--- title: "OpenBao Alternatives: 5 Secrets Managers Compared" canonical: "https://infisical.com/blog/openbao-alternatives" published: "2026-11-13" tags: ["Resources"] source-index: https://infisical.com/llms.txt ---

# OpenBao Alternatives: 5 Secrets Managers Compared

OpenBao gives Vault teams back what the [2023 license change](https://infisical.com/blog/hashicorp-new-bsl-license) took away: Vault's API and engine model under the open-source MPL-2.0 license, governed in the open rather than by a single vendor. Many companies are exploring alternatives anyway because OpenBao doesn’t mitigate Vault’s complexity.

Anyone running OpenBao still needs to seal and unseal clusters, write HCL policies, manually configure rotation, access, and workflows, and frequently specialized developers to run the tool.

Most teams looking for OpenBao alternatives move to a [dedicated secrets manager](https://infisical.com/blog/secrets-management-complete-guide) like Infisical, which is open source and runs without a cluster to unseal or a specialist to run it.

## How the OpenBao alternatives compare

| Tool | Best for | Deployment | License | Dynamic secrets | What it takes to run |
| :---- | :---- | :---- | :---- | :---- | :---- |
| Infisical | Teams that want open source without running a Vault-style cluster | Cloud or self-hosted, including air-gapped | MIT core | 30+ targets, including AWS, GCP, and Azure identities | Nothing in the cloud, PostgreSQL and Redis self-hosted |
| HashiCorp Vault | Platform teams with Vault specialists that need the cloud engines or a managed option | Self-hosted or HCP Vault Dedicated | Source-available (BSL 1.1) | Database credentials with leases, plus cloud, Kubernetes, LDAP, and SSH engines | A cluster and Vault specialists, or HCP fees |
| CyberArk Secrets Manager | Enterprises already on CyberArk privileged access | Self-hosted or SaaS | Open-source edition under LGPL v3 | Just-in-time issuers | The CyberArk stack |
| Bitwarden Secrets Manager | Bitwarden customers that want a low-cost, end-to-end encrypted store | Cloud, self-hosted on Enterprise | Mixed: AGPL core, source-available parts | ✗ | Little in the cloud, the Bitwarden server stack self-hosted |
| SOPS | GitOps teams that keep encrypted config in Git | A local CLI | MPL-2.0 | ✗ | Key distribution |

## 1. Infisical

Infisical offers an MIT-licensed open-source secrets manager for teams that want advanced secrets management without assembling another system. Infisical features environments, approval policies, rotation, dynamic secrets, and syncs out of the box, which makes it much simpler to operate.

Infisical also has the pieces OpenBao moved out of its core:

* Workloads on AWS, Azure, and GCP authenticate with existing cloud identities
* Dynamic secrets issue AWS IAM, GCP IAM, and Azure Entra ID credentials without a plugin to install.

**Best for:** OpenBao teams frustrated with the effort of running a Vault-style system.

**Strengths:**

- Machine identities for AWS, Azure, GCP, Kubernetes, OIDC, JWT, SPIFFE, and TLS certificates.
- Environments built into every project, where OpenBao, like Vault, has no environment object and leaves the path layout to each team.
- Developers run any app locally with secrets injected through the CLI and use SDKs for Node, Python, Go, Java, .NET, and more.
- Rotation for MSSQL, Oracle, and MongoDB, and for SaaS keys such as Auth0 and OpenAI, with [dynamic secrets](https://infisical.com/blog/secret-rotation-vs-dynamic-secrets) for 30+ targets on top.
- Syncs into 50+ destinations, including AWS Secrets Manager, Azure Key Vault, GCP Secret Manager, GitHub, and Vault itself, where OpenBao has no sync to other stores.
- Point-in-time recovery for a whole environment or folder.
- A [Kubernetes operator](https://infisical.com/blog/kubernetes-secrets-management), a CSI driver, and an injector.
- KMS with encryption, signing, and KMIP for the work done with the transit engine.
- [Certificate Management](https://infisical.com/blog/certificate-management) that goes past OpenBao's PKI engine, with public and private CAs, automatic renewal, certificate discovery, and syncs into load balancers and cloud certificate stores.

