OpenBao
Community-governed, truly open-source secrets manager — a Linux Foundation fork of Vault, born when Vault went source-available.
🔗 Visit OpenBao
Description
Applications need passwords, API keys and certificates to talk to other systems, and storing those directly in code or config files is a classic security mistake. OpenBao is a free, open tool whose entire job is to store that sensitive data safely, hand it out only to what's authorized to have it, and automatically expire it when it's no longer needed.
OpenBao is an open-source secrets management platform: a community-driven fork of HashiCorp Vault, created after Vault relicensed to the Business Source License (BSL) in 2023, and now governed by the Linux Foundation under the OpenSSF umbrella. It encrypts all data before persistent storage, generates dynamic, short-lived credentials on demand for systems like databases and Kubernetes rather than relying on static long-lived secrets, and offers encryption-as-a-service with centralized key management so applications can encrypt/decrypt data without ever storing the key themselves. Access control is identity-based across multiple pluggable authentication providers, with automatic secret leasing, renewal and hierarchical revocation. Written mostly in Go with a web UI, it's MPL-2.0 licensed — a genuinely open-source license, unlike Vault's current BSL — with active development (6,700+ GitHub stars, 20,000+ commits).
💬 Our review
The short version: if the reason you wanted HashiCorp Vault was specifically that it was open source, OpenBao is now the more honest answer to that need — same core capability, real open governance, no BSL restrictions.
OpenBao's entire reason to exist is a license event: when HashiCorp moved Vault to the Business Source License in 2023, it stopped being freely redistributable and commercially usable the way true open source is, which is exactly the trigger that spun off OpenTofu from Terraform too. OpenBao inherited Vault's architecture and most of its capability — dynamic secrets, encryption as a service, identity-based access, leasing/revocation — while moving governance to the Linux Foundation and licensing under MPL-2.0. That's a meaningfully different trust model for organizations (especially ones building products on top of it) that need certainty their infrastructure dependency won't get relicensed out from under them again. The trade-off: as a fork, it necessarily lags slightly behind Vault's newest proprietary/enterprise features, and migration tooling from an existing Vault deployment, while documented, is still real work. For teams currently paying HashiCorp for Vault Enterprise purely to stay compliant with BSL terms, or teams starting fresh who want secrets management with zero license risk, OpenBao is the credible free alternative; teams deeply invested in Vault Enterprise's newest features may find migration not yet worth it.
💰 Pricing
📊 Global score
🤖 AI-enriched data
Fully open source under MPL-2.0, Linux Foundation governed, no license fee
Pros
True open-source license (MPL-2.0) vs Vault's BSL
Linux Foundation / OpenSSF governance, no single-vendor lock-in
Same core capability as Vault: dynamic secrets, encryption as a service
Cons
Lags newest Vault Enterprise features as a fork
Migration from existing Vault deployments takes real effort