Suggestions appear as you type. Use the up and down arrows to choose one and Enter to open it.

This page's audience our own tag's counts — open to see them
–Visits
–Page views
–Clicks to vendors
–Time on page
–Reading now
Clicks to vendors, by tool
  • –
Top countries
  • –
Devices
  • –

– · visits, page views and clicks counted by our own tag, which counts more than our checked analytics; every figure rounded down · how we count

KeyRack

Free#20 of 27 in Key Management Software

KeyRack: A self-hosted key-routing service for teams managing providers, policies and HSM operations. Ranked #20 of 27 in Key Management Software by our editors (7.3/10); pricing: Free plan; best for developers wanting open-source self-hosted key routing.

7.3/10Editor score
Visit KeyRack
KeyRack7.3 Visit KeyRack

At a glance

  • Editor score
    7.3 / 10
  • Pricing
    Free plan
  • Best for
    Developers wanting open-source self-hosted key routing
  • Free plan
    Yes
  • Paid from
    Free
  • HSM-backed keys
    Yes
  • Facts checked
    20 Sep 2026
KeyRack screenshot

  • Where it wins

    • Hierarchical key trees support namespace-scoped rules and cascade operations
    • Routes across software, PKCS#11, Vault Transit and KMIP providers
    • Tamper-evident audit verification with BLAKE3 and optional Ed25519 signing

  • Where it doesn't

    • Self-hosted deployment requires infrastructure managed by the adopting organization
    • Commercial extensions use contact-based pricing
    • Automatic scheduled rotation and key import are outside the documented scope

Our verdict on KeyRack

KeyRack is an open-source key management service that runs in an organization's infrastructure. It is designed for developers and platform teams that need self-hosted key routing across software providers, HSMs, Vault Transit and KMIP. Its audience includes regulated industries, multi-cloud platforms, SaaS providers and OpenStack operators. The service provides gRPC and REST APIs, supports customer-controlled HSM and KMIP backends through HYOK configurations, and is available under AGPL-3.0-or-later.

Its strongest differentiator is coordination across key hierarchies and providers. Hierarchical key trees support namespace-scoped rules and cascade operations, while multi-provider routing enables cross-provider re-encryption. HSM-backed cryptographic operations add hardware-backed handling, and external Cedar or OPA policy decision point integration allows policy decisions to remain part of an existing control model. These capabilities make KeyRack a focused fit for teams that need routing and policy coordination rather than a single-provider key service.

KeyRack also fits infrastructure teams that need structured, verifiable audit trails. It can emit audit events through NATS, files or stdout, with BLAKE3 hash chaining and optional Ed25519 signing for verification. Integrations include AWS KMS, OpenStack Barbican, PostgreSQL, SQLite, Docker Compose, Kubernetes, OIDC and mTLS, while AWS KMS and OpenStack Barbican compatibility is available through commercial extensions. Teams should choose KeyRack when they can operate self-hosted infrastructure and value open-source control, provider flexibility and HYOK. Organizations seeking a fully managed service or public numeric pricing for commercial extensions should consider alternatives.

Your product? Our editors can test KeyRack in depth and publish a review, labelled as paid · from $149/mo →

KeyRack pricing

Plans Free planFree Free to use — no paid tier required for the core job.
See plans on keyrack.io

KeyRack fact sheet

Free planYes
Paid fromFree
HSM-backed keysYes
Automatic key rotationNot verified
Audit logsYes
Deployment modelSelf_hosted
Key importNot verified
Supported key typesBoth
Customer-managed keysYes
DeploymentSelf-hosted
SupportCommunity, Docs
Built forMid-market, Enterprise (editorial estimate)
Integrations14 integrations: AWS KMS, OpenStack Barbican, PKCS#11, HashiCorp Vault Transit, KMIP, Cedar …
PricingFree plan
Websitekeyrack.io
Facts checked20 Sep 2026

KeyRack integrations

KeyRack lists 14 integrations on its own site.

  • AWS KMS
  • OpenStack Barbican
  • PKCS#11
  • HashiCorp Vault Transit
  • KMIP
  • Cedar
  • OPA
  • NATS
  • PostgreSQL
  • SQLite
  • Docker Compose
  • Kubernetes
  • OIDC
  • mTLS

Alternatives to KeyRack

See all KeyRack alternatives →

Used KeyRack? Be the first to review it

The editor score above is our own research. What this page doesn't have yet is a reader's view — what you used KeyRack for, what worked and what didn't. No stars are seeded and no review is paid for; an editor reads every one before it appears.

Write a reviewTwo minutes · verified accounts only · read by an editor before it appears

Reviews come only from verified accounts. Sign in or create an account first — your e-mail is never shown.

Your rating

0 characters · at least 80, up to 3,000

Posted from your verified account. Reviews appear after an editor reads them, usually within two working days.

Featured on iTechGuides

Featured on iTechGuides — KeyRack 7.3/10

KeyRack is listed in our Key Management Software directory. Add the badge to your site — it links back to this page.

<a href="https://www.itechguides.com/products/keyrack/"><img src="https://www.itechguides.com/best/badge/keyrack.svg" alt="Featured on iTechGuides" width="230" height="46"></a>

Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026

Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.

Last updated · How we research and update