**How it improves on OpenBao:**

- The operating model changes. There's no Vault-style cluster: Infisical Cloud runs it for you, and a self-hosted instance needs PostgreSQL and Redis.
- AI agents get their own security layer in [Agent Vault](https://infisical.com/docs/documentation/platform/agent-vault/overview), which brokers API credentials through a proxy so the agent holds only a session token. OpenBao gives an agent the same raw secret it gives any other client.
- Cloud workloads authenticate with their AWS, Azure, or GCP identity and get dynamic cloud IAM credentials, with no plugin to install.
- One company develops and supports it, where OpenBao's full-time maintainers are mostly funded by a few companies that sell competing OpenBao services.

**Pricing model:** the open-source core is free to self-host, with an enterprise license for paid features, and Infisical Cloud offers a free tier and paid plans.

## 2. HashiCorp Vault

Anyone familiar with OpenBao knows HashiCorp Vault, which has been offered by IBM since February 2025. It comes as self-managed Community and Enterprise editions or as a hosted version via HCP Vault Dedicated, a managed single-tenant service on AWS or Azure.

Vault’s architecture equals OpenBao’s, although Vault includes built-in cloud engines, a larger database catalog, and a vendor that offers support and continuous development.

Like OpenBao, it isn't a complete product out of the box, but [a set of primitives and plugins that teams build on extensively](https://infisical.com/compare/infisical-vs-hashicorp-vault).

**Best for:** platform and security teams with the people to run a central secrets and encryption service, who want the AWS, Azure, and GCP engines built in or a managed deployment, which OpenBao doesn't offer.

**Strengths:**

- The AWS, Azure, and GCP secrets engines are in the core product.
- [Dynamic database credentials](https://infisical.com/blog/from-static-to-dynamic-db-credentials), leased and revocable, for many databases.
- Many auth methods, including cloud IAM methods.
- Three ways to get secrets into Kubernetes: the Vault Secrets Operator, a CSI provider, and the Agent Injector.
- A managed option in HCP Vault Dedicated, for teams that want the cluster run for them.

**Limitations:**

- Self-managed Vault means running a cluster: your team needs to seal and unseal and build storage, high availability, upgrades, etc.
- There's no environment object. Dev and prod separation comes from mounts, paths, and policies you need to design and enforce.
- Namespaces, control groups, Secrets Sync, and SAML are Enterprise only.
- The BSL isn't an OSI license, so anyone embedding or offering Vault needs a legal review, and anyone who needs OSI terms needs the fork.

**Pricing model:** Community is free. Enterprise is licensed through sales with no published prices, and HCP Vault Dedicated bills an hourly cluster fee.

## 3. CyberArk Secrets Manager

CyberArk Secrets Manager, previously called Conjur, is [the secrets manager CyberArk built for applications and machines](https://infisical.com/blog/cyberark-conjur-alternatives). CyberArk is now part of Palo Alto Networks, which closed the acquisition in February 2026 and [moved the portfolio under the Idira brand](https://infisical.com/blog/idira-rebranded-cyberark) in May. It's available as SaaS or self-hosted, and its open-source edition, Conjur Open Source, now gets little development.

**Best for:** large enterprises already running CyberArk's privileged access stack that want application secrets from the same vendor.

**Strengths:**

- An open-source server under LGPL v3, with its own policy language, a REST API, and workload authenticators.
- A commercial self-hosted edition that adds high availability, HSM support, and KMS key encryption.
- Secrets Hub, which pushes secrets held in CyberArk's privileged access vault into AWS, Azure, GCP, and Vault stores.
- Just-in-time secrets through issuers.

**Limitations:**

- The open-source edition gets little development and doesn't include essential enterprise features.
- Secrets Hub only works with CyberArk's privileged access product as its source.
- SaaS rotation only runs through Privilege Cloud or the Secrets Rotation Service.
- Access is defined in its own policy language.

**Pricing model:** quote only for the commercial editions. Conjur Open Source is free.

## 4. Bitwarden Secrets Manager

Bitwarden Secrets Manager is the developer secrets product from the password manager company. It stores secrets in projects and gives machines access through machine accounts and access tokens, via the web vault, a CLI, and SDKs.

**Best for:** teams using Bitwarden that want a low-cost home for infrastructure secrets and don't need dynamic credentials.

**Strengths:**

- A free tier, and paid plans that start low.
- End-to-end encryption with a zero-knowledge design.
- Cloud hosting in the US or EU, or self-hosting.
- Integrations for GitHub Actions, GitLab, Jenkins, Ansible, Terraform, and a Kubernetes operator.

