No. 11 of 39 ·Secrets Management Tools

OpenStack Barbican

Linux · Self-hosted · API

Freedom report

Two barsScore 6.3

Free tierA free tier is on its own pricing page
Open codeNo open-source code on record
Runs widely1 of 6 device platforms
DocumentedPlans, terms and facts published

OpenStack Barbican is ranked #11 of 39 in secrets management tools on Freedom251. It runs on API, Linux, Self-hosted. There is a free plan.

OpenStack Barbican plans and pricing

All plans

Open source Barbican Free No plan limits stated docs.openstack.org · 4 Oct 2026

Compared on secrets management tools

Deployment model: self_hosted

Best OpenStack Barbican alternatives

See all 20

Two bars Keyway Free tier No. 1€9/mo6.6 Two bars Kubermatic Kubernetes Platform Free tier No. 2Free6.6 Two bars Phase Free tier No. 3$10/mo6.6 Two bars SikkerKey Free tier No. 4$29/mo6.6 Two bars Infisical Free tier No. 5$2/mo6.5 Two bars KeyEnv Free tier No. 6$0.28/mo6.5

The record

Purpose: Barbican is the OpenStack Key Manager service for secure storage, provisioning, and management of secrets such as keys, certificates, passwords, and raw binary data.
API: The barbican-api service provides an OpenStack-native REST API for provisioning and managing secrets.
Components: The service includes barbican-api, barbican-worker, and barbican-keystone-listener components.
Secret stores: A plugin architecture lets operators store secrets in software-based stores or hardware devices such as HSMs.
HSM support: The PKCS#11 crypto plugin interfaces with a Hardware Security Module, with master encryption and HMAC keys residing in the HSM.
Integrations: Documented secret-store plugins include KMIP, Dogtag, and Vault, alongside PKCS#11 crypto plugins.
Keystone: The Keystone listener manages Barbican database representations of Keystone projects when those projects are deleted.
Security tradeoff: The default Simple Crypto plugin stores its single encryption key in plaintext in barbican.conf, so access to service nodes must be restricted carefully.
ACL limitation: Container ACL settings are not propagated to associated secrets, and ACL functionality applies only when Barbican is integrated with Keystone.
Customization: Operators can develop custom plugins for secret storage, generation, and event handling; plugin support status can be stable, experimental, or out-of-tree.
Deployment requirement: The installation documentation assumes a working OpenStack deployment.
License: The OpenStack project is provided under the Apache 2.0 license.
Price from: Free

Where it ranks on Freedom251

Best Secrets Management Tools in 2026#11 of 39
Best Virtualization Management Software in 2026#10 of 33
Best Cloud Management Software in 2026#12 of 33
Best Cloud Automation Software in 2026#10 of 31
Best Cloud Orchestration Software in 2026#14 of 24
Best Encryption Key Management Software in 2026#3 of 16
Best Key Management Software in 2026#3 of 16

Is OpenStack Barbican yours?

Claim it for free: prove the domain, then correct facts, plans and screenshots. An editor reviews every change.

Claim it free Promote OpenStack Barbican

Sources

docs.openstack.org/barbican/latest/· checked 4 Oct 2026
docs.openstack.org/barbican/latest/install/get_started.htm· checked 4 Oct 2026
docs.openstack.org/barbican/latest/install/barbican-backen· checked 4 Oct 2026
docs.openstack.org/barbican/latest/api/reference/acls.html· checked 4 Oct 2026
docs.openstack.org/barbican/latest/contributor/plugin/inde· checked 4 Oct 2026
docs.openstack.org/barbican/latest/install/index.html· checked 4 Oct 2026