Keywhiz

KeyWhiz: Open-Source Secret Management

Keywhiz is an open-source software system that helps manage and distribute secrets such as passwords and authentication keys. It provides secure storage and controlled access based on role-based permissions.

What is Keywhiz?

Keywhiz is an open-source software system designed to help manage and distribute secrets such as passwords, API keys, SSL certificates, and other authentication artifacts securely. It provides secure storage, versioning, and controlled access to help organizations centralize and control access to secrets through fine-grained access controls.

Keywhiz allows organizations to store secrets encrypted in a database backend. It supports plugins for storage in MySQL, PostgreSQL, and SQLite. Access to secrets is controlled through access groups and clients based on HTTPS mutual TLS authentication integrated with LDAP or custom plugins. Keywhiz aims to reduce insecure secrets sprawl and provide secret distribution as a service within organizations.

Key features of Keywhiz include:

• Secure encrypted storage of secrets and credentials
• Versioning of secrets to retain history
• Access control via client certificates and access groups
• Automated secret rotation
• Integrations with HashiCorp Vault and other systems
• CLI client and management UI
• Audit logging of access

Keywhiz was created and open-sourced by Square and is now used by various organizations to centrally manage API keys, passwords, certificates and other secrets. It aims to improve security by reducing reliance on insecure practices like hardcoded credentials.

Keywhiz Features

Official Links