Pre-release · —

Keep Hippo

Keep Hippo replicates Vault's wire protocol, not just its ideas: the /v1/ path model, the X-Vault-Token header, port 8200, and the VAULT_ADDR and VAULT_TOKEN environment variables. Point the real vault CLI at it and the commands work. Underneath is a first-party implementation of the parts that matter — a sealed storage barrier, Shamir unseal, secrets engines, auth methods, ACL policies, tokens and leases — shipped as a single Go binary with its own console and its own branding.

Download keephippo.com

macOS · Linux · Windows  ·  Go · single binary  ·  MPL-2.0

What it does

Vault-compatible secrets manager

A from-scratch secrets manager that speaks HashiCorp Vault's HTTP API, so the Vault clients you already have keep working. Server, CLI and web console in one Go binary.

Not audited. Keep Hippo is an educational implementation of a secrets manager and has not undergone a security audit. Do not use it to protect real secrets until a release says otherwise — see SECURITY.md.

Vault CLI parity

Every verb, --format=json included. Scripts written against vault run against keephippo without a diff.

Barrier & Shamir seal

Storage sits behind an encrypted barrier that starts sealed. Unsealing takes a threshold of key shares, exactly as it should.

KV v1 and v2

Both engines, with versioning, soft delete and check-and-set on v2 — mounted at whatever path you choose.

Auth methods

Token, userpass and approle, with the full token lifecycle: creation, renewal, revocation and orphaning.

ACL policies

Path-based policies with capability lists, attached to tokens at login and enforced on every request.

Leases & transit

A real expiration manager that revokes on schedule, plus a transit engine for encryption-as-a-service against named keys.

Downloads

Get Keep Hippo

Version — · free to download and use. No account required.

We think you're on . Download
macOS
macOS 12 Monterey or later
Download for macOS
Latest release on GitHub
Windows
Windows 10 / 11
Download for Windows
Latest release on GitHub
Linux
64-bit · glibc 2.28+
Download for Linux
Latest release on GitHub

Every build is published on GitHub Releases, where you will also find the release notes and every previous version. Prefer to build it yourself? The source is right there.

Its own site

Keep Hippo has a home of its own

keephippo.com carries the full guide, the complete download list, and every release note.

Open keephippo.com
keephippo.com
Loading keephippo.com…
Open keephippo.com

That is keephippo.com itself, live — not a screenshot. Click anywhere on it to open the real thing.

Where to go next

Keep Hippo, everywhere else

The herd page is the introduction. These are the places the project actually lives.

keephippo.comThe project's own website jfigge/keephippoSource, issues and releases User guideEvery feature, documented READMEThe short version, on GitHub The rest of the herdFive more hippos
PreviousJump Hippo NextMind Hippo