OpenBao vs Doppler
Both are alternatives to HashiCorp Vault. Here's how they stack up — verified facts, no spin.
Also searched as Doppler vs OpenBao — same comparison, one verdict.
OpenBao
TOP PICKVault before the licence changed — forked, MPL-2.0, run by a foundation.
OpenBao is the Linux Foundation's fork of Vault, taken from the last release before the Business Source License and continued under MPL-2.0. It is not a reimplementation or a lookalike: it is the same codebase, so the API, the CLI, the policy language and the storage format are Vault's, and migration is closer to a rename than a port. Governance is the whole point — it sits under a foundation with multiple corporate contributors rather than a single vendor who can change the terms again. Around 6.9k stars and actively developed. If your reason for looking is the licence rather than the product, this is the answer and there is not much more to decide.
Doppler
Hosted secrets with the polish, if you would rather not run one.
Doppler is a fully managed secrets platform: a good UI, wide integration coverage across cloud providers and CI systems, environment and branch scoping, and automatic rotation for common backends. It is proprietary and hosted, which is the honest trade — you are exchanging the operational burden for a dependency on someone else's uptime and pricing. Included here because for a small team with no platform engineer, a managed service they will actually configure correctly beats a self-hosted one they will misconfigure, and pretending otherwise would not serve the reader.
Side by side
| OpenBao | Doppler | |
|---|---|---|
| Sovereignty Score | 94 | 42 |
| Open source | Yes | No |
| Self-hostable | Yes | No |
| Local-first | Yes | No |
| License | MPL-2.0 | Proprietary (hosted service) |
| Pricing | Free and open source. You run it on your own infrastructure. | Free tier for individuals and small teams; paid team plans per seat per month. |
OpenBao is Macrostack's recommended HashiCorp Vault alternative, so it's our pick here.
OpenBao
Strengths
- +The same codebase — migration from Vault is close to drop-in
- +MPL-2.0 under Linux Foundation governance, not a single vendor's discretion
- +Keeps Vault's dynamic secrets, PKI and transit engines
- +Existing Vault knowledge, tooling and Terraform providers transfer directly
Trade-offs
- −Inherits Vault's operational difficulty in full — this is not the easy option
- −Smaller community than Vault, and the ecosystem is still catching up
- −No enterprise namespaces or vendor support contract
- −Divergence from upstream Vault will grow over time
Doppler
Strengths
- +Nothing to operate — no unsealing, no HA design, no upgrades
- +Broad integrations across clouds, CI systems and frameworks
- +Clean UI that non-platform engineers can use without training
- +Automatic rotation for common backends
Trade-offs
- −Proprietary and hosted — your secrets sit in someone else's system
- −No self-host option at any price
- −Per-seat pricing grows with the team rather than with usage
- −You inherit their pricing decisions, exactly as Vault users inherited HashiCorp's
Related alternative guides
Facts verified 2026-07-31. Licenses and pricing change — spotted something out of date? That's a correction we want.