openbao

Core Features

• Encrypted secret storage: secrets are encrypted before hitting disk, PostgreSQL, or other backends
• Dynamic secrets: generates short-lived AWS and database credentials on demand and revokes them automatically
• Encryption as a service: encrypt and decrypt data without storing it
• Leasing, renewal, and revocation: every secret has a TTL, with tree-wide revocation for incident response
• Detailed audit logging of who accessed which secrets and when

What It Can't Do

• •The dev server mode stores everything in memory and auto-unseals, so never use it in production. OpenBao is infrastructure software for platform and ops teams, not a personal password manager like 1Password; using it for individual passwords is overkill. Production deployments require planning around the seal/unseal workflow, storage backends, and high availability, so expect a real learning curve. There is no official hosted offering, meaning you must self-host and maintain it yourself. Go developers should not import the main repository as a library; only the api/v2 and sdk/v2 client modules are officially supported.

Use Cases

• Centralizing database passwords and API keys for a platform team instead of scattering plaintext credentials across code and config files
• Issuing and rotating certificates and tokens for service-to-service communication in a microservices architecture
• Instantly revoking all secrets of a compromised user or service to contain a security breach

Tags

Getting Started