Repolode
Submit
openbao

openbao/openbao

Open-source software for managing, storing, and distributing secrets, certificates, and keys, forked from HashiCorp Vault's open-source lineage.

Open-source alternative to:HashiCorp Vault

View on GitHubWebsite
Stars
8,630
Forks
639
Open issues
332
Last commit
9 hours ago

What is it?

OpenBao is a server for managing sensitive data such as secrets, certificates, and keys. It encrypts secrets before writing them to persistent storage, so access to the raw storage alone does not expose their contents. Storage backends include local disk and PostgreSQL.

Beyond static key/value storage, OpenBao can generate dynamic credentials on demand for systems such as AWS or SQL databases, and automatically revoke them when their lease expires. Clients can renew leases through built-in APIs, and revocation can target a single secret or a whole tree of secrets, which helps with key rotation and incident response.

OpenBao also offers data encryption as a service, letting applications encrypt and decrypt data without implementing their own cryptography. The repository includes the `bao` binary, a development-mode server, the web UI, and the documentation site. Its `api/v2` and `sdk/v2` Go modules are published for other projects to import.

Key features

  • 01Encrypts key/value secrets before writing them to storage such as disk or PostgreSQL.
  • 02Generates dynamic credentials for systems like AWS and SQL databases, revoking them when leases expire.
  • 03Supports lease renewal through built-in APIs.
  • 04Revokes single secrets or whole trees of secrets for key rotation and incident response.
  • 05Provides encrypt and decrypt operations so applications need not manage their own encryption.
  • 06Publishes Go API and SDK modules for importing into other projects.

Use cases

  • Centralizing database credentials and API keys for microservices.
  • Issuing short-lived cloud credentials to applications on demand.
  • Encrypting sensitive fields in application databases without custom crypto code.
  • Revoking access to a set of secrets after a suspected intrusion.

Quick start

  1. 1

    Install the Go toolchain (version pinned in .go-version)

  2. 2

    Build the bao binary

    go build -o bin/bao .
  3. 3

    Run the OpenBao server in development mode

    go run . server -dev

Things to know

  • The README only documents building from source with Go, so you need a Go toolchain installed.
  • Importing the main github.com/openbao/openbao module into other projects is explicitly unsupported.

Topics

#secret-management#security#encryption#key-management#credentials#golang#go

FAQ

What is openbao?
Open-source software for managing, storing, and distributing secrets, certificates, and keys, forked from HashiCorp Vault's open-source lineage. OpenBao is a server for managing sensitive data such as secrets, certificates, and keys. It encrypts secrets before writing them to persistent storage, so access to the raw storage alone does not expose their contents. Storage backends include local disk and PostgreSQL.
Is openbao free to use? What license does it have?
openbao is open source under the MPL-2.0 license. Check the license terms before using it in commercial products.
Is openbao still maintained?
Actively maintained. The last commit to openbao was on Oct 21, 2026.
What can I use openbao for?
Centralizing database credentials and API keys for microservices. Issuing short-lived cloud credentials to applications on demand. Encrypting sensitive fields in application databases without custom crypto code. Revoking access to a set of secrets after a suspected intrusion.
How do I install openbao?
Install the Go toolchain (version pinned in .go-version) Build the bao binary: go build -o bin/bao . Run the OpenBao server in development mode: go run . server -dev
Where can I get openbao?
The source code and installation instructions are on GitHub: https://github.com/openbao/openbao

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects