Store static secrets in an encrypted key-value store, encrypted before they ever touch disk.
• Issue dynamic secrets — generate on-demand, auto-expiring credentials for AWS, databases, Kubernetes, and more, instead of long-lived passwords.
• Encryption as a service — encrypt and decrypt application data through the transit engine without your app ever handling the keys.
• PKI / certificate authority — mint and rotate TLS certificates on demand.
• Leasing, renewal, and revocation — every secret has a lease; revoke a single secret or a whole tree at once.
• Identity-based access control — authenticate humans and machines and enforce fine-grained policies across clouds and services.
• High-availability storage with an integrated Raft backend, plus audit logging of every request.

Where does OpenBao fall short?

OpenBao dropped Vault’s proprietary Enterprise features when it forked — advanced multi-cluster replication and HSM auto-unseal aren’t part of the community project, so if you depend on those you’ll need to weigh alternatives. There is also no first-party managed/hosted service: unlike HashiCorp’s HCP Vault, you run and operate OpenBao yourself. Finally, it is a younger project than Vault, so some third-party integrations, tutorials, and Helm charts still assume Vault and may need small tweaks.

Is OpenBao free?

Yes — OpenBao is fully free and open source under the MPL-2.0 license, with no paid tier, feature gating, or commercial edition held back by the project. Everything in the roadmap is developed in the open. Your only costs are the servers you run it on and the time to operate it.

What does OpenBao replace?

OpenBao is a drop-in-minded alternative to HashiCorp Vault, and it competes with managed cloud secret stores like AWS Secrets Manager and Azure Key Vault, as well as enterprise privileged-access platforms like CyberArk. If you want Vault-style dynamic secrets and encryption without a per-secret cloud bill or a proprietary license, OpenBao is the like-for-like open source option. For a friendlier UI-first approach, teams also compare it with Infisical.

FAQ

Is OpenBao open source? Yes. OpenBao is licensed under MPL-2.0, an OSI-approved open source license, and is governed as a community project under the Linux Foundation’s OpenSSF — the same license Vault used before HashiCorp switched to the Business Source License in 2023.

Can I migrate from HashiCorp Vault to OpenBao? In most cases, yes. OpenBao forked from Vault 1.14, so its API, CLI commands, and storage format are broadly compatible and existing Vault clients and policies typically work with little or no change. Test enterprise-only features, which OpenBao doesn’t include.

Is OpenBao a good HashiCorp Vault alternative? For open source, self-hosted secrets management it’s the closest match — same core engines (KV, transit, PKI, dynamic secrets) without the license restrictions. It’s a weaker fit only if you need Vault Enterprise’s replication, HSM support, or a vendor-managed cloud.

What do I need to run OpenBao? A single Go binary (or container) on Linux, macOS, or Windows, plus a storage backend — the built-in Raft store needs nothing extra. It’s lightweight to start, though production setups add high availability, backups, and unseal-key management.