OSI-licensed open source
A key management server stores, rotates and controls access to cryptographic keys and secrets so applications do not hold them in config files. Open-source options span full secrets platforms, KMIP servers for storage and database encryption, and tools that lean on cloud KMS backends.
Each tool here is OSI-licensed, checked on its repository on 2026-11-07. Two popular names are left out on purpose: HashiCorp Vault is under the Business Source License, and Eviden (formerly Cosmian) KMS is listed in its repository as BUSL-1.1. Both are source-available, not open source.
Tools, licences and pricing checked against vendor and repository pages on November 7, 2026.
| Tool | Best for | Pricing | Licence |
|---|---|---|---|
| OpenBao | Self-hosted secrets and key management with a Vault-like model | Free, open source | MPL-2.0 |
| OpenStack Barbican | OpenStack clouds | Free, open source | Apache-2.0 |
| Infisical | Developer-friendly secrets plus basic key operations | Free, open source (core); enterprise features need a paid licence, see vendor pricing. | MIT |
| PyKMIP | KMIP testing and lightweight KMIP deployments | Free, open source | Apache-2.0 |
| CyberArk Conjur | Machine-identity secrets in CI/CD and containers | Free, open source (Conjur OSS) | LGPL-3.0 |
| SOPS | GitOps secrets encrypted with your cloud KMS | Free, open source | MPL-2.0 |
Best for: Self-hosted secrets and key management with a Vault-like model · Free, open source
OpenBao is a software solution to manage, store and distribute secrets, certificates and keys. It is licensed under MPL-2.0.
Best for: OpenStack clouds · Free, open source
Barbican is an API for storing, provisioning and managing secrets, mainly for OpenStack environments. The GitHub repository mirrors code maintained on opendev.org.
Best for: Developer-friendly secrets plus basic key operations · Free, open source (core); enterprise features need a paid licence, see vendor pricing.
Infisical is a secret management platform that also covers certificates and privileged access. Its KMS features include central management of cryptographic keys and symmetric encrypt and decrypt via API. The ee directory is excluded from the MIT licence.
Best for: KMIP testing and lightweight KMIP deployments · Free, open source
PyKMIP is a Python implementation of the Key Management Interoperability Protocol (KMIP), including a server component.
Best for: Machine-identity secrets in CI/CD and containers · Free, open source (Conjur OSS)
Conjur secures secrets used by privileged users and machine identities. The server is LGPL-3.0 with API clients and extensions under Apache-2.0.
Best for: GitOps secrets encrypted with your cloud KMS · Free, open source
SOPS edits encrypted files in YAML, JSON, ENV, INI and binary formats. It encrypts with AWS KMS, GCP KMS, Azure Key Vault, HuaweiCloud KMS, age or PGP.
One email a week with the tools, launches and releases added to TechLogHub. Unsubscribe in one click.
One email a week: new and trending developer tools, fresh comparisons, and what shipped. Unsubscribe in one click.
| If you need… | Start with |
|---|---|
| Self-hosted secrets and keys with a Vault-style model | OpenBao |
| OpenStack integration | OpenStack Barbican |
| Secrets platform with developer UX | Infisical |
| KMIP for storage or database encryption | PyKMIP |
| Machine identities in pipelines | CyberArk Conjur |
| Encrypted secrets in Git using cloud KMS | SOPS |
Quick answers to common questions
A service that generates, stores, rotates and controls access to cryptographic keys, ideally keeping them off application hosts.
No. Vault is under the Business Source License, which is source-available. OpenBao is an MPL-2.0 alternative.
The Key Management Interoperability Protocol, used by storage arrays and databases to talk to key servers. PyKMIP implements it.
These projects do not claim FIPS validation in their repositories; if you need it, check hardware or vendor options.
List it on TechLogHub and we'll review it for this guide.