**Limitations:**

- There are no environments. Each secret belongs to one project.
- No rotation, dynamic secrets, approvals, or syncs to cloud stores are documented.
- Self-hosting needs an Enterprise plan and the Bitwarden server stack.

**Pricing model:** per user, with extra machine accounts billed beyond each plan's allowance.

## 5. SOPS

SOPS is a command-line tool that encrypts secret values inside YAML, JSON, ENV, INI, and binary files so they can be [committed to Git](https://infisical.com/blog/gitops-secrets-management). It's a CNCF Sandbox project under MPL-2.0.

**Best for:** GitOps teams that keep configuration in Git and want it encrypted with keys they already manage.

**Strengths:**

- There's no server to run, unseal, or upgrade.
- Only values are encrypted, so keys stay readable and files stay diffable in pull requests.
- It encrypts with AWS KMS, GCP KMS, Azure Key Vault, age, PGP, or Vault and OpenBao transit, so teams can run OpenBao and SOPS.
- Key groups use Shamir's Secret Sharing, so decryption can be made to need several key holders.

**Limitations:**

- It encrypts files and doesn't serve secrets: there's no API, dashboard, rotation, dynamic secrets, or syncs, so every pipeline needs a decrypt step.
- Anyone who has the keys also has access. Removing someone requires updating the keys, rotating the data key, and rotating the secret values.
- Key names stay in cleartext.
- It has no audit log or approval step itself. Git history, pull-request review, and KMS logs fill that role.

**Pricing model:** free. The key backend bills separately.

## Moving from OpenBao to Infisical

Most teams move one application at a time. KV secrets are exported from OpenBao and imported into Infisical projects, workloads switch to Infisical's Kubernetes operator, agent, or SDKs, and OpenBao keeps serving the applications that haven't moved yet. Teams still on Vault can skip the fork and use the [Vault migration guide](https://infisical.com/docs/documentation/platform/external-migrations/vault) instead. The [best secrets management tools](https://infisical.com/blog/best-secret-management-tools) cover the wider field.

## FAQ

### What are the best alternatives to OpenBao?

Most teams leaving OpenBao move to a simpler secrets manager like Infisical. Like OpenBao, Infisical is open source (MIT-licensed core). Infisical replaces Vault's operating model rather than keeping it, with no cluster to unseal, a managed cloud option, and much simpler operations. It fits teams that want open source without the work of running a Vault-style cluster.

### Is OpenBao a drop-in replacement for HashiCorp Vault?

Not entirely. OpenBao forked from Vault 1.14 and keeps most of its engines, but it has diverged from current Vault because it relies on a limited pool of open source maintainers. Its core product no longer includes the AWS, Azure, and GCP secrets engines or the cloud IAM auth methods, which now install as separate plugins. OpenBao also supports a shorter list of databases. A Vault cluster on a storage backend other than Raft also can't move across directly. Teams that rely on any of those need a workaround before switching.

### Does OpenBao have a managed or hosted version?

Not from the project itself. OpenBao is self-hosted software with an official Helm chart, and the project offers no managed service or vendor SLA. Teams run and support it themselves or buy managed hosting or support from one of a few third parties. These companies also fund most of OpenBao’s full-time maintainers. Infisical is open source and also runs as a managed service in Infisical Cloud, for teams that want open source without running it themselves.

### Does OpenBao support AWS, Azure, and GCP?

Yes, through plugins. OpenBao removed Vault's AWS, Azure, and GCP secrets engines and cloud IAM auth methods from the core part of the product, but they still exist as plugins. Teams on those clouds install and register them separately, or authenticate through JWT or OIDC workload identity instead.

### Is OpenBao free and open source?

Yes. OpenBao is free and licensed under MPL-2.0, an OSI-approved license, and it's run as a Linux Foundation project with open governance. Unlike Vault Community, it includes namespaces and control groups in the open-source project. The software costs nothing, but the cluster's infrastructure and the people or services to run it do. The guide to [open-source secrets management for DevOps](https://infisical.com/blog/open-source-secrets-management-devops) covers the other open-source options.

To keep open source without running a Vault-style cluster, [sign up](https://app.infisical.com/signup) and import your first secrets today, or [talk to an expert](https://infisical.com/talk-to-us) about moving off OpenBao.