Self-Hosted Secrets Management Vaults
Open-source alternatives to HashiCorp Vault for securely storing and managing sensitive credentials and configuration data.
Self-Hosted Secrets Management Vaults
Find the best repos with AI.We'll search the best matching repositories with AI.
- hashicorp/vault
hashicorp/vault
35,796View on GitHubVault is a centralized secrets management platform designed to secure, store, and control access to sensitive credentials such as API keys, passwords, certificates, and encryption keys. At its core, the system employs a barrier-based cryptographic sealing mechanism that requires an unseal process to decrypt internal storage, ensuring that sensitive data remains protected. It provides identity-based access control to manage granular permissions across distributed infrastructure, effectively centralizing security policies and authentication for both human and machine workloads. What distinguish
Vault is the industry-standard secrets management tool that fully matches all requirements: self-hostable, dynamic secrets, encryption at rest, RBAC, audit logging, secret rotation, API-driven management, and multiple auth backends — it is the definitive solution for this category.
GoDynamic Credential ProvidersDynamic Credential ProvisioningDynamic Secret Engines - openbao/openbao
openbao/openbao
6,433View on GitHubOpenBao is a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys.
OpenBao is a direct open-source fork of HashiCorp Vault, providing dynamic secrets, encryption at rest, role-based access control, audit logging, and a rich API — it fully meets the requirements for a self-hostable secrets management alternative.
GoDynamic Secret EnginesDynamic Secret ManagementSecret Rotation Systems - infisical/infisical
Infisical/infisical
27,374View on GitHubInfisical is a centralized secrets management platform designed to store, synchronize, and control access to sensitive credentials and configuration data across distributed development, staging, and production environments. It employs client-side encryption to ensure that secrets remain unreadable to the underlying storage infrastructure, while providing a hierarchical permission model to govern both user and machine access. The platform distinguishes itself through dynamic credential provisioning, which generates short-lived access tokens that are automatically revoked after use. It supports
Infisical is a centralized secrets management platform that provides dynamic credential provisioning, client-side encryption, and hierarchical access control—precisely the self-hostable Vault alternative with dynamic secrets, encryption, and role-based access you are looking for.
TypeScriptDynamic Credential ProvisioningDynamic Secret ManagementSecret Encryption - cyberark/conjur
cyberark/conjur
CyberArk Conjur automatically secures secrets used by privileged users and machine identities
CyberArk Conjur is a self-hostable secrets management platform that secures machine and privileged-user secrets with encryption, RBAC, audit logging, and API-driven management, though its support for dynamic secrets and built-in secret rotation is less comprehensive than Vault’s.
RubySecret Management
