OpenBao

Free plan APILinuxMacSelf-hostedWebWindows

What OpenBao is

OpenBao manages access to sensitive information such as API tokens, encryption keys, passwords, and certificates. It can be operated through a UI, CLI, or HTTP API and is self-managed under the Mozilla Public License 2.0, with no vendor pricing or usage limits stated. OpenBao encrypts key/value secrets before writing them to persistent storage. It can create temporary credentials for systems such as Kubernetes and SQL databases, then revoke them when their leases expire. Leases can be renewed, and individual secrets or groups can be revoked. OpenBao also encrypts and decrypts data without storing it, using centrally defined parameters. Authentication options include GitHub, LDAP, and AppRole, with policies associated to authenticated clients through tokens. Its storage security barrier uses AES-256-GCM and checks the authentication tag during decryption. High-availability configurations are supported. Deployment options include packages, containers, binaries, source builds, and Helm for Kubernetes; installation documentation includes Linux, macOS, FreeBSD, and Windows. Releases have GPG signatures, and SBOMs are available on GitHub Releases. Integrated Storage has a default maximum entry size of 1 MiB, configurable through max_entry_size.

Who it suits

It suits teams that need to manage secrets and encryption in a self-managed environment, including deployments involving Kubernetes or SQL databases. Operators should account for the stated Integrated Storage entry-size default and the security model's excluded scenarios.

What it does well

Manage through UI, CLI, or HTTP API
Dynamic secrets can be revoked when leases expire
Supports high-availability configurations
Free open-source software under Mozilla Public License 2.0

What to know first

Integrated Storage defaults to a 1 MiB maximum entry size
Storage backend control and running-instance memory analysis are out of scope

Limits

Integrated Storage has a default maximum entry size of 1 MiB; max_entry_size can be configured. OpenBao is self-managed, and no vendor pricing or usage limits are stated.

Plans

Plan	Billed and limits	Price
OpenBao	Open source software under Mozilla Public License 2.0 · Self-managed deployment · no vendor pricing or usage limits stated	Free

As openbao.org lists them, read 9 Oct 2026. The maker's own page has the final word.

Getting started

Visit the OpenBao website.
Choose an installation route: package manager, container, precompiled binary, source build, or Helm for Kubernetes.
Install on a supported Linux distribution, macOS, FreeBSD, or Windows system.
Manage OpenBao through its UI, CLI, or HTTP API.

Verdict

OpenBao provides self-managed secret storage, dynamic credentials, and encryption controls with multiple deployment options. Its security model excludes arbitrary control of the storage backend and memory analysis of a running instance; Integrated Storage also has a configurable 1 MiB default entry limit.

Questions

How much does OpenBao cost?

OpenBao is free and open source under the Mozilla Public License 2.0. It has no vendor pricing.

Is OpenBao self-hosted?

Yes. OpenBao supports self-managed deployment through packages, containers, binaries, source builds, and Helm for Kubernetes.

Which platforms are supported?

Installation options include Linux distributions, macOS, FreeBSD, and Windows. OpenBao also supports web, API, and self-hosted use.

Can OpenBao create and revoke secrets automatically?

It can generate dynamic secrets for systems such as Kubernetes and SQL databases, then revoke them when their leases expire.

What is the Integrated Storage limit?

The default maximum entry size is 1 MiB, and it can be configured through max_entry_size.

Facts from OpenBao's own pages

Access methods: Users can manage OpenBao through its UI, CLI, or HTTP API. · openbao.org, 9 Oct 2026
Authentication: OpenBao supports authentication methods including GitHub, LDAP, and AppRole, and associates authenticated clients with policies through tokens. · openbao.org, 9 Oct 2026
Deployment: OpenBao can be installed through package managers, container registries, precompiled binaries, source builds, or Helm for Kubernetes. · openbao.org, 9 Oct 2026
Dynamic secrets: OpenBao can generate secrets on demand for systems such as Kubernetes and SQL databases, then automatically revoke them when their lease expires. · openbao.org, 9 Oct 2026
Encryption: OpenBao can encrypt and decrypt data without storing it, using centrally defined encryption parameters. · openbao.org, 9 Oct 2026
Founded: 2023 · openbao.org, 28 Sept 2026
High availability: OpenBao supports running in a highly available configuration to help preserve availability during failures. · openbao.org, 9 Oct 2026
Integrations: The project lists integrations including Sigstore for artifact signing, StackHPC for OpenStack, and Percona for database encryption key management. · openbao.org, 9 Oct 2026
Leases and revocation: Secrets have leases that can be renewed through built-in APIs, and OpenBao can revoke individual secrets or groups of secrets. · openbao.org, 9 Oct 2026
Notable limit: Integrated Storage has a default maximum entry size of 1 MiB, which can be configured through max_entry_size. · openbao.org, 9 Oct 2026
Product: OpenBao is an identity-based secrets and encryption management system for storing and controlling access to sensitive data such as API tokens, encryption keys, passwords, and certificates. · openbao.org, 9 Oct 2026
Release security: The download page says releases have GPG signatures and SBOMs are available on the GitHub Releases page. · openbao.org, 9 Oct 2026
Secret storage: OpenBao encrypts key/value secrets before writing them to persistent storage. · openbao.org, 9 Oct 2026
Security: OpenBao's security barrier encrypts data sent to storage with AES-256-GCM and verifies the authentication tag when decrypting. · openbao.org, 9 Oct 2026
Security boundary: The security model treats arbitrary control of the storage backend and memory analysis of a running instance as out of scope. · openbao.org, 9 Oct 2026
Supported operating systems: Installation documentation includes packages for Linux distributions, Homebrew for macOS, FreeBSD packages, and a Windows executable. · openbao.org, 9 Oct 2026

Where OpenBao stands on Freedom251

Secrets Management Tools#9 of 